Skip to content

WolfPack Installation

The installation process has prerequisite software that will need to be on hand and, in addition, specific hardware requirements.

1.0 System Requirements

1.1 Hardware Requirements

1.1.1 Supported Servers

  • Cisco UCS C240-M6N (2RU) or C240-M6N (2RU) with the following hardware:
    • 2 x UCSC-PCIE-IQ10GF
    • 192 Gb RAM
    • 2 x 24 Core Processors
    • UCSC-P-IQ1GC
    • TPM
    • Dual M.2 Drive Boot Raid
    • Rails
  • Cisco UCS C220-M7N (1RU)
    • 2 x UCSC-PCIE-IQ10GF
    • 192 Gb RAM
    • 2 x 24 Core Processors
    • TPM
    • Rails
    • 1 x UCSC-O-ID10GC-D
    • 1 x UCSC-OCP3-K
    • 1 x UCS-NVME4-1920-D
    • 2 x UCS-NVM2-400GB
    • 1 x UCS-M2-NVRAID

1.1.2 Required SFPs and Cableing

  • SFPs:
    • 6 Multi-Mode SFPs
    • 3 Copper SFP
  • Cable:
    • 1 Multi-Mode Fiber 1 Meter
    • 1 Multi-Mode Fiber (Length Determined by distance to ISP Handoff)
    • 1 Multi-Mode Fiber (Length Determined by distance to Service Switches)
    • 3 Green Cooper Patch Cables

1.2 Software Requirements

WolfPack requires the following Software to complete the installation:

  • VMware ESXi 8
  • Cisco Secure Firewall Threat Defense Virtual (7.4.1 or Higher)
  • Palo Alto VM Series (11.1.2-h3 or Higher)
  • Catalyst 8000V Edge Software (17.13.1a or Higher)
  • PowerShell 7 (latest Version)
  • PowerShell Modules:
    • VMware.PowerCLI
    • GooseSuite
    • Cisco.IMC
    • psyml

Info

For the remainder of the guide you will need to use your sites NAAS-001v Server. This server should have Powershell 7 and the required modules pre-installed.

1.3 Network Requirements

The Palo Alto firewall requires access to the internet. Please ensure that v998.eXX-net-mgt subnet is included in the allow-nat access list of your sites PE.

Please see the IP Cutsheet for Management IP Addresses WolfPack Management IP Address

1.4 Cabling for Security Stack Server Connecting to Service Switch Stack

Below you will find the Cableing Connections based on the server type you have deployed you will need these in Section 2.1

1.4.1 Cisco C240-M6(N/S) Cable Diagram

Cisco C240-M6(S/N) Cable Diagram
Figure 1. Cisco C240-M6(S/N) Cable Diagram

1.4.2 Cisco C220-M7N Cable Diagram

Cisco C220-M7N Cable Diagram
Figure 2. Cisco C220-M7N Cable Diagram

2.0 Hardware Installation

When you recieve your Security Stack Server, you will need to unbox the unit. Check to make sure you have power cables for the device. Verify your ISP media handoff (Single Mode Fiber / Multimode Fiber / Copper, etc). Make sure you have the correct SFP for the handoff.

2.1 Connect your Security Stack to Network Infrastructure

Next we will connect to the service switch. Please reference Section 1.4

Warning

If you do not have Service Switches you will only need to connect the copper ports for provisioning. We will touch on what will be needed for loopback testing later on in this guide if you dont have service switches.

Find open ports on your service switch stack or other switch if you dont have service switches, and connect your ports with the the only exception being in the warning box above.

Warning

This section is only for deployments utilizing a Service Switch Stack.

This is the connection to port 2 in PCIe Slot 1 on both the the M6 and M7 series.

conf t
 interface twe X/0/X
  description UPLINK TO SS ips-2 vSwitch
  switchport
  switchport mode trunk
  switchport trunk native vlan 3
  switchport trunk allowed vlan 3600-3604

This is the connection to onboard port 2 for the M6 series and port 2 in the MLOM slot on the M7 series. This will provide connectivity for the oobm interfaces on the virtual network devices.

conf t
 interface twe X/0/X
  description UPLINK TO SS oobm vSwitch
  switchport
  switchport mode trunk
  switchport trunk native vlan 997
  switchport trunk allowed vlan 998

This is the connection to onboard port 1 for the M6 series and port 1 in the MLOM slot on the M7 series. This will provide connectivity for VMware management.

conf t
 interface twe X/0/X
  description UPLINK TO SS vSwitch0 vSwitch
  switchport
  switchport mode trunk
  switchport trunk native vlan 997
  switchport trunk allowed vlan 3000

3.0 VMware ESXI Installation

For the ESXI install, we will be installing it manually. NetOPS has written a SOP for how to insteall the ESXI manually once you have the Security Stack cabled up.

You can find the SOP in the following location:

\e01-fs-001v\ANGEL\03 Netops\NETOPS\Ashleigh WIP\Security Stack\Security Stack (ESXI MANUAL INSTALL)

4.0 VMware vSwitch Configuration

Below is the diagram that depicts the vSwitches and associated port groups required to support Wolfpack. These vSwitches are virtual standard switches and NOT virtual distributed switches.

ANGEL Edge
Figure 3. WolfPack vSwitches

4.1 Common Variables

Before continuing you will need to RDP into your local NAAS-001v server and ensure you can ping the new Security Stacks' vSphere IP address.

