# AI zone, phase 1: sample change file for a lab firewall (PAN-OS 11.1 set commands). Sample, not applied.
# Builds zone lan (port 1, static address, default route to the ISP router) and zone ai (port 2, DHCP server,
# sanctioned DNS by DHCP option), source NAT ai -> lan, a zone-protection profile and a 12-rule security policy
# ending in two logged deny rules; section 1 first removes a legacy configuration. Every address, MAC and name
# is a documentation placeholder (RFC 5737 / RFC 1918 / RFC 7042). October 2026. Every non-comment line passes
# the offline checker against the public PAN-OS 11.1 configure hierarchy; the firewall's own validate stays the real test.
delete rulebase security rules "Inbound Block Rule"
delete rulebase security rules "Outbound Block Rule"
delete rulebase security rules legacy-allow-game-1
delete rulebase security rules legacy-allow-game-2
delete rulebase security rules legacy-allow-game-aux
delete rulebase security rules "legacy connectivity rule"
delete rulebase security rules legacy-web-out
delete rulebase security rules legacy-any-any-1
delete rulebase security rules legacy-any-any-2
delete rulebase nat rules legacy-uturn-media
delete rulebase nat rules legacy-dnat-media
delete rulebase nat rules legacy-snat-out-1
delete rulebase nat rules legacy-snat-out-2
delete rulebase nat rules legacy-uturn-example
delete rulebase nat rules legacy-dnat-example
delete rulebase qos rules "legacy qos rule 1"
delete rulebase qos rules "legacy qos rule 2"
delete rulebase qos rules "legacy qos rule 3"
delete rulebase qos rules "legacy qos rule 4"
delete network qos interface ethernet1/3
delete network qos interface ethernet1/4
delete rulebase application-override rules legacy-app-override
delete network dns-proxy DNSProxy
delete network dhcp interface ethernet1/2
delete network virtual-wire Virtual-Wires_01
delete zone untrust_vw
delete zone trust_vw
delete import network interface ethernet1/3
delete import network interface ethernet1/4
delete network interface ethernet ethernet1/3
delete network interface ethernet ethernet1/4
delete zone trust
delete zone untrust
delete network interface ethernet ethernet1/1 layer3 dhcp-client
delete network interface ethernet ethernet1/2 layer3 ip Interface_1.2
delete network interface ethernet ethernet1/2 layer3 interface-management-profile
delete network profiles interface-management-profile IntMgmt_PrivateAdmin
delete network profiles interface-management-profile IntMgmt_PrivatePingOnly
delete address-group
delete address
delete service-group legacy-service-group
delete service legacy-service-media
delete service legacy-service-game
delete service legacy-service-stun
delete service legacy-service-443
delete service legacy-service-53
delete application legacy-custom-app
delete application-filter legacy-filter
delete tag legacy-tag-1
delete tag legacy-tag-2
delete tag legacy-tag-3
delete tag legacy-tag-4
delete tag legacy-tag-5
delete tag legacy-tag-6
delete tag legacy-tag-7
delete external-list legacy-external-list
delete profile-group legacy-profile-group
delete profiles url-filtering legacy-url-1
delete profiles url-filtering legacy-url-2
set network interface ethernet ethernet1/1 layer3 ip 172.16.0.2/24
set network interface ethernet ethernet1/1 comment "lan: upstream to the ISP router; static address outside the ISP router DHCP pool"
set network interface ethernet ethernet1/2 layer3 ip 192.0.2.1/24
set network interface ethernet ethernet1/2 comment "ai: one access point in AP mode, one AI SSID"
set network profiles interface-management-profile imp-ai-ping-only ping yes
set network profiles interface-management-profile imp-ai-ping-only permitted-ip 192.0.2.0/24
set network interface ethernet ethernet1/2 layer3 interface-management-profile imp-ai-ping-only
set network virtual-router VirtualRouter01 interface [ ethernet1/1 ethernet1/2 ]
set network virtual-router VirtualRouter01 routing-table ip static-route default-route destination 0.0.0.0/0
