content packagesを含め、running configとすべてのログを削除する system disksを含めたデータを完全に削除する
データ復旧は不可
Note: The request system private-data-reset command will not perform the same actions as a factory reset of the device from Maintenance Mode. Private-data-reset will not do a zero-ization of the data and will not erase the system disks. Performing a bit-level recovery procedure can still retrieve the data from the device. Also, all the content packages installed will remain with the same PAN-OS, but all the logs and saved configurations on the firewall will be cleared.
admin@PA-200-first> request system private-data-reset
Executing this command will remove all logs and configuration will revert back to factory defaults. The system will restart and then reset the data. Are you sure you want to continue? (y/n) (y or n)
cp: cannot stat `/opt/pancfg/mgmt/wf_ramdisk/wildfire-images/*': No such file or directory
cp: cannot stat `/opt/pancfg/mgmt/wf_ramdisk/updates/oldwildfire/*': No such file or directory
Shutting down NFS mountd: [ OK ]
Shutting down NFS daemon: nfsd: last server has exited, flushing export cache
[ OK ]
Shutting down NFS services: [ OK ]
（以下省略）
admin@PA-200-first> request restart system
Executing this command will disconnect the current session. Do you want to continue? (y or n)
以下の表示がされたら、「maint」と打ちます。
メンテナンスモードが実行されます。
Autoboot to default partition in 5 seconds.
Enter 'maint' to boot to maint partition.
Entry: maint
Booting to maint mode.
以下の表示がされたら、「maint」と打ちます。メンテナンスモードが実行されます。
Autoboot to default partition in 5 seconds.
Enter 'maint' to boot to maint partition.
Entry: maint
Booting to maint mode.
↓以下のような画面になりますので、「Continue」を選択して、エンターをクリック
Paloalto-コンフィグ初期化-設定方法-CLI-1
↓「Factory Reset」まで移動して、エンターをクリック
Paloalto-コンフィグ初期化-設定方法-CLI-2
↓再度「Factory Reset」まで移動して、エンターをクリック
Paloalto-コンフィグ初期化-設定方法-CLI-3
↓Factory Resetが実行されました。ので、待機します。
Paloalto-コンフィグ初期化-設定方法-CLI-4
↓Factory Resetが完了しました。「Reboot」まで移動して、エンターをクリック
Paloalto-コンフィグ初期化-設定方法-CLI-5
以上でFactory Resetが完了しました。工場出荷状態のまっさらな機器状態になりました。
設定の確認
set cli pager off
set cli config-output-format set
configure
show
実際に「request system private-data-reset」と「Factory Reset」で初期化した後のコンフィグは以下の通りです。
admin@PA-200# show
set deviceconfig system ip-address 192.168.1.1
set deviceconfig system netmask 255.255.255.0
set deviceconfig system update-server updates.paloaltonetworks.com
set deviceconfig system update-schedule threats recurring weekly day-of-week wednesday
set deviceconfig system update-schedule threats recurring weekly at 01:02
set deviceconfig system update-schedule threats recurring weekly action download-only
set deviceconfig system timezone US/Pacific
set deviceconfig system service disable-telnet yes
set deviceconfig system service disable-http yes
set deviceconfig system hostname PA-200
set deviceconfig setting config rematch yes
set deviceconfig setting management hostname-type-in-syslog FQDN
set network interface ethernet ethernet1/1 virtual-wire
set network interface ethernet ethernet1/2 virtual-wire
set network interface loopback units
set network interface vlan units
set network interface tunnel units
set network vlan
set network virtual-wire default-vwire interface1 ethernet1/1
set network virtual-wire default-vwire interface2 ethernet1/2
set network profiles monitor-profile default interval 3
set network profiles monitor-profile default threshold 5
set network profiles monitor-profile default action wait-recover
set network ike crypto-profiles ike-crypto-profiles default encryption [ aes-128-cbc 3des ]
set network ike crypto-profiles ike-crypto-profiles default hash sha1
set network ike crypto-profiles ike-crypto-profiles default dh-group group2
set network ike crypto-profiles ike-crypto-profiles default lifetime hours 8
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 encryption aes-128-cbc
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 hash sha256
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 dh-group group19
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-128 lifetime hours 8
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 encryption aes-256-cbc
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 hash sha384
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 dh-group group20
set network ike crypto-profiles ike-crypto-profiles Suite-B-GCM-256 lifetime hours 8
set network ike crypto-profiles ipsec-crypto-profiles default esp encryption [ aes-128-cbc 3des ]
