<?xml version="1.0"?>
<config version="11.1.0" urldb="paloaltonetworks" detail-version="11.1.4">
  <mgt-config>
    <password-complexity>
      <enabled>yes</enabled>
      <minimum-length>8</minimum-length>
    </password-complexity>
  </mgt-config>
  <shared>
    <application/>
    <application-group/>
    <service/>
    <service-group/>
    <botnet>
      <configuration>
        <http>
          <dynamic-dns>
            <enabled>yes</enabled>
            <threshold>5</threshold>
          </dynamic-dns>
          <malware-sites>
            <enabled>yes</enabled>
            <threshold>5</threshold>
          </malware-sites>
          <recent-domains>
            <enabled>yes</enabled>
            <threshold>5</threshold>
          </recent-domains>
          <ip-domains>
            <enabled>yes</enabled>
            <threshold>10</threshold>
          </ip-domains>
          <executables-from-unknown-sites>
            <enabled>yes</enabled>
            <threshold>5</threshold>
          </executables-from-unknown-sites>
        </http>
        <other-applications>
          <irc>yes</irc>
        </other-applications>
        <unknown-applications>
          <unknown-tcp>
            <destinations-per-hour>10</destinations-per-hour>
            <sessions-per-hour>10</sessions-per-hour>
            <session-length>
              <maximum-bytes>100</maximum-bytes>
              <minimum-bytes>50</minimum-bytes>
            </session-length>
          </unknown-tcp>
          <unknown-udp>
            <destinations-per-hour>10</destinations-per-hour>
            <sessions-per-hour>10</sessions-per-hour>
            <session-length>
              <maximum-bytes>100</maximum-bytes>
              <minimum-bytes>50</minimum-bytes>
            </session-length>
          </unknown-udp>
        </unknown-applications>
      </configuration>
      <report>
        <topn>100</topn>
        <scheduled>yes</scheduled>
      </report>
    </botnet>
  </shared>
  <devices>
    <entry name="localhost.localdomain">
      <network>
        <interface>
          <ethernet>
            <entry name="ethernet1/1">
              <aggregate-group>ae1</aggregate-group>
            </entry>
            <entry name="ethernet1/2">
              <aggregate-group>ae1</aggregate-group>
            </entry>
            <entry name="ethernet1/3">
              <layer3>
                <ndp-proxy>
                  <enabled>no</enabled>
                </ndp-proxy>
                <sdwan-link-settings>
                  <upstream-nat>
                    <enable>no</enable>
                    <static-ip/>
                  </upstream-nat>
                  <enable>no</enable>
                  <ipv6-enable>no</ipv6-enable>
                </sdwan-link-settings>
                <lldp>
                  <enable>no</enable>
                </lldp>
                <dhcp-client/>
              </layer3>
              <comment>ae1 WAN</comment>
            </entry>
          </ethernet>
          <aggregate-ethernet>
            <entry name="ae1">
              <layer3>
                <lacp>
                  <high-availability>
                    <use-same-system-mac>
                      <enable>no</enable>
                    </use-same-system-mac>
                  </high-availability>
                  <transmission-rate>slow</transmission-rate>
                  <enable>yes</enable>
                </lacp>
                <sdwan-link-settings>
                  <upstream-nat>
                    <enable>no</enable>
                    <static-ip/>
                  </upstream-nat>
                  <enable>no</enable>
                  <ipv6-enable>no</ipv6-enable>
                </sdwan-link-settings>
                <ndp-proxy>
                  <enabled>no</enabled>
                </ndp-proxy>
                <lldp>
                  <enable>no</enable>
                </lldp>
                <units>
                  <entry name="ae1.3260">
                    <sdwan-link-settings>
                      <upstream-nat>
                        <enable>no</enable>
                        <static-ip/>
                      </upstream-nat>
                      <enable>no</enable>
                      <ipv6-enable>no</ipv6-enable>
                    </sdwan-link-settings>
                    <ndp-proxy>
                      <enabled>no</enabled>
                    </ndp-proxy>
                    <adjust-tcp-mss>
                      <enable>no</enable>
                    </adjust-tcp-mss>
                    <ip>
                      <entry name="10.32.60.3/29"/>
                    </ip>
                    <tag>3260</tag>
                    <interface-management-profile>Ping</interface-management-profile>
                    <comment>Fabric-Transit</comment>
                  </entry>
                </units>
              </layer3>
            </entry>
          </aggregate-ethernet>
        </interface>
        <profiles>
          <monitor-profile>
            <entry name="default">
              <interval>3</interval>
              <threshold>5</threshold>
              <action>wait-recover</action>
            </entry>
          </monitor-profile>
          <interface-management-profile>
            <entry name="Ping">
              <ping>yes</ping>
            </entry>
          </interface-management-profile>
        </profiles>
        <ike>
          <crypto-profiles>
            <ike-crypto-profiles>
              <entry name="default">
                <encryption>
                  <member>aes-128-cbc</member>