set network virtual-router VirtualRouter01 routing-table ip static-route default-route interface ethernet1/1
set network virtual-router VirtualRouter01 routing-table ip static-route default-route nexthop ip-address 172.16.0.1
set network virtual-router VirtualRouter01 routing-table ip static-route default-route metric 10
set network profiles zone-protection-profile zp-ai description "AI zone: recon block, spoofed-IP drop, packet checks, RED flood limits (tune from show zone-protection zone ai)"
set network profiles zone-protection-profile zp-ai scan 8001 action block-ip track-by source
set network profiles zone-protection-profile zp-ai scan 8001 action block-ip duration 300
set network profiles zone-protection-profile zp-ai scan 8001 interval 2
set network profiles zone-protection-profile zp-ai scan 8001 threshold 100
set network profiles zone-protection-profile zp-ai scan 8002 action alert
set network profiles zone-protection-profile zp-ai scan 8002 interval 10
set network profiles zone-protection-profile zp-ai scan 8002 threshold 100
set network profiles zone-protection-profile zp-ai scan 8003 action block-ip track-by source
set network profiles zone-protection-profile zp-ai scan 8003 action block-ip duration 300
set network profiles zone-protection-profile zp-ai scan 8003 interval 2
set network profiles zone-protection-profile zp-ai scan 8003 threshold 100
set network profiles zone-protection-profile zp-ai flood tcp-syn enable yes
set network profiles zone-protection-profile zp-ai flood tcp-syn red alarm-rate 1000
set network profiles zone-protection-profile zp-ai flood tcp-syn red activate-rate 2000
set network profiles zone-protection-profile zp-ai flood tcp-syn red maximal-rate 4000
set network profiles zone-protection-profile zp-ai flood udp enable yes
set network profiles zone-protection-profile zp-ai flood udp red alarm-rate 1000
set network profiles zone-protection-profile zp-ai flood udp red activate-rate 2000
set network profiles zone-protection-profile zp-ai flood udp red maximal-rate 4000
set network profiles zone-protection-profile zp-ai flood icmp enable yes
set network profiles zone-protection-profile zp-ai flood icmp red alarm-rate 100
set network profiles zone-protection-profile zp-ai flood icmp red activate-rate 200
set network profiles zone-protection-profile zp-ai flood icmp red maximal-rate 1000
set network profiles zone-protection-profile zp-ai flood other-ip enable yes
set network profiles zone-protection-profile zp-ai flood other-ip red alarm-rate 100
set network profiles zone-protection-profile zp-ai flood other-ip red activate-rate 200
set network profiles zone-protection-profile zp-ai flood other-ip red maximal-rate 1000
set network profiles zone-protection-profile zp-ai discard-ip-spoof yes
set network profiles zone-protection-profile zp-ai discard-strict-source-routing yes
set network profiles zone-protection-profile zp-ai discard-loose-source-routing yes
set network profiles zone-protection-profile zp-ai discard-unknown-option yes
set network profiles zone-protection-profile zp-ai discard-malformed-option yes
set network profiles zone-protection-profile zp-ai discard-overlapping-tcp-segment-mismatch yes
set network profiles zone-protection-profile zp-ai discard-tcp-split-handshake yes
set network profiles zone-protection-profile zp-ai discard-tcp-syn-with-data yes
set network profiles zone-protection-profile zp-ai discard-tcp-synack-with-data yes
set network profiles zone-protection-profile zp-ai remove-tcp-timestamp yes
set network profiles zone-protection-profile zp-ai strip-mptcp-option global
set zone lan network layer3 ethernet1/1
set zone lan network zone-protection-profile Recommended_Zone_Protection
set zone ai network layer3 ethernet1/2
set zone ai network zone-protection-profile zp-ai
set network dhcp interface ethernet1/2 server mode enabled
set network dhcp interface ethernet1/2 server probe-ip yes
set network dhcp interface ethernet1/2 server option lease timeout 1440
