Coming from Cisco VIRL, I found Eve incredibly simple to setup. It not only supports Cisco images, but other vendors as well, such as Palo Alto. In this tutorial I'll be installing the Palo Alto image on an Eve server hosted in VMware Fusion.

Lab details:

  • EVE-NG version: 2.0.3-110
  • QEMU version: 2.4.0
  • macOS Catalina 10.15.4
  • Palo Alto 8.1.10

Prerequisites

  • You need to have Eve setup already. I'm not going to run through that because it's as simple as downloading the OVA and importing it into your hypervisor of choice.
  • You need access to a Palo Alto virtual machine image.
  • Your local network has a DHCP server.

Setup

Follow this article to convert your Palo Alto OVA image to qcow2 format. It is quite simple. The process goes like this:

  1. Upload the OVA to the Eve server using SCP or SFTP.
  2. Uncompress the OVA file to produce a VMDK:
    tar xf PA_VM_FILENAME.ova
  3. Convert the VMDK to qcow2 format:
    /opt/qemu/bin/qemu-img convert -f vmdk -O qcow2 PA_VM_FILENAME.vmdk virtioa.qcow2
  4. Move the qcow2 image to the correct directory on the Eve server.
    mv virtioa.qcow2 /opt/unetlab/addons/qemu/paloalto-7.0.1
  5. Fix permissions.
    /opt/unetlab/wrappers/unl_wrapper -a fixpermissions

That’s it!

Now when you go to add a Palo Alto node, the “Add Node” dropdown will colorize the Palo Alto option in blue, and you can click it.

You can add multiple code versions if you have them as well if you need to stress test a new version in Pre Prod or something like that.

By default, Eve will connect you to the Palo Alto via VNC. VNC is trash, so let’s change that.

In order to connect to the Palo Alto GUI you need to connect the PA node to an Eve management network, like so:

  1. Create the management node in your Eve lab clicking Add > Network > Select Type: Management
  1. Connect the PA VM to the node.
  1. Your PA node is now bridged to VMware’s management network. In my case, it simply bridges the VM directly to my LAN so that the Palo Alto acquire an IP from my local DHCP server, and I can connect to it locally.
  2. Make sure that you connect to the mgmt port on the Palo Alto. No other interface will work.
  1. If you want to be able to connect to the CLI, edit the PA node and change Console to telnet. (Why on Earth it defaults to vnc is beyond me). I recommend that you change this before you start the VM, because you cannot change it while it’s running. I do this so that I can monitor the VM boot status, that way I can clearly see when it’s ready to connect to locally.
  2. Boot up the Palo Alto. WARNING: Be patient! The CLI console prompt transitions through following prompts on a PA-500 before it is ready to accept admin/admin login:
    1.  500 login:2.  PA-HDF login:3.  PA-VM login:It is at prompt #3 (need to hit enter to check if the prompt changed), that the device is ready to accept the admin/admin username/password to allow login. Once the PA gets to this screen, give it 5 more minutes.

Annnnnd…done!

Generally speaking, once you see that DHCP prompt, you’re good to go.

  1. If everything is setup correctly, the VM will pull an IP from your local DHCP server. Now you can connect via HTTPS/443.

Troubleshooting

If you get stuck, this information might help.

Here is Eve’s VM network settings:

Here is VMware Fusions global network settings: