Requirements and Caveats

Please read before using the IronSkillet configuration templates.

Requirements

Using IronSkillet branch version panos_v10.0 requires the following to properly load into Panorama and/or the NGFW

• Running software version 10.0

  • Upgrade the firewall to 10.0

  • Upgrade Panorama to 10.0

• Active subscription for Threat Prevention

  • Activate the subscription licenses

• Updated application and antivirus content

  • Install content and software updates

Note

The links are specific to PAN-OS v10.0 and users may switch to 9.1, 9.0, or 8.1 based on deployed release

Note

Threat Prevention and the antivirus content update are both required to gain access to the Palo Alto Networks provided External Dynamic Lists (EDLs) used in the security policies.

Note

URL Filtering, DNS Cloud Service, and Wildfire subscriptions are not required to load the configuration but are highly recommended as part of the best practice to utilize IronSkillet elements such as the URL Filtering, Spyware, and Wildifre security profiles and associated profile groups

Caveats

Please review the following to understand any limitations or recommendations regarding the IronSkillet templates

• Be sure to edit or the default administrative superuser account if not part of initial configuration

  • If the default account information is used, the user is notified at login

  • To change or add superuser accounts see Configure a Firewall Administrator

• The current version only supports IPv4 management interface configuration

  • IPv6 to be considered based on customer demand

• IronSkillet loaded into a VM-50 will utilize the full profile capacity

  • See the section VM-50 Security Profile Limits for more information

• The Panorama full configuration template is based on a fully shared model

  • All device-group configuration at the Shared top of tree

  • Additional Panorama template stacks should include the IronSkillet template