The code block below will set common varibles used in other sections. Please edit the follwing varibles:

  • $serverName (Replace with Security Stacks' vSphere Host IP or FQDN)
  • $site (Replace with the site name you are deploying to)

Warning

If you are deploying this in the Lab the Site will be E00

Info

  1. Copy the script below by clicking the copy image in the top right corner of the code block.
  2. Paste it into VS Code on your local NAAS server, then edit the script from there.
Common Variables
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# Update with the Security Stack vSphere Host IP or FQDN
$serverName = "Security Stacks' vSphere Host IP or FQDN"

# Update to Site number
$site = "EXX"

# 8000v OVF Path (Update as version changed)
$cisco8000vOVFPath = '\\angel.net\software\01 Third Party\Cisco\Device Software\C8000v\17.13.01a\c8000v-universalk9_vga.17.13.01a.ovf'

# 8000v OVA Path (Update as version changed)
$cisco8000vOVAPath = '\\angel.net\software\01 Third Party\Cisco\Device Software\C8000v\17.13.01a\c8000v-universalk9.17.13.01a.ova'

# Palo Alto OVF (Update as version changed)
$paloAltoVMFwOVF = '\\angel.net\software\20 Fabrics\WolfPack\Palo Alto\11.1.0\PA-VM-ESX-11.1.0.ovf'

# Cisco IPS OVF (Update as version changed)
$ciscoSftdvOvf = '\\angel.net\Software\20 Fabrics\WolfPack\Cisco\SFTDv\7.4.1-172\Cisco_Secure_Firewall_Threat_Defense_Virtual-VI-7.4.1-172.ovf'

#region Do not edit
$vCentercreds = Get-Credential -Username "$ENV:USERNAME@angel.net"
$securityStackHostCredentials = Get-Credential -UserName root -Message "Enter the Security Stack Root Password"

# Connect to the vCenter or ESXi host
Connect-VIServer -Server $serverName -Credential $securityStackHostCredentials -Force
#endregion Do not edit

Once the document is edited, open Powershell 7 and paste the entire script into powershell. Hit enter to run the script. The script will make your username your "ADF" username (as shown in Powershell) and will ask for a password. Enter one. It will then ask for a "root" password. Use the root password from your ESXI install.

4.2 vSwitch Config

On your local NAAS-001v server execute the following code. The following code block provides the necessary PowerCLI code to create vSwitches.

Note

No Editing is required in the following script

# Get the ESXi host object
$vmwareHost = Get-VMHost -Name $serverName

$virtualSwitches = @(
    "angel",
    "wan",
    "ips-1",
    "ips-2",
    "srtn",
    "isp",
    "oobm"
)
$numPorts = 128
$mtu = 9000

foreach($virtualSwitch in $virtualSwitches)
{
    $vmwareHost | New-VirtualSwitch -Name $virtualSwitch -NumPorts $numPorts -Mtu $mtu
}

4.3 vSwitch PortGroup Config

On your local NAAS-001v server execute the following code. The following code block provides the necessary PowerCLI code to create port groups on associated vSwitches.

Note

No Editing is required in the following script

VMware PortGroups
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
# Get the ESXi host object
$vmwareHost = Get-VMHost -Name $serverName

$portGroups = @(
    @{
        switch            = "isp"
        name              = "pg-isp"
        vid               = "0"
        promiscuousMode   = $true
        macAddressChanges = $true
        forgedTransmits   = $true
    },
    @{
        switch            = "wan"
        name              = "pg-wan-fw"
        vid               = "0"
        promiscuousMode   = $true
        macAddressChanges = $true
        forgedTransmits   = $true
    },
    @{
        switch = "wan"
        name   = "pg-wan"
        vid    = "0"
    },
    @{
        switch = "angel"
        name   = "pg-angel-bdr"
        vid    = "0"
    },
    @{
        switch = "angel"
        name   = "pg-angel-ext"
        vid    = "0"
    },
    @{
        switch = "srtn"
        name   = "pg-srtn-angel"
        vid    = "3600"
    },
    @{
        switch = "srtn"
        name   = "pg-srtn-vrf_vvoip"
        vid    = "3601"
    },
    @{
        switch = "srtn"
        name   = "pg-srtn-vrf_haipe"
        vid    = "3602"
    },
    @{
        switch = "srtn"
        name   = "pg-srtn-vrf_ess"
        vid    = "3603"
    },
    @{
        switch = "srtn"
        name   = "pg-srtn-vrf_oobm"
        vid    = "3604"
    },
    @{
        switch            = "ips-1"
        name              = "pg-ips1"
        vid               = "4095"
        promiscuousMode   = $true
        macAddressChanges = $true
        forgedTransmits   = $true
    },
    @{
        switch            = "ips-2"
        name              = "pg-ips2"
        vid               = "4095"
        promiscuousMode   = $true
        macAddressChanges = $true
        forgedTransmits   = $true
    }
    @{
        switch = "oobm"
        name   = "pg-oobm-net-mgt"
        vid    = "998"
    }
)

foreach ($portGroup in $portGroups) {
    # Create the port group
    $vmwareHost | Get-VirtualSwitch -Name $portGroup.switch | New-VirtualPortGroup -Name $portGroup.name -VlanId $portGroup.vid

    if ($portGroup.Keys -Contains "promiscuousMode") {
        $portGroupObject = Get-VirtualPortGroup -VMHost $vmwareHost -VirtualSwitch $portGroup.switch -Name $portGroup.name

        $securityPolicySplatting = @{
            AllowPromiscuous = $portGroup.promiscuousMode
            MacChanges       = $portGroup.macAddressChanges
            ForgedTransmits  = $portGroup.forgedTransmits
            Confirm          = $false
        }
        $portGroupObject | Get-SecurityPolicy | Set-SecurityPolicy @securityPolicySplatting
    }
}

5.0 vSphere DataStore

We will need to create a datastore using one of the NVMe drive located in slot 1 or 2 of the Server. The following PowerCLI Code will get one of those drives and provision a datastore named WolfPack with it. On your local NAAS-001v server execute the following code.