set network dhcp interface ethernet1/2 server option gateway 192.0.2.1
set network dhcp interface ethernet1/2 server option subnet-mask 255.255.255.0
set network dhcp interface ethernet1/2 server option dns primary 203.0.113.53
set network dhcp interface ethernet1/2 server option dns secondary 203.0.113.54
set network dhcp interface ethernet1/2 server ip-pool 192.0.2.10-192.0.2.199
set network dhcp interface ethernet1/2 server reserved 192.0.2.10 mac 00:00:5e:00:53:10
set network dhcp interface ethernet1/2 server reserved 192.0.2.10 description "access point management"
set network dhcp interface ethernet1/2 server reserved 192.0.2.11 mac 00:00:5e:00:53:11
set network dhcp interface ethernet1/2 server reserved 192.0.2.11 description "AI node A"
set network dhcp interface ethernet1/2 server reserved 192.0.2.12 mac 00:00:5e:00:53:12
set network dhcp interface ethernet1/2 server reserved 192.0.2.12 description "AI node B"
set tag ai-zone comments "AI zone, phase 1 (sample)"
set address n-ai-net ip-netmask 192.0.2.0/24
set address n-ai-net description "AI zone subnet on ethernet1/2"
set address h-ai-ap ip-netmask 192.0.2.10/32
set address h-ai-ap description "access point management (DHCP reservation)"
set address h-ai-node-a ip-netmask 192.0.2.11/32
set address h-ai-node-a description "AI node A (DHCP reservation)"
set address h-ai-node-b ip-netmask 192.0.2.12/32
set address h-ai-node-b description "AI node B (DHCP reservation)"
set address-group g-ai-nodes static [ h-ai-node-a h-ai-node-b ]
set address-group g-ai-nodes description "AI nodes allowed out; add the future node when it exists"
set address h-lab-server ip-netmask 172.16.0.21/32
set address h-lab-server description "lab server LAN address"
set address h-desktop ip-netmask 172.16.0.22/32
set address h-desktop description "desktop LAN address"
set address-group g-overlay-lan-peers static [ h-lab-server h-desktop ]
set address-group g-overlay-lan-peers description "LAN hosts the AI nodes may reach on the overlay UDP port only"
set address h-dns-sanctioned-a ip-netmask 203.0.113.53/32
set address h-dns-sanctioned-b ip-netmask 203.0.113.54/32
set address-group g-dns-sanctioned static [ h-dns-sanctioned-a h-dns-sanctioned-b ]
set address-group g-dns-sanctioned description "The only DNS resolvers the AI zone may use (sanctioned, malware-blocking)"
set address n-rfc1918-10 ip-netmask 10.0.0.0/8
set address n-rfc1918-172 ip-netmask 172.16.0.0/12
set address n-rfc1918-192 ip-netmask 192.168.0.0/16
set address n-cgnat-shared ip-netmask 100.64.0.0/10
set address n-cgnat-shared description "RFC 6598 shared address space, which includes the overlay address range"
set address n-link-local ip-netmask 169.254.0.0/16
set address n-multicast ip-netmask 224.0.0.0/4
set address n-reserved-240 ip-netmask 240.0.0.0/4
set address n-this-network ip-netmask 0.0.0.0/8
set address-group g-not-internet static [ n-rfc1918-10 n-rfc1918-172 n-rfc1918-192 n-cgnat-shared n-link-local n-multicast n-reserved-240 n-this-network ]
set address-group g-not-internet description "Never reachable from the AI zone: the LAN, ISP equipment, firewall management, the overlay range"
set service s-udp-overlay protocol udp port 41641
set service s-udp-overlay protocol udp override yes timeout 240
set service s-udp-overlay description "Overlay direct path (WireGuard) on the overlay vendor documented default port; 240 s UDP timeout per the vendor firewall guidance"
set service s-tcp-80-443 protocol tcp port 80,443
set service s-tcp-80-443 description "HTTP and HTTPS only"
set rulebase nat rules ai-snat-out from ai
set rulebase nat rules ai-snat-out to lan
set rulebase nat rules ai-snat-out source n-ai-net
set rulebase nat rules ai-snat-out destination any
set rulebase nat rules ai-snat-out service any
set rulebase nat rules ai-snat-out source-translation dynamic-ip-and-port interface-address interface ethernet1/1
set rulebase nat rules ai-snat-out tag ai-zone
