Palo Alto Pod with Win 10

0What you'll do

• Boot the PA-VM (paloalto-10.1.0) and complete first-time CLI bootstrap
• Use the included Win 10 client as a browser host to reach https://<pa-mgmt-ip>
• Configure Mgmt + a Trust + Untrust zone with two interfaces
• Push a default allow policy and verify ping from R2 (Inside) to a destination across the firewall

1Boot order

1. Start PA-VM — slowest, ~5 min to vm login:. Start it first so it has a head start.
2. Start IOL routers/switches (instant).
3. Start the Win 10 client last.

2First-time CLI bootstrap on PA-VM

Open the PA-VM console (telnet). Default login:

username: admin
password: admin     (PAN-OS will force a change on first login)

Set the Mgmt interface IP so Win 10 can browse to it:

configure
set deviceconfig system ip-address 192.168.10.10 netmask 255.255.255.0 default-gateway 192.168.10.1
set deviceconfig system hostname pa-fw01
set deviceconfig system dns-setting servers primary 1.1.1.1
commit
exit

3Reach the GUI from Win 10

1. Open the Win 10 VNC console.
2. Make sure Win 10's NIC is on the Mgmt subnet — usually auto-DHCP via the Mgmt bridge. If not: set static 192.168.10.30 / 24.
3. Open Edge. Browse to https://192.168.10.10.
4. Accept the self-signed cert warning (Advanced → Continue).
5. Log in with the new password you set in step 2.

4Configure zones + interfaces in the GUI

4.1 — Zones

Network → Zones → Add:

4.2 — Interfaces

Network → Interfaces → Ethernet:

4.3 — Virtual Router

Network → Virtual Routers → default → add both interfaces. Add a default route 0.0.0.0/0 next-hop 198.51.100.254 (or whatever your Outside R1 is).

5Add a security policy + NAT + commit

5.1 — Security policy (allow trust → untrust any)

Policies → Security → Add. Source zone trust, dest zone untrust, application any, service any, action Allow. Save.

5.2 — NAT

Policies → NAT → Add. Source zone trust, dest zone untrust, source translation: dynamic-ip-and-port, interface ethernet1/1, IP from interface. Save.

5.3 — Commit

Top-right → Commit. Wait 60-90 sec.

6Verify from R2 (Inside)

Open the R2 telnet console:

enable
configure terminal
interface Ethernet0/0
 ip address 10.10.10.10 255.255.255.0
 no shutdown
ip route 0.0.0.0 0.0.0.0 10.10.10.1
end
ping 198.51.100.254 source Ethernet0/0

Reply success ⇒ traffic is going R2 → PA (trust) → PA NAT → R1 (untrust). Confirm on the PA: Monitor → Traffic — your ICMP flow should show up with action allow.

7Troubleshooting