New-Datastore -Name "WolfPack" -Path (Get-SCSILun | Where-Object -Property CanonicalName -Match "NVMe" | Get-Random)

6.0 Deploy Cisco 8000v

The Cisco Catalyst 8000V Edge Software (Catalyst 8000V) is a virtual-form-factor router that delivers comprehensive WAN gateway, and network services functions into virtual enviroments.

In Wolfpack the 8000v is used as a Provider Edge (PE) and Session Border Controller (SBC) services to a site.

Please ensure you have the proper version of the software prior to deploying the OVA.

6.1 Provider Edge OVA Deployment

Login to the vSphere host that is being used for Wolfpack

PE Deployment
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
Disconnect-VIServer * -Confirm:$false -Force

#Change to your sites VCSA
Connect-VIServer "$site-VCSA-001v.angel.net" -Credential $vCentercreds -Force

#Get OVF Configuration Items for Deployment
$peConfig = Get-OvfConfiguration -Ovf $cisco8000vOVAPath

Disconnect-VIServer * -Confirm:$false -Force

#Set OVF Configuration Items
$peConfig.DeploymentOption.Value = "8CPU-16GB-16GB"
$peConfig.NetworkMapping.GigabitEthernet1.Value = "pg-oobm-net-mgt"
$peConfig.NetworkMapping.GigabitEthernet2.Value = "pg-wan"
$peConfig.NetworkMapping.GigabitEthernet3.Value = "pg-srtn-vrf_haipe"

Connect-VIServer $serverName -Credential $securityStackHostCredentials -Force   
$vAppSplatting = @{
    Datastore        = Get-Datastore -Name "WolfPack"
    Location         = Get-VMHost
    Source           = $cisco8000vOVFPath
    Name             = "$site-PE-001v"
    Force            = $true
    VMHost           = Get-VMHost
    OvfConfiguration = $peConfig
}

Import-VApp @vAppSplatting

#Create additional Network Adapter for PE
Get-VM -Name "$site-PE-001v" | New-NetworkAdapter -StartConnected -Type Vmxnet3 -NetworkName "pg-angel-bdr"
Get-VM -Name "$site-PE-001v" | New-NetworkAdapter -StartConnected -Type Vmxnet3 -NetworkName "pg-angel-ext"
Get-VM -Name "$site-PE-001v" | New-NetworkAdapter -StartConnected -Type Vmxnet3 -NetworkName "pg-srtn-vrf_ess"
Get-VM -Name "$site-PE-001v" | New-NetworkAdapter -StartConnected -Type Vmxnet3 -NetworkName "pg-oobm-net-mgt"

6.2 Session Border Controller (SBC) OVA Deployment

The Following is used to deploy the Session border Controller for the site.

SBC Deployment
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
Disconnect-VIServer * -Confirm:$false -Force

#Change to your sites VCSA
Connect-VIServer "$site-VCSA-001v.angel.net" -Credential $vCentercreds -Force

#Get OVF Configuration Items for Deployment
$sbcConfig = Get-OvfConfiguration -Ovf $cisco8000vOVAPath

Disconnect-VIServer * -Confirm:$false -Force

#Set OVF Configuration Items
$sbcConfig.DeploymentOption.Value = "8CPU-16GB-16GB"
$sbcConfig.NetworkMapping.GigabitEthernet1.Value = "pg-oobm-net-mgt"
$sbcConfig.NetworkMapping.GigabitEthernet2.Value = "pg-wan"
$sbcConfig.NetworkMapping.GigabitEthernet3.Value = "pg-srtn-vrf_vvoip"

Connect-VIServer $serverName -Credential $securityStackHostCredentials -Force

$vAppSplatting = @{
    Datastore        = Get-Datastore -Name "WolfPack"
    Location         = Get-VMHost
    Source           = $cisco8000vOVFPath
    Name             = "$site-SBC-001v"
    Force            = $true
    VMHost           = Get-VMHost
    OvfConfiguration = $sbcConfig
}

Import-VApp @vAppSplatting

6.3 Route Server (RS) OVA Deployment

The Following is used to deploy the Session border Controller for the site.

SBC Deployment
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
Disconnect-VIServer * -Confirm:$false -Force

#Change to your sites VCSA
Connect-VIServer "$site-VCSA-001v.angel.net" -Credential $vCentercreds -Force

#Get OVF Configuration Items for Deployment
$rsConfig = Get-OvfConfiguration -Ovf $cisco8000vOVAPath

Disconnect-VIServer * -Confirm:$false -Force

#Set OVF Configuration Items
$sbcConfig.DeploymentOption.Value = "8CPU-16GB-16GB"
$sbcConfig.NetworkMapping.GigabitEthernet1.Value = "pg-oobm-net-mgt"
$sbcConfig.NetworkMapping.GigabitEthernet2.Value = "pg-angel-ext"

Connect-VIServer $serverName -Credential $securityStackHostCredentials -Force

$vAppSplatting = @{
    Datastore        = Get-Datastore -Name "WolfPack"
    Location         = Get-VMHost
    Source           = $cisco8000vOVFPath
    Name             = "$site-rs-001v"
    Force            = $true
    VMHost           = Get-VMHost
    OvfConfiguration = $rsConfig
}

Import-VApp @vAppSplatting

7.0 Palo Alto VM Deployment

We should put in the SBC / PE router configs before continuing with the Firewalls, correct?

