On a Palo Alto Firewall Interface:

$2.$ Do the following to Site $1$

a$.$ Load Named Config $5$ and Commit

b$.$ Delete the virtual router

c$.$ Create a new virtual router and name it something.

d$.$ Add Eth $1/2$ and Eth $1/3$ to the new virtual router

e$.$ Configure the following on Eth $1/4-$This is your new Internet interface

i$.$ Make it a layer $3$ interface

ii$.$ Assign it to the new virtual router

iii. Assign it to a new zone, called outside

iv$.$ Configure its IP address for DHCP Client

f$.$ Configure Source NAT $($PAT$)$ for Users$\_$Net to outside

g$.$ Configure a Security policy for Users$\_$Net to outside

h$.$ Add default route virtual router for $0\mathrm{.}0\mathrm{.}0\mathrm{.}0/0$ to the ISP of $221\mathrm{.}100\mathrm{.}250\mathrm{.}1$ using the interface Eth $1/4$

i$.$ Rename the Extranet Zone to DMZ

j$.$ Commit these changes and test that you can browse the Internet before continuing.