set rulebase nat rules ai-snat-out description "AI zone to the LAN and the internet, dynamic IP and port to the port-1 address"
set rulebase security rules edl-block-outbound from any
set rulebase security rules edl-block-outbound to any
set rulebase security rules edl-block-outbound source any
set rulebase security rules edl-block-outbound destination [ panw-bulletproof-ip-list panw-highrisk-ip-list panw-known-ip-list ]
set rulebase security rules edl-block-outbound source-user any
set rulebase security rules edl-block-outbound category any
set rulebase security rules edl-block-outbound application any
set rulebase security rules edl-block-outbound service any
set rulebase security rules edl-block-outbound action deny
set rulebase security rules edl-block-outbound log-start no
set rulebase security rules edl-block-outbound log-end yes
set rulebase security rules edl-block-outbound tag Outbound
set rulebase security rules edl-block-outbound description "Iron Skillet outbound block rule: the predefined known-malicious, high-risk and bulletproof IP lists"
set rulebase security rules edl-block-inbound from any
set rulebase security rules edl-block-inbound to any
set rulebase security rules edl-block-inbound source [ panw-bulletproof-ip-list panw-highrisk-ip-list panw-known-ip-list ]
set rulebase security rules edl-block-inbound destination any
set rulebase security rules edl-block-inbound source-user any
set rulebase security rules edl-block-inbound category any
set rulebase security rules edl-block-inbound application any
set rulebase security rules edl-block-inbound service any
set rulebase security rules edl-block-inbound action deny
set rulebase security rules edl-block-inbound log-start no
set rulebase security rules edl-block-inbound log-end yes
set rulebase security rules edl-block-inbound tag Inbound
set rulebase security rules edl-block-inbound description "Iron Skillet inbound block rule: the predefined known-malicious, high-risk and bulletproof IP lists"
set rulebase security rules ai-overlay-lan-direct from ai
set rulebase security rules ai-overlay-lan-direct to lan
set rulebase security rules ai-overlay-lan-direct source g-ai-nodes
set rulebase security rules ai-overlay-lan-direct destination g-overlay-lan-peers
set rulebase security rules ai-overlay-lan-direct source-user any
set rulebase security rules ai-overlay-lan-direct category any
set rulebase security rules ai-overlay-lan-direct application any
set rulebase security rules ai-overlay-lan-direct service s-udp-overlay
set rulebase security rules ai-overlay-lan-direct action allow
set rulebase security rules ai-overlay-lan-direct log-start no
set rulebase security rules ai-overlay-lan-direct log-end yes
set rulebase security rules ai-overlay-lan-direct profile-setting group Outbound
set rulebase security rules ai-overlay-lan-direct tag ai-zone
set rulebase security rules ai-overlay-lan-direct description "AI nodes to the two LAN peers on the overlay UDP port only (direct path). What rides inside is governed by the overlay policy"
set rulebase security rules ai-block-private from ai
set rulebase security rules ai-block-private to lan
set rulebase security rules ai-block-private source any
set rulebase security rules ai-block-private destination g-not-internet
set rulebase security rules ai-block-private source-user any
set rulebase security rules ai-block-private category any
set rulebase security rules ai-block-private application any
set rulebase security rules ai-block-private service any
set rulebase security rules ai-block-private action drop
set rulebase security rules ai-block-private log-start no
set rulebase security rules ai-block-private log-end yes
set rulebase security rules ai-block-private tag ai-zone
set rulebase security rules ai-block-private description "AI zone may not reach any private, CGNAT, link-local or multicast address beyond the firewall"
set rulebase security rules ai-dns-sanctioned from ai
set rulebase security rules ai-dns-sanctioned to lan
set rulebase security rules ai-dns-sanctioned source g-ai-nodes
set rulebase security rules ai-dns-sanctioned destination g-dns-sanctioned
set rulebase security rules ai-dns-sanctioned source-user any
set rulebase security rules ai-dns-sanctioned category any
set rulebase security rules ai-dns-sanctioned application [ dns dns-base ]
set rulebase security rules ai-dns-sanctioned service application-default
set rulebase security rules ai-dns-sanctioned action allow
set rulebase security rules ai-dns-sanctioned log-start no
set rulebase security rules ai-dns-sanctioned log-end yes
set rulebase security rules ai-dns-sanctioned profile-setting group Outbound
set rulebase security rules ai-dns-sanctioned tag ai-zone
set rulebase security rules ai-dns-sanctioned description "DNS to the sanctioned resolvers only (internet gateway best practice: allow only sanctioned DNS servers)"
set rulebase security rules ai-block-dns-other from ai
set rulebase security rules ai-block-dns-other to lan
set rulebase security rules ai-block-dns-other source any
set rulebase security rules ai-block-dns-other destination any
set rulebase security rules ai-block-dns-other source-user any
set rulebase security rules ai-block-dns-other category any
set rulebase security rules ai-block-dns-other application [ dns dns-base ]
set rulebase security rules ai-block-dns-other service any
set rulebase security rules ai-block-dns-other action reset-both
set rulebase security rules ai-block-dns-other log-start no
set rulebase security rules ai-block-dns-other log-end yes
set rulebase security rules ai-block-dns-other tag ai-zone
set rulebase security rules ai-block-dns-other description "Plain DNS to any other resolver is reset"
set rulebase security rules ai-block-doh-dot from ai
set rulebase security rules ai-block-doh-dot to lan
set rulebase security rules ai-block-doh-dot source any
set rulebase security rules ai-block-doh-dot destination any
set rulebase security rules ai-block-doh-dot source-user any
set rulebase security rules ai-block-doh-dot category any
set rulebase security rules ai-block-doh-dot application [ dns-over-https dns-over-tls ]
set rulebase security rules ai-block-doh-dot service any
set rulebase security rules ai-block-doh-dot action reset-both
set rulebase security rules ai-block-doh-dot log-start no
set rulebase security rules ai-block-doh-dot log-end yes
set rulebase security rules ai-block-doh-dot tag ai-zone
set rulebase security rules ai-block-doh-dot description "DoH and DoT hide DNS from the firewall; reset"
set rulebase security rules ai-block-evasive from ai
set rulebase security rules ai-block-evasive to lan
set rulebase security rules ai-block-evasive source any
set rulebase security rules ai-block-evasive destination any
set rulebase security rules ai-block-evasive source-user any
set rulebase security rules ai-block-evasive category any
set rulebase security rules ai-block-evasive application [ tor bittorrent openvpn ssh unknown-tcp unknown-udp unknown-p2p ]
set rulebase security rules ai-block-evasive service any
set rulebase security rules ai-block-evasive action drop
set rulebase security rules ai-block-evasive log-start no
set rulebase security rules ai-block-evasive log-end yes
set rulebase security rules ai-block-evasive tag ai-zone
set rulebase security rules ai-block-evasive description "No Tor, BitTorrent, OpenVPN, outbound SSH or unidentified traffic from the AI zone"
set rulebase security rules ai-infra-out from ai
set rulebase security rules ai-infra-out to lan
set rulebase security rules ai-infra-out source g-ai-nodes
set rulebase security rules ai-infra-out destination g-not-internet
set rulebase security rules ai-infra-out negate-destination yes
set rulebase security rules ai-infra-out source-user any
set rulebase security rules ai-infra-out category any
set rulebase security rules ai-infra-out application [ ntp stun ping traceroute ]
set rulebase security rules ai-infra-out service application-default
set rulebase security rules ai-infra-out action allow
set rulebase security rules ai-infra-out log-start no
set rulebase security rules ai-infra-out log-end yes
set rulebase security rules ai-infra-out profile-setting group Outbound
set rulebase security rules ai-infra-out tag ai-zone
set rulebase security rules ai-infra-out description "NTP, STUN (overlay connectivity checks), ping, traceroute on default ports"
set rulebase security rules ai-web-out from ai
set rulebase security rules ai-web-out to lan
set rulebase security rules ai-web-out source g-ai-nodes
set rulebase security rules ai-web-out destination g-not-internet
set rulebase security rules ai-web-out negate-destination yes
set rulebase security rules ai-web-out source-user any
set rulebase security rules ai-web-out category any
set rulebase security rules ai-web-out application any
set rulebase security rules ai-web-out service s-tcp-80-443
set rulebase security rules ai-web-out action allow
set rulebase security rules ai-web-out log-start no
set rulebase security rules ai-web-out log-end yes
set rulebase security rules ai-web-out profile-setting group Outbound
set rulebase security rules ai-web-out tag ai-zone
set rulebase security rules ai-web-out description "AI nodes to the internet on TCP 80/443 only, Iron Skillet Outbound profiles"
set rulebase security rules ai-cleanup-deny from ai
set rulebase security rules ai-cleanup-deny to lan
set rulebase security rules ai-cleanup-deny source any
set rulebase security rules ai-cleanup-deny destination any
set rulebase security rules ai-cleanup-deny source-user any
set rulebase security rules ai-cleanup-deny category any
set rulebase security rules ai-cleanup-deny application any
set rulebase security rules ai-cleanup-deny service any
set rulebase security rules ai-cleanup-deny action deny
set rulebase security rules ai-cleanup-deny log-start no
set rulebase security rules ai-cleanup-deny log-end yes
set rulebase security rules ai-cleanup-deny tag ai-zone
set rulebase security rules ai-cleanup-deny description "Cleanup: deny and log anything else leaving the AI zone"
set rulebase security rules lan-to-ai-deny from lan
set rulebase security rules lan-to-ai-deny to ai
set rulebase security rules lan-to-ai-deny source any
set rulebase security rules lan-to-ai-deny destination any
set rulebase security rules lan-to-ai-deny source-user any
set rulebase security rules lan-to-ai-deny category any
set rulebase security rules lan-to-ai-deny application any
set rulebase security rules lan-to-ai-deny service any
set rulebase security rules lan-to-ai-deny action deny
set rulebase security rules lan-to-ai-deny log-start no
set rulebase security rules lan-to-ai-deny log-end yes
set rulebase security rules lan-to-ai-deny tag ai-zone
set rulebase security rules lan-to-ai-deny description "Cleanup: nothing from the LAN side into the AI zone (management rides the overlay)"
set rulebase default-security-rules rules interzone-default action drop
set rulebase default-security-rules rules interzone-default log-end yes
set rulebase default-security-rules rules intrazone-default log-end yes
move rulebase security rules edl-block-outbound top
move rulebase security rules edl-block-inbound after edl-block-outbound
move rulebase security rules ai-overlay-lan-direct after edl-block-inbound
move rulebase security rules ai-block-private after ai-overlay-lan-direct
move rulebase security rules ai-dns-sanctioned after ai-block-private
move rulebase security rules ai-block-dns-other after ai-dns-sanctioned
move rulebase security rules ai-block-doh-dot after ai-block-dns-other
move rulebase security rules ai-block-evasive after ai-block-doh-dot
move rulebase security rules ai-infra-out after ai-block-evasive
move rulebase security rules ai-web-out after ai-infra-out
move rulebase security rules ai-cleanup-deny after ai-web-out
move rulebase security rules lan-to-ai-deny after ai-cleanup-deny