This section will focus on the deployment of the Data Firewall as well as the Out-of-Band Management Firewall for WolfPack. This will only deploy the VM and we will explore adding it to Panorama in a later section.

The Following PowerCLI Code can be used to deploy the two firewalls.

New-GSPAFirewallDeployment
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
$firewalls = @(
    @{
        Name        = "$site-FW-001v"
        NetAdapters = @(
            @{
                Name      = "Network adapter 1"
                PortGroup = "pg-oobm-net-mgt"
            },
            @{
                Name      = "Network adapter 2"
                PortGroup = "pg-angel-bdr"
            }
            @{
                Name      = "Network adapter 3"
                PortGroup = "pg-angel-ext"
            }
            @{
                Name      = "Network adapter 4"
                PortGroup = "pg-srtn-angel"
            },
            @{
                Name      = "Network adapter 5"
                PortGroup = "pg-isp"
            },
            @{
                Name      = "Network adapter 6"
                PortGroup = "pg-wan-fw"
            }
        )
    },
    @{
        Name        = "$site-FW-002v"
        NetAdapters = @(
            @{
                Name      = "Network adapter 1"
                PortGroup = "pg-oobm-net-mgt"
            },
            @{
                Name      = "Network adapter 2"
                PortGroup = "pg-angel-bdr"
            }
            @{
                Name      = "Network adapter 3"
                PortGroup = "pg-angel-ext"
            }
            <#
            Will implent this PG later when fully standing up OOBM Firewalls
            @{
                Name = "Network adapter 4"
                PortGroup = "pg-oobm-net-mgt"
            },
            @{
                Name = "Network adapter 5"
                PortGroup = "pg-oobm-ext"
            },
            @{
                Name = "Network adapter 6"
                PortGroup = "pg-srtn-vrf_oobm"
            }
            #>
        )
    }
)

Connect-VIServer $serverName -Credential $securityStackHostCredentials -Force   

foreach ($firewall in $firewalls) {
    $fwvAppSplatting = @{
        Datastore = Get-Datastore -Name "WolfPack"
        Location  = Get-VMHost
        Source    = $paloAltoVMFwOVF
        Name      = $firewall.Name
        Force     = $true
        VMHost    = Get-VMHost
    }

    Import-VApp @fwvAppSplatting

    $networkAdapters = Get-VM "$($firewall.Name)" | Get-NetworkAdapter | Select-Object -ExpandProperty Name

    foreach ($netAdapter in $firewall.NetAdapters) {
        if (!($networkAdapters.Contains("$($netAdapter.Name)"))) {
            $networkAdapterSplatting = @{
                NetworkName    = "$($netAdapter.PortGroup)"
                StartConnected = $true
                Type           = "Vmxnet3"
                Confirm        = $false
            }
            Get-VM "$($firewall.Name)" | New-NetworkAdapter @networkAdapterSplatting 
        }
        else {
            Get-VM "$($firewall.Name)" | Get-NetworkAdapter -Name "$($netAdapter.Name)" |  Set-NetworkAdapter -NetworkName "$($netAdapter.PortGroup)" -Confirm:$false
        }
    }
}

7.1 Panorama Configuration Data FW (FW-001v)

The folloiwng code is responsible for generating the device template on Panorama for the Data Firewall at the site.

New-GSPAFirewallSettings
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
function Set-GSSiteIPFormat {
  [CmdletBinding()]
  param (
    [Parameter(Mandatory = $true)]
    [String]
    $Site
  )

  if ($Site -match "^(?i)E\d$") {
    $ip = $Matches[0]
    $ip = $ip.Replace("E", "")
  }
  if ($Site -match "^(?i)E0\d$") {
    $ip = $Matches[0]
    $ip = $ip.Replace("E0", "")
  }
  if ($Site -match "^(?i)E1\d$") {
    $ip = $Matches[0]
    $ip = $ip.Replace("E", "")
  }
  $ip

}
$siteIP = Set-GSSiteIPFormat -Site $site

$panoramaUri = "https://e01-nm-001v.netops.angel.net/"
$apiKey = (Invoke-RESTMethod -Method Get -Uri "$($panoramaUri)api/?type=keygen&user=admin&password=12qwaszx!@QWASZX" -SkipCertificateCheck).response.result.key

$header = @{
  'X-PAN-KEY' = $apiKey
}

$templateName = "$site-FW-001v.nsd.angel.net"

#region Create Template
$panoramaTemplate = @{
  entry = @{
    '@name'     = "$templateName"
    description = "$site Data Firewall"
    settings    = @{
      "enable-clustering" = "no"
    }
  }
}

$templateApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Panorama/Templates?name=$templateName"
  Method               = "POST"
  SkipCertificateCheck = $true
  Body                 = $panoramaTemplate | ConvertTo-Json -Depth 10
  Header               = $header
  ContentType          = "application/json"
}
Invoke-RestMethod @templateApiCall
#endregion Create Template