                  <member>3des</member>
                </encryption>
                <hash>
                  <member>sha1</member>
                </hash>
                <dh-group>
                  <member>group2</member>
                </dh-group>
                <lifetime>
                  <hours>8</hours>
                </lifetime>
              </entry>
              <entry name="Suite-B-GCM-128">
                <encryption>
                  <member>aes-128-cbc</member>
                </encryption>
                <hash>
                  <member>sha256</member>
                </hash>
                <dh-group>
                  <member>group19</member>
                </dh-group>
                <lifetime>
                  <hours>8</hours>
                </lifetime>
              </entry>
              <entry name="Suite-B-GCM-256">
                <encryption>
                  <member>aes-256-cbc</member>
                </encryption>
                <hash>
                  <member>sha384</member>
                </hash>
                <dh-group>
                  <member>group20</member>
                </dh-group>
                <lifetime>
                  <hours>8</hours>
                </lifetime>
              </entry>
            </ike-crypto-profiles>
            <ipsec-crypto-profiles>
              <entry name="default">
                <esp>
                  <encryption>
                    <member>aes-128-cbc</member>
                    <member>3des</member>
                  </encryption>
                  <authentication>
                    <member>sha1</member>
                  </authentication>
                </esp>
                <dh-group>group2</dh-group>
                <lifetime>
                  <hours>1</hours>
                </lifetime>
              </entry>
              <entry name="Suite-B-GCM-128">
                <esp>
                  <encryption>
                    <member>aes-128-gcm</member>
                  </encryption>
                  <authentication>
                    <member>none</member>
                  </authentication>
                </esp>
                <dh-group>group19</dh-group>
                <lifetime>
                  <hours>1</hours>
                </lifetime>
              </entry>
              <entry name="Suite-B-GCM-256">
                <esp>
                  <encryption>
                    <member>aes-256-gcm</member>
                  </encryption>
                  <authentication>
                    <member>none</member>
                  </authentication>
                </esp>
                <dh-group>group20</dh-group>
                <lifetime>
                  <hours>1</hours>
                </lifetime>
              </entry>
            </ipsec-crypto-profiles>
            <global-protect-app-crypto-profiles>
              <entry name="default">
                <encryption>
                  <member>aes-128-cbc</member>
                </encryption>
                <authentication>
                  <member>sha1</member>
                </authentication>
              </entry>
            </global-protect-app-crypto-profiles>
          </crypto-profiles>
        </ike>
        <qos>
          <profile>
            <entry name="default">
              <class-bandwidth-type>
                <mbps>
                  <class>
                    <entry name="class1">
                      <priority>real-time</priority>
                    </entry>
                    <entry name="class2">
                      <priority>high</priority>
                    </entry>
                    <entry name="class3">
                      <priority>high</priority>
                    </entry>
                    <entry name="class4">
                      <priority>medium</priority>
                    </entry>
                    <entry name="class5">
                      <priority>medium</priority>
                    </entry>
                    <entry name="class6">
                      <priority>low</priority>
                    </entry>
                    <entry name="class7">
                      <priority>low</priority>
                    </entry>
                    <entry name="class8">
                      <priority>low</priority>
                    </entry>
                  </class>
                </mbps>
              </class-bandwidth-type>
            </entry>
          </profile>
        </qos>
        <virtual-router>
          <entry name="default">
            <protocol>
              <bgp>
                <enable>yes</enable>
                <dampening-profile>
                  <entry name="default">
                    <cutoff>1.25</cutoff>
                    <reuse>0.5</reuse>
                    <max-hold-time>900</max-hold-time>
                    <decay-half-life-reachable>300</decay-half-life-reachable>
                    <decay-half-life-unreachable>900</decay-half-life-unreachable>
                    <enable>yes</enable>
                  </entry>
                </dampening-profile>
                <routing-options>
                  <graceful-restart>
                    <enable>yes</enable>
                  </graceful-restart>
                </routing-options>
                <peer-group>
                  <entry name="Fabric">
                    <type>
                      <ebgp>
                        <remove-private-as>no</remove-private-as>
                        <import-nexthop>original</import-nexthop>
                        <export-nexthop>use-self</export-nexthop>
