deviceconfig {
  system {
    ip-address 10.1.1.1;
    netmask 255.255.255.0;
    update-server updates.paloaltonetworks.com;
    update-schedule {
      threats {
        recurring {
          weekly {
            day-of-week wednesday;
            at 01:02;
            action download-only;
          }
        }
      }
    }
    timezone US/Pacific;
    service {
      disable-telnet yes;
      disable-http yes;
    }
    hostname PA-VM;
    default-gateway 10.1.1.254;
    dns-setting {
      servers {
        primary 8.8.8.8;
        secondary 8.8.4.4;
      }
    }
  }
  setting {
    config {
      rematch yes;
    }
    management {
      hostname-type-in-syslog FQDN;
    }
    auto-mac-detect yes;
  }
}
network {
  interface {
    ethernet {
      ethernet1/2 {
        layer3 {
          ip {
            192.168.10.1/24;
          }
          interface-management-profile allow-mgmt;
        }
      }
      ethernet1/1 {
        layer3 {
          ipv6 {
            neighbor-discovery {
              router-advertisement {
                enable no;
              }
            }
          }
          ndp-proxy {
            enabled no;
          }
          lldp {
            enable no;
          }
          interface-management-profile allow-ping;
          dhcp-client;
        }
      }
    }
  }
  profiles {
    monitor-profile {
      default {
        interval 3;
        threshold 5;
        action wait-recover;
      }
    }
    interface-management-profile {
      allow-mgmt {
        https yes;
        ssh yes;
        ping yes;
      }
      allow-ping {
        ssh no;
        ping yes;
      }
    }
  }
  ike {
    crypto-profiles {
      ike-crypto-profiles {
        default {
          encryption [ aes-128-cbc 3des];
          hash sha1;
          dh-group group2;
          lifetime {
            hours 8;
          }
        }
        Suite-B-GCM-128 {
          encryption aes-128-cbc;
          hash sha256;
          dh-group group19;
          lifetime {
            hours 8;
          }
        }
        Suite-B-GCM-256 {
          encryption aes-256-cbc;
          hash sha384;
          dh-group group20;
          lifetime {
            hours 8;
          }
        }
      }
      ipsec-crypto-profiles {
        default {
          esp {
            encryption [ aes-128-cbc 3des];
            authentication sha1;
          }
          dh-group group2;
          lifetime {
            hours 1;
          }
        }
        Suite-B-GCM-128 {
          esp {
            encryption aes-128-gcm;
            authentication none;
          }
          dh-group group19;
          lifetime {
            hours 1;
          }
        }
        Suite-B-GCM-256 {
          esp {
            encryption aes-256-gcm;
            authentication none;
          }
          dh-group group20;
          lifetime {
            hours 1;
          }
        }
      }
      global-protect-app-crypto-profiles {
        default {
          encryption aes-128-cbc;
          authentication sha1;
        }
      }
    }
  }
  qos {
    profile {
      default {
        class {
          class1 {
            priority real-time;
          }
          class2 {
            priority high;
          }
          class3 {
            priority high;
          }
          class4 {
            priority medium;
          }
          class5 {
            priority medium;
          }
          class6 {
            priority low;
          }
          class7 {
            priority low;
          }
          class8 {
            priority low;
          }
        }
      }
    }
  }
  virtual-router {
    default {
      protocol {
        bgp {
          enable no;
          dampening-profile {
            default {
              cutoff 1.25;
              reuse 0.5;
              max-hold-time 900;
              decay-half-life-reachable 300;
              decay-half-life-unreachable 900;
              enable yes;
            }
          }
        }
      }
    }
    student-vr {
      interface [ ethernet1/2 ethernet1/1];
    }
  }
}
shared {
  application;
  application-group;
  service;
  service-group;
  botnet {
    configuration {
      http {
        dynamic-dns {
          enabled yes;
          threshold 5;
        }
        malware-sites {
          enabled yes;
          threshold 5;
        }
        recent-domains {
          enabled yes;
          threshold 5;
        }
        ip-domains {
          enabled yes;
          threshold 10;
        }
        executables-from-unknown-sites {
          enabled yes;
          threshold 5;
        }
      }
      other-applications {
        irc yes;
      }
      unknown-applications {
        unknown-tcp {
          destinations-per-hour 10;
          sessions-per-hour 10;
          session-length {
            maximum-bytes 100;
            minimum-bytes 50;
          }
        }
        unknown-udp {
          destinations-per-hour 10;
          sessions-per-hour 10;
          session-length {
            maximum-bytes 100;
            minimum-bytes 50;
          }
        }
      }
    }
    report {
      topn 100;
      scheduled yes;
    }
  }
  content-preview {
    application;
    application-type {
      category;
      technology;
    }
  }
}
zone {
  Trust-L3 {
    network {
      layer3 ethernet1/2;
    }
  }
  Untrust-L3 {
    network {
      layer3 ethernet1/1;
    }
  }
}
service-group;
service;
schedule;
rulebase {
  nat {
    rules {
      POD-NAT-OUT {
        source-translation {
          dynamic-ip-and-port {
            interface-address {
              interface ethernet1/1;
            }
          }
        }
        to Untrust-L3;
        from Trust-L3;
        source any;
        destination any;
        service any;
        description "Outbound NAT for POD";
        to-interface ethernet1/1;
      }
    }
  }
  security {
    rules {
      Basic-Allowed-Apps {
        to Untrust-L3;
        from Trust-L3;
        source any;
        destination any;
        source-user any;
        category any;
        service application-default;
        hip-profiles any;
        action allow;
        application any;
      }
    }
  }
}
import {
  network {
    interface ethernet1/1;
  }
}
application-group;
application;
mgt-config {
  users {
    admin {
      phash $1$djqumuui$ScFd4Q6nPSQn25ch1FjKn.;
      permissions {
        role-based {
          superuser yes;
        }
      }
    }
  }
}