#region Create Virtual Router
# Create Virtual Router in Template
$panoramaVirtualRouter = @{
  entry = @{
    '@name' = "angel"
  }
}
$virtualRouterApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Network/VirtualRouters?name=angel&location=template&template=$templateName"
  Method               = "POST"
  SkipCertificateCheck = $true
  Body                 = $panoramaVirtualRouter | ConvertTo-Json -Depth 10
  Header               = $header
}
Invoke-RestMethod @virtualRouterApiCall

#endregion Create Virtual Router

#region Create Virtual Wire
#Create Virtual Wires
$panoramaVirtualWire = @{
  entry = @{
    '@name' = "border"
  }
}
$virtualWireApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Network/VirtualWires?name=border&location=template&template=$templateName"
  Method               = "POST"
  SkipCertificateCheck = $true
  Body                 = $panoramaVirtualWire | ConvertTo-Json -Depth 10
  Header               = $header
}
Invoke-RestMethod @virtualWireApiCall

#endregion Create Virtual Wire

#region Create Zones
#Create Zones
$zones = @(
  @{
    name = "angel-bdr"
    type = "layer3"
  },
  @{
    name = "angel-ext"
    type = "layer3"
  },
  @{
    name = "angel-int"
    type = "layer3"
  },
  @{
    name = "dmz"
    type = "virtual-wire"
  },
  @{
    name = "internet"
    type = "virtual-wire"
  }
)
foreach ($zone in $zones) {
  $zonesJson = @{
    entry = @{
      '@name'   = "$($zone.name)"
      'network' = if ($zone.type -eq "layer3") {
        @{
          layer3                  = @{}
          'prenat-identification' = @{}
        }
      }
      elseif ($zone.type -eq "virtual-wire") {
        @{
          "virtual-wire"          = @{}
          'prenat-identification' = @{}
        }
      }
    }
  }
  $zoneApiCall = @{
    Uri                  = "$($panoramaUri)restapi/v11.1/Network/Zones?name=$($zone.name)&vsys=vsys1&location=template&template=$templateName"
    Method               = "POST"
    SkipCertificateCheck = $true
    Body                 = $zonesJson | ConvertTo-Json -Depth 10
    Header               = $header
  }
  Invoke-RestMethod @zoneApiCall
}

#endregion Create Zones

#region Edit default vsys
$panoramaTemplateEdit = @{
  entry = @{
    settings = @{
      "default-vsys" = "vsys1"
    }
  }
}

$templateApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Panorama/Templates?name=$templateName"
  Method               = "PUT"
  SkipCertificateCheck = $true
  Body                 = $panoramaTemplateEdit | ConvertTo-Json -Depth 10
  Header               = $header
  ContentType          = "application/json"
}
Invoke-RestMethod @templateApiCall
#endregion Edit default vsys

#region Interface Management Network Profile
$interfaceManagementProfiles = @(
  @{
    name      = "allow-ping-angel-ext"
    ping      = $true
    https     = $false
    http      = $false
    ssh       = $false
    telnet    = $false
    snmp      = $false
    permitted = @(
      "10.$siteIP.229.8/29"
    )
  },
  @{
    name      = "allow-ping-angel-bdr"
    ping      = $true
    https     = $false
    http      = $false
    ssh       = $false
    telnet    = $false
    snmp      = $false
    permitted = @(
      "10.$siteIP.229.0/29"
    )
  },
  @{
    name      = "allow-ping-angel-int"
    ping      = $true
    https     = $false
    http      = $false
    ssh       = $false
    telnet    = $false
    snmp      = $false
    permitted = @(
      "0.0.0.0/0"
    )
  }
)
foreach ($interfaceManagementProfile in $interfaceManagementProfiles) {
  $interfaceManagementProfilePayload = @{
    entry = @{
      '@name'        = $interfaceManagementProfile.name
      ping           = ($interfaceManagementProfile.ping) ? 'yes' : 'no'
      https          = ($interfaceManagementProfile.https) ? 'yes' : 'no'
      http           = ($interfaceManagementProfile.http) ? 'yes' : 'no'
      ssh            = ($interfaceManagementProfile.ssh) ? 'yes' : 'no'
      telnet         = ($interfaceManagementProfile.telnet) ? 'yes' : 'no'
      snmp           = ($interfaceManagementProfile.snmp) ? 'yes' : 'no'
      'permitted-ip' = @{
        entry = @()
      }
    }
  }
  foreach ($permittedIp in $interfaceManagementProfile.permitted) {
    $interfaceManagementProfilePayload.entry.'permitted-ip'.entry += @{
      '@name' = $permittedIp
    }
  }

  $interfaceManagementProfileApiCall = @{
    Uri                  = "$($panoramaUri)restapi/v11.1/Network/InterfaceManagementNetworkProfiles?name=$($interfaceManagementProfile.name)&location=template&template=$templateName"
    Method               = "POST"
    SkipCertificateCheck = $true
    Body                 = $interfaceManagementProfilePayload | ConvertTo-Json -Depth 10
    Header               = $header
    ContentType          = "application/json"
  }
  Invoke-RestMethod @interfaceManagementProfileApiCall
}
#endregion