                      </ebgp>
                    </type>
                    <peer>
                      <entry name="LEAF-3">
                        <peer-address>
                          <ip>10.32.60.1</ip>
                        </peer-address>
                        <connection-options>
                          <incoming-bgp-connection>
                            <remote-port>0</remote-port>
                            <allow>yes</allow>
                          </incoming-bgp-connection>
                          <outgoing-bgp-connection>
                            <local-port>0</local-port>
                            <allow>yes</allow>
                          </outgoing-bgp-connection>
                          <multihop>0</multihop>
                          <keep-alive-interval>30</keep-alive-interval>
                          <open-delay-time>0</open-delay-time>
                          <hold-time>90</hold-time>
                          <idle-hold-time>15</idle-hold-time>
                          <min-route-adv-interval>30</min-route-adv-interval>
                        </connection-options>
                        <subsequent-address-family-identifier>
                          <unicast>yes</unicast>
                          <multicast>no</multicast>
                        </subsequent-address-family-identifier>
                        <local-address>
                          <ip>10.32.60.3/29</ip>
                          <interface>ae1.3260</interface>
                        </local-address>
                        <bfd>
                          <profile>Inherit-vr-global-setting</profile>
                        </bfd>
                        <max-prefixes>5000</max-prefixes>
                        <enable>yes</enable>
                        <peer-as>64500</peer-as>
                        <enable-mp-bgp>no</enable-mp-bgp>
                        <address-family-identifier>ipv4</address-family-identifier>
                        <enable-sender-side-loop-detection>yes</enable-sender-side-loop-detection>
                        <reflector-client>non-client</reflector-client>
                        <peering-type>unspecified</peering-type>
                      </entry>
                      <entry name="LEAF-4">
                        <peer-address>
                          <ip>10.32.60.2</ip>
                        </peer-address>
                        <connection-options>
                          <incoming-bgp-connection>
                            <remote-port>0</remote-port>
                            <allow>yes</allow>
                          </incoming-bgp-connection>
                          <outgoing-bgp-connection>
                            <local-port>0</local-port>
                            <allow>yes</allow>
                          </outgoing-bgp-connection>
                          <multihop>0</multihop>
                          <keep-alive-interval>30</keep-alive-interval>
                          <open-delay-time>0</open-delay-time>
                          <hold-time>90</hold-time>
                          <idle-hold-time>15</idle-hold-time>
                          <min-route-adv-interval>30</min-route-adv-interval>
                        </connection-options>
                        <subsequent-address-family-identifier>
                          <unicast>yes</unicast>
                          <multicast>no</multicast>
                        </subsequent-address-family-identifier>
                        <local-address>
                          <ip>10.32.60.3/29</ip>
                          <interface>ae1.3260</interface>
                        </local-address>
                        <bfd>
                          <profile>Inherit-vr-global-setting</profile>
                        </bfd>
                        <max-prefixes>5000</max-prefixes>
                        <enable>yes</enable>
                        <peer-as>64500</peer-as>
                        <enable-mp-bgp>no</enable-mp-bgp>
                        <address-family-identifier>ipv4</address-family-identifier>
                        <enable-sender-side-loop-detection>yes</enable-sender-side-loop-detection>
                        <reflector-client>non-client</reflector-client>
                        <peering-type>unspecified</peering-type>
                      </entry>
                    </peer>
                    <aggregated-confed-as-path>yes</aggregated-confed-as-path>
                    <soft-reset-with-stored-info>yes</soft-reset-with-stored-info>
                    <enable>yes</enable>
                  </entry>
                </peer-group>
                <router-id>10.32.60.3</router-id>
                <local-as>64520</local-as>
                <install-route>yes</install-route>
                <allow-redist-default-route>yes</allow-redist-default-route>
                <redist-rules>
                  <entry name="default-static">
                    <address-family-identifier>ipv4</address-family-identifier>
                    <enable>yes</enable>
                    <set-origin>incomplete</set-origin>
                  </entry>
                </redist-rules>
              </bgp>
              <rip>
                <enable>no</enable>
              </rip>
              <ospf>
                <enable>no</enable>
              </ospf>
              <ospfv3>
                <enable>no</enable>
              </ospfv3>
              <redist-profile>
                <entry name="default-static">
                  <filter>