set network ike crypto-profiles ipsec-crypto-profiles default esp authentication sha1
set network ike crypto-profiles ipsec-crypto-profiles default dh-group group2
set network ike crypto-profiles ipsec-crypto-profiles default lifetime hours 1
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 esp encryption aes-128-gcm
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 esp authentication none
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 dh-group group19
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-128 lifetime hours 1
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 esp encryption aes-256-gcm
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 esp authentication none
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 dh-group group20
set network ike crypto-profiles ipsec-crypto-profiles Suite-B-GCM-256 lifetime hours 1
set network ike crypto-profiles global-protect-app-crypto-profiles default encryption aes-128-cbc
set network ike crypto-profiles global-protect-app-crypto-profiles default authentication sha1
set network qos profile default class class1 priority real-time
set network qos profile default class class2 priority high
set network qos profile default class class3 priority high
set network qos profile default class class4 priority medium
set network qos profile default class class5 priority medium
set network qos profile default class class6 priority low
set network qos profile default class class7 priority low
set network qos profile default class class8 priority low
set network virtual-router default protocol bgp enable no
set network virtual-router default protocol bgp dampening-profile default cutoff 1.25
set network virtual-router default protocol bgp dampening-profile default reuse 0.5
set network virtual-router default protocol bgp dampening-profile default max-hold-time 900
set network virtual-router default protocol bgp dampening-profile default decay-half-life-reachable 300
set network virtual-router default protocol bgp dampening-profile default decay-half-life-unreachable 900
set network virtual-router default protocol bgp dampening-profile default enable yes
set shared application
set shared application-group
set shared service
set shared service-group
set shared botnet configuration http dynamic-dns enabled yes
set shared botnet configuration http dynamic-dns threshold 5
set shared botnet configuration http malware-sites enabled yes
set shared botnet configuration http malware-sites threshold 5
set shared botnet configuration http recent-domains enabled yes
set shared botnet configuration http recent-domains threshold 5
set shared botnet configuration http ip-domains enabled yes
set shared botnet configuration http ip-domains threshold 10
set shared botnet configuration http executables-from-unknown-sites enabled yes
set shared botnet configuration http executables-from-unknown-sites threshold 5
set shared botnet configuration other-applications irc yes
set shared botnet configuration unknown-applications unknown-tcp destinations-per-hour 10
set shared botnet configuration unknown-applications unknown-tcp sessions-per-hour 10
set shared botnet configuration unknown-applications unknown-tcp session-length maximum-bytes 100
set shared botnet configuration unknown-applications unknown-tcp session-length minimum-bytes 50
set shared botnet configuration unknown-applications unknown-udp destinations-per-hour 10
set shared botnet configuration unknown-applications unknown-udp sessions-per-hour 10
set shared botnet configuration unknown-applications unknown-udp session-length maximum-bytes 100
set shared botnet configuration unknown-applications unknown-udp session-length minimum-bytes 50
set shared botnet report topn 100
set shared botnet report scheduled yes
set zone trust network virtual-wire ethernet1/2
set zone untrust network virtual-wire ethernet1/1
set service-group
set service
set schedule
set rulebase security rules rule1 from trust
set rulebase security rules rule1 to untrust
set rulebase security rules rule1 source any
set rulebase security rules rule1 destination any
set rulebase security rules rule1 service any
set rulebase security rules rule1 application any
set rulebase security rules rule1 action allow
set rulebase security rules rule1 log-end yes
set application-group
set application
set mgt-config users admin phash ＊＊＊＊＊
set mgt-config users admin permissions role-based superuser yes
[edit]
admin@PA-200#