#region Ethernet Interfaces
$interfaces = @(
  @{
    name    = 'ethernet1/1'
    comment = 'angel-bdr'
    mtu     = '1500'
    layer3  = @{
      ip                             = "10.$siteIP.229.2/29"
      'interface-management-profile' = "allow-ping-angel-bdr"
    }
  },
  @{
    name    = 'ethernet1/2'
    comment = 'angel-ext'
    mtu     = '1400'
    layer3  = @{
      ip                             = "10.$siteIP.229.10/29"
      'interface-management-profile' = "allow-ping-angel-ext"
    }
  },
  @{
    name    = 'ethernet1/3'
    comment = 'angel-int'
    mtu     = '1400'
    layer3  = @{
      ip                             = "10.$siteIP.229.18/29"
      'interface-management-profile' = "allow-ping-angel-int"
    }
  }
  @{
    name           = 'ethernet1/4'
    'virtual-wire' = @{}
  },
  @{
    name           = 'ethernet1/5'
    'virtual-wire' = @{}
  }
  <#
  @{
    name           = 'ethernet1/8'
    comment = 'Trunk'
    mtu     = '1500'
    layer3  = @{
      ip                             = "10.$siteIP.229.18/29"
      'interface-management-profile' = "allow-ping-angel-int"
    }
  }
  #>
)

foreach ($interface in $interfaces) {
  if ($interface.ContainsKey('layer3')) {
    $interfacePayload = @{
      entry = @{
        layer3  = @{
          mtu                            = $interface.layer3.mtu
          'interface-management-profile' = $interface.layer3.'interface-management-profile'
          ip                             = @{
            entry = @(
              @{
                '@name' = "$($interface.layer3.ip)" 
              }
            )
          }
        }
        '@name' = $interface.name
      }
    }
  }
  elseif ($interface.ContainsKey('virtual-wire')) {
    $interfacePayload = @{
      entry = @{
        '@name'        = $interface.name
        'virtual-wire' = @{}
      }
    }
  }
  $interfaceApiCall = @{
    Uri                  = "$($panoramaUri)restapi/v11.1/Network/EthernetInterfaces?name=$($interface.name)&location=template&template=$templateName"
    Method               = "POST"
    SkipCertificateCheck = $true
    Body                 = $interfacePayload | ConvertTo-Json -Depth 10
    Header               = $header
    ContentType          = "application/json"
  }
  Invoke-RestMethod @interfaceApiCall
}
#endregion

#region Assign Interface to Vysy and Security Zone
$zoneinterfaces = @(
  @{
    name     = 'ethernet1/1'
    zoneName = 'angel-bdr'
    type     = 'layer3'
  },
  @{
    name     = 'ethernet1/2'
    zoneName = 'angel-ext'
    type     = 'layer3'
  },
  @{
    name     = 'ethernet1/3'
    zoneName = 'angel-int'
    type     = 'layer3'
  },
  @{
    name     = 'ethernet1/4'
    zoneName = 'internet'
    type     = 'virtual-wire'
  },
  @{
    name     = 'ethernet1/5'
    zoneName = 'dmz'
    type     = 'virtual-wire'
  }    
)
$vsysadditionPayload = @{
  entry = @{
    '@name' = 'vsys1'
    import  = @{
      network = @{
        interface        = @{
          member = @()
        }
        'virtual-wire'   = @{
          member = @(
            "border"
          )
        }
        'virtual-router' = @{
          member = @(
            "angel"
          )
        }
      }
    }
  }
}

foreach ($zoneinterface in $zoneinterfaces) {
  $vsysadditionPayload.entry.import.network.interface.member += $zoneinterface.name
}

$vsysadditionApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Device/VirtualSystems?name=vsys1&location=template&template=$templateName"
  Method               = "PUT"
  SkipCertificateCheck = $true
  Body                 = $vsysadditionPayload | ConvertTo-Json -Depth 10
  Header               = $header
  ContentType          = "application/json"
}
$vsysadditionPayload | ConvertTo-Json -Depth 10
Invoke-RestMethod @vsysadditionApiCall

foreach ($zoneinterface in $zoneinterfaces) {

  $zoneinterfacePayload = @{
    entry = @{
      '@name' = $zoneinterface.zoneName
      network = @{
        "$($zoneinterface.type)" = @{
          member = @(
            "$($zoneinterface.name)"
          )
        }
        'prenat-identification'  = @{}
      }
    }
  }
  $editSecurityZoneApiCall = @{
    Uri                  = "$($panoramaUri)restapi/v11.1/Network/Zones?name=$($zoneinterface.zoneName)&vsys=vsys1&location=template&template=$templateName"
    Method               = "PUT"
    SkipCertificateCheck = $true
    Body                 = $zoneinterfacePayload | ConvertTo-Json -Depth 10
    Header               = $header
    ContentType          = "application/json"
  }
  Invoke-RestMethod @editSecurityZoneApiCall
}
#endregion

#region Configure Virtual Router
$virtualRouterOspfPayload = @{
  entry = @{
    '@name'   = 'angel'
    interface = @{
      member = @(
        'ethernet1/1',
        'ethernet1/2',
        'ethernet1/3'
      )
    }
    protocol  = @{
      ospf = @{
        enable                 = 'yes'
        'router-id'            = if ($templateName -match "E\d\d-FW-001v") {
          "172.30.$siteIP.101"
        }
        elseif ($templateName -match "E\d\d-FW-002v") {
          "172.30.$siteIP.102"
        }
        'reject-default-route' = 'no'
        area                   = @{
          entry = @(
            @{
              '@name'   = '0.0.0.0'
              type      = @{
                normal = @{}
              }
              interface = @{
                entry = @(
                  @{
                    '@name' = 'ethernet1/1'
                    enable  = 'yes'
                  },
                  @{
                    '@name' = 'ethernet1/2'
                    enable  = 'yes'
                  },
                  @{
                    '@name' = 'ethernet1/3'
                    enable  = 'yes'
                  }
                )
              }
            }
          )
        }
      }
    }
  }
}

$editvirtualRouterOspfApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Network/VirtualRouters?name=angel&location=template&template=$templateName"
  Method               = "PUT"
  SkipCertificateCheck = $true
  Body                 = $virtualRouterOspfPayload | ConvertTo-Json -Depth 10
  Header               = $header
  ContentType          = "application/json"
}
Invoke-RestMethod @editvirtualRouterOspfApiCall

#endregion Configure Virtual Router

#region Create Template Stack
$panoramaTemplateStack = @{
  entry = @{
    '@name'     = "$($templateName)_Stack"
    description = "$site Data Firewall Stack"
    templates   = @{
      member = @(
        "$($templateName)",
        "ANGEL Firewalls"
      )
    }
  }
}

$templateStackApiCall = @{
  Uri                  = "$($panoramaUri)restapi/v11.1/Panorama/TemplateStacks?name=$($templateName)_Stack"
  Method               = "POST"
  SkipCertificateCheck = $true
  Body                 = $panoramaTemplateStack | ConvertTo-Json -Depth 10
  Header               = $header
  ContentType          = "application/json"
}
Invoke-RestMethod @templateStackApiCall
#endregion Create Template Stack

7.1.1 Powering on/ Configuring Management Interface of Data FW (FW-001v)

Power on the Data Firewall in vSphere (FW-001v), and open the VM Console.

  1. Login to the device with the default username and password (admin/admin). You will have to put in a new password here. Put in the NetOps zipper password.
  2. Enter configuration mode using the command configure

  3. Use the following command to set the IP address of the management interface:

    set deviceconfig system type static
set deviceconfig system ip-address (ip address) 
set deviceconfig system netmask (netmask) 
set deviceconfig system default-gateway (default gateway) 
set deviceconfig system dns-setting servers primary (DNS ip address).
commit
exit

Now Log into the new Firewall to get to the default GUI. Go to DEVICE > GENERAL SETTINGS. Hit the cogwheel (edit). Put in the new Hostname (EXX-FW-001v) and the domain (angel.net).

7.1.2 Add a new firewall to the Palo Alto Account

We also need to add new firewalls to the Palo Alto account to register/license the new device.

Note

You need a "Customer Support Portal" account to complete this section. If you do not have one reach out to NETOPS to be added to the account.

  1. Log into Paloalto Account (support.paloaltonetworks.com)

  2. On the left mecu, select "Products" > "Software NGFW Credits".

  3. Select "Details" on the box near the bottom and you'll see the "Authorization Code" (AUTH CODE - short number under "Wolfpack"). Copy this down.

  4. Navigate to the newly installed firewall via the web browser.

  5. Go to DEVICE > SETUP > SERVICES. Make sure "Update Server" is set to updates.paloaltonetworks.com and confirm "Verify Update Server Identity" is selected.

  6. Go to DEVICE > LICENSES.

  7. Select "Activate feature using authorization code". Enter the code you copied. Hit OK and the Firewall will get the license updates.

Note

This may take awhile. You can confirm it was successful by going to the DASHBOARD and seeing a Serial Number and a "VM License".

7.1.3 Create Device Group

You will need to log in to Panorama, and from there, you will need to create a device group in panorama. Panorama is housed in the US-EAST Region and can be accessed via this link Panorama

Once you log in to Panorama, you will navigate to the Panorama tab in the top Navigation bar. See Figure 4 below for reference.

PAN TOPNAV
Figure 4. Panorama Top Nav

From here you will need to navigate to Device Groups. See Figure 5 below.

PAN SIDE NAV
Figure 5. Panorama Side Nav

Now, we will create a New Device Group for the sites' data firewall to be managed:

  1. Select Add at the bottom.
  2. In the Name Field Enter the Site Name in the Name Field (Eg. E02)
  3. In the Parent Device Group Field Select Angel BDR FWs
  4. Select Ok

7.1.4 Add device in Panorama

You will need to log in to Panorama, and from there, we will add the firewall as a managed device. Panorama is housed in the US-EAST Region and can be accessed via this link Panorama

Once you log in to Panorama, you will navigate to the Panorama tab in the top Navigation bar. See Figure 6 below for reference.

PAN TOPNAV
Figure 6. Panorama Top Nav

From here you will need to navigate to Managed Devices / Summary. See Figure 7 below.

PAN SIDE NAV
Figure 7. Panorama Side Nav

Now, we will add the firewall to be managed. Please login to the Firewall, and on the Dashboard page, the serial number will be listed. Take note of this for the Add Device dialog in Panorama.

Note

There is a SOP in case the serial number doesn't show up. This seems to be rare, but if it does happen the SOP will be helpful.

At the bottom, select the add button. We will need the serial number of the device being added. The Add Device Diaglog will appear. See Figure 8 below.

PAN ADD DEVICE
Figure 8. Panorama Add Device

Here, you will enter the serial number from the earlier. After entering the serial number, select the Generate Auth Key button. This will generate an auth key that will be needed to point the Firewall at Panorama. Please take note of this auth key for a later step.

After Selecting okay the Device Association Screen will appear. From here you will set the following fields:

  • Device Group: (For FW-001v Select the Site Under Angel BDR FWs)
  • Template Stack: Select the Name of the Firewall
  • Auto Push on 1st Connect: Check the box

Now select OK at the bottom.