                    <type>
                      <member>static</member>
                    </type>
                    <interface>
                      <member>ethernet1/3</member>
                    </interface>
                  </filter>
                  <priority>1</priority>
                  <action>
                    <redist/>
                  </action>
                </entry>
              </redist-profile>
            </protocol>
            <interface>
              <member>ae1.3260</member>
              <member>ethernet1/3</member>
            </interface>
            <ecmp>
              <algorithm>
                <ip-modulo/>
              </algorithm>
              <enable>yes</enable>
              <symmetric-return>yes</symmetric-return>
            </ecmp>
          </entry>
        </virtual-router>
      </network>
      <deviceconfig>
        <system>
          <type>
            <static/>
          </type>
          <update-server>updates.paloaltonetworks.com</update-server>
          <update-schedule>
            <threats>
              <recurring>
                <weekly>
                  <day-of-week>wednesday</day-of-week>
                  <at>01:02</at>
                  <action>download-only</action>
                </weekly>
              </recurring>
            </threats>
          </update-schedule>
          <timezone>US/Pacific</timezone>
          <service>
            <disable-telnet>yes</disable-telnet>
            <disable-http>yes</disable-http>
          </service>
          <hostname>PA-VM</hostname>
          <device-telemetry>
            <device-health-performance>yes</device-health-performance>
            <product-usage>yes</product-usage>
            <threat-prevention>yes</threat-prevention>
            <region>Americas</region>
          </device-telemetry>
          <ip-address>192.168.0.114</ip-address>
          <netmask>255.255.255.0</netmask>
          <default-gateway>192.168.0.1</default-gateway>
        </system>
        <setting>
          <config>
            <rematch>yes</rematch>
          </config>
          <management>
            <hostname-type-in-syslog>FQDN</hostname-type-in-syslog>
          </management>
          <auto-mac-detect>yes</auto-mac-detect>
        </setting>
      </deviceconfig>
      <vsys>
        <entry name="vsys1">
          <application/>
          <application-group/>
          <zone>
            <entry name="Fabric-Transit">
              <network>
                <layer3>
                  <member>ae1.3260</member>
                </layer3>
              </network>
            </entry>
            <entry name="Untrust">
              <network>
                <layer3>
                  <member>ethernet1/3</member>
                </layer3>
              </network>
            </entry>
          </zone>
          <service/>
          <service-group/>
          <schedule/>
          <rulebase>
            <security>
              <rules>
                <entry name="Allow from Fabric to Internet" uuid="0e767799-04d8-46a6-9f09-376d1d381ba7">
                  <to>
                    <member>Untrust</member>
                  </to>
                  <from>
                    <member>Fabric-Transit</member>
                  </from>
                  <source>
                    <member>any</member>
                  </source>
                  <destination>
                    <member>any</member>
                  </destination>
                  <source-user>
                    <member>any</member>
                  </source-user>
                  <category>
                    <member>any</member>
                  </category>
                  <application>
                    <member>any</member>
                  </application>
                  <service>
                    <member>any</member>
                  </service>
                  <source-hip>
                    <member>any</member>
                  </source-hip>
                  <destination-hip>
                    <member>any</member>
                  </destination-hip>
                  <action>allow</action>
                  <log-start>no</log-start>
                  <log-end>yes</log-end>
                </entry>
              </rules>
            </security>
            <nat>
              <rules>
                <entry name="Source NAT" uuid="3a3a5ab5-fa17-410a-b265-af8b2131526d">
                  <source-translation>
                    <dynamic-ip-and-port>
                      <interface-address>
                        <interface>ethernet1/3</interface>
                      </interface-address>
                    </dynamic-ip-and-port>
                  </source-translation>
                  <to>
                    <member>Untrust</member>
                  </to>
                  <from>
                    <member>Fabric-Transit</member>
                  </from>
                  <source>
                    <member>any</member>
                  </source>
                  <destination>
                    <member>any</member>
                  </destination>
                  <service>any</service>
                </entry>
              </rules>
            </nat>
          </rulebase>
          <import>
            <network>
              <interface>
                <member>ae1</member>
                <member>ae1.3260</member>
                <member>ethernet1/3</member>
              </interface>
            </network>
          </import>
        </entry>
      </vsys>
    </entry>
  </devices>
</config>