Info

We need to commit our changes to the Panorama running configuration. Currently, they are only part of the candidate configuration.

In the top right of the screen click on the Commit drop down and select Commit to Panorama. Once the dialog appears Select commit at the bottom.

7.1.5 Pointing the Firewall at Panorama

Note

For this section, you must log in to the Firewall to be pointed at Panorama. Please consult the IP cut-sheet for the deployment.

Login to the Firewall via its IP Address. Once logged in, in the Top Nav Bar, select Device.

Once you are on the Device page, you should see Panorama Settings. Now select the cog wheel to the right of Panorama Settings. This will open the Panorama Settings Dialog.

Now enter the hostname of Panorama under Panorama Servers.

Info

Panorama FQDN: E01-NM-001v.netops.angel.net

Locate the Auth Key we generated in the earlier step and paste or type it into the Auth Key section. Now select OK.

Now select Commit on the top right of the top nav bar. Once the Commit Dialog

Now Navigate back to Panorama and go back to Managed Devices / Summary. In the list Your Firewall should show connected under Device State.

Warning

If your device is not connected, the E01 Data Firewall may be blocking connectivity from your firewall to Panorama. Contact E01 Network Operation for assistance.

Note

At this point, once the device shows "CONNECTED" and the policy/templates are synched, you should be sure your new FW has the latest Software OS. There is a SOP on how to update the Firewall OS that you can follow. Make sure it matches the Panorama Software OS version.

8.0 IPS Deployment

WolfPack provides Intrusion Prevention Services (IPS) to the Enclave. In this section, we will deploy the IPS and cover the associated steps to ensure the manager configures and adopts it properly.

Info

The IPS in WolfPack Only uses in-line pairs (ILP). An ILP is a set of bonded interfaces that act as a bump in the wire. It is transparent to the network and does not require an IP address to inspect traffic. The ILP allows the IPS to take action on the traffic.

8.1 IPS OVA Deployment

The folloiwng code is responsible for deploying the OVF for the IPS.

New-GSCiscoIpsDeployment
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
Disconnect-VIServer * -Confirm:$false -Force

#Change to your sites VCSA
Connect-VIServer "e01-VCSA-001v.angel.net" -Credential $vCentercreds -Force

#Get OVF Configuration Items for Deployment
$ipsConfig = Get-OvfConfiguration -Ovf $ciscoSftdvOvf

#Set OVF Configuration Items
$ipsConfig.DeploymentOption.Value = "16Core32GB"
$ipsConfig.NetworkMapping.Management0_0.Value = "pg-oobm-net-mgt"
$ipsConfig.NetworkMapping.Diagnostic.Value = "pg-oobm-net-mgt"
$ipsConfig.NetworkMapping.GigabitEthernet0_0.Value = "pg-ips1"
$ipsConfig.NetworkMapping.GigabitEthernet0_1.Value = "pg-ips2"

$ipsConfig.Common.pw.Value = '12qwaszx!@QWASZX'
$ipsConfig.Common.fqdn.Value = 'e00-ips-001v.netops.angel.net'
$ipsConfig.Common.dns1.Value = '10.255.255.253'
$ipsConfig.Common.dns2.Value = '10.255.255.254'
$ipsConfig.Common.searchdomains.Value = 'netops.angel.net'
$ipsConfig.Common.ipv4.how.Value = 'Manual'
$ipsConfig.Common.ipv4.addr.Value = '172.17.0.99'
$ipsConfig.Common.ipv4.mask.Value = '255.255.255.0'
$ipsConfig.Common.ipv4.gw.Value = '172.17.0.1'
$ipsConfig.Common.ipv6.how.Value = 'Manual'
$ipsConfig.Common.ipv6.addr.Value = 'fd00:e00:12::5'
$ipsConfig.Common.ipv6.mask.Value = '64'
$ipsConfig.Common.ipv6.gw.Value = 'fd00:e00:12::1'
$ipsConfig.Common.manageLocally.Value = 'No'
$ipsConfig.Common.firewallmode.Value = 'routed'
$ipsConfig.Common.DeploymentType.Value = 'c'
$ipsConfig.Common.mgr.Value = 'e01-nm-002v.netops.angel.net'
$ipsConfig.Common.regKey.Value = 'cisco123'

$vAppSplatting = @{
    Datastore = Get-Datastore -Name "WolfPack"
    Location = Get-VMHost
    Source = "$ciscoSftdvOvf"
    Name = "$site-IPS-001v"
    Force = $true
    VMHost = Get-VMHost
    OvfConfiguration = $ipsConfig
}

Import-VApp @vAppSplatting

<#
$datastore = Get-Datastore -Name "WolfPack"
New-PSDrive -Location $datastore -Name ds -PSProvider VimDatastore -Root "\"

if(!(Test-Path "ds:\day0-configs")){
    New-item  -Name day0-configs -Path ds:\
}
Copy-DatastoreItem -Item "day0.iso" -Destination "ds:\day0-configs\$($vAppSplatting.Name)\" -Force
#>


$vm = Get-VM -Name $vAppSplatting.Name
$vm | Start-VM
#$vm | Get-CDDrive| Set-CDDrive -Connected $true -IsoPath "[WolfPack] day0-configs\$($vAppSplatting.Name)\day0.iso" -StartConnected $true -Confirm:$false

If the code above does not deploy correctly, the instructions for manually creating the IPS and attaching it to the FMC are here

8.2 IPS Configuration