PALO ALTO FIREWALL STUDY GUIDE
1. Palo Alto Networks Firewall Overview
What is Palo Alto Firewall?
A Palo Alto Networks Next-Generation Firewall (NGFW) provides:
- Network security
- Application identification and control
- Threat prevention
- Malware protection
- URL filtering
- User identification
- VPN connectivity
- Zero Trust security enforcement
Core Security Technologies
| Technology | Purpose |
|---|---|
| App-ID | Identifies applications regardless of port/protocol |
| Content-ID | Detects and blocks threats/content |
| User-ID | Maps users to IP addresses |
| Device-ID | Identifies devices |
| WildFire | Cloud-based malware analysis |
| Threat Prevention | Blocks exploits, viruses, spyware |
| SSL Decryption | Inspects encrypted traffic |
2. Palo Alto Firewall Architecture
Management Plane
Responsible for:
- Configuration
- Web GUI
- CLI access
- Logging
- Reporting
- Device management
Data Plane
Responsible for:
- Packet forwarding
- Security policy enforcement
- NAT
- VPN processing
- Threat inspection
Control Plane
Responsible for:
- Routing protocols
- System management processes
- HA communication
3. Initial Firewall Setup
Default Credentials
Username: admin Password: admin
First steps:
✅ Change password
✅ Configure management IP
✅ Configure hostname
✅ Configure DNS
✅ Configure NTP
✅ Install licenses
✅ Update software/content
4. Palo Alto Configuration Hierarchy
Device | |-- Management |-- Licenses |-- Software Updates |-- Administrators |-- Authentication | Network | |-- Interfaces |-- Zones |-- Virtual Routers |-- NAT |-- VPN | Policies | |-- Security Rules |-- NAT Rules |-- QoS |-- Decryption | Objects | |-- Addresses |-- Services |-- Applications |-- Security Profiles
5. Interfaces
Interface Types
Layer 3 Interface
Used for:
- Routing
- IP addressing
- Security zones
Example:
ethernet1/1 IP: 203.0.113.2/30 Zone: Untrust
Layer 2 Interface
Used for:
- Switching
- VLAN environments
Virtual Wire
Used for:
- Transparent firewall deployment
Tunnel Interface
Used for:
- IPsec VPN
- GRE tunnels
6. Security Zones
Zones control traffic movement.
Common zones:
Trust Untrust DMZ Guest VPN Management
Example:
Inside Users | Trust Zone | Palo Alto Firewall | Untrust Zone | Internet
7. Virtual Router
The virtual router provides routing functionality.
Supports:
- Static routes
- OSPF
- BGP
- RIP
Example default route:
Destination: 0.0.0.0/0 Next Hop: ISP Gateway
8. Routing Commands
Show routing table:
show routing route
Test route:
test routing fib-lookup virtual-router default ip 8.8.8.8
9. Security Policies
Security policies determine:
- Who can communicate
- What applications are allowed
- When access is permitted
Policy evaluation:
- Top to bottom
- First match wins
Example:
Source Zone: Trust Destination Zone: Untrust Application: web-browsing Action: Allow
10. Security Profiles
Security profiles inspect allowed traffic.
Antivirus
Detects:
- Viruses
- Malware
Anti-Spyware
Detects:
- Command and control traffic
Vulnerability Protection
Blocks:
- Exploits
- Attacks
URL Filtering
Controls:
- Website categories
File Blocking
Controls:
- File uploads/downloads
WildFire Analysis
Detects:
- Unknown malware
11. NAT Configuration
Source NAT
Used for internal users accessing Internet.
Example:
Private IP 192.168.1.10 Translated to Public IP 203.0.113.5
Types:
- Dynamic IP and Port
- Static IP
- Dynamic IP
Destination NAT
Used for publishing internal servers.
Example:
Internet:
203.0.113.20
Translated:
192.168.10.20
12. Application Identification (App-ID)
App-ID identifies applications.
Examples:
Traditional firewall:
Allow TCP 443
Palo Alto:
Allow: ssl Block: unknown-tcp
Benefits:
- Stops port-based attacks
- Controls applications
- Provides visibility
13. User-ID
Maps users to IP addresses.
Example:
192.168.10.50 = John Smith
Sources:
- Active Directory
- Captive Portal
- GlobalProtect
- Agent-based identification
14. GlobalProtect VPN
Provides:
- Remote access VPN
- Always-on VPN
- Device security checks
Components:
Portal
Provides:
- Client configuration
- Authentication
Gateway
Provides:
- VPN tunnel termination
- Security enforcement
15. High Availability (HA)
Used for firewall redundancy.
Modes:
Active/Passive
One firewall active.
Example:
PA-01 Active PA-02 Passive
Active/Active
Both firewalls process traffic.
HA Synchronizes:
- Configuration
- Sessions
- User information
16. Panorama Management
Panorama provides centralized management.
Functions:
- Manage multiple firewalls
- Push policies
- Collect logs
- Reporting
Hierarchy:
Panorama Device Groups | Firewalls Templates | Network Settings
17. Logging and Monitoring
Important logs:
Traffic Logs
Show:
- Source
- Destination
- Application
- Action
Threat Logs
Show:
- Attacks
- Malware
- Exploits
System Logs
Show:
- Firewall events
Configuration Logs
Show:
- Changes made
18. Troubleshooting Commands
System Information
show system info
Interface Status
show interface all
Session Information
show session all
ARP Table
show arp all
Packet Capture
debug dataplane packet-diag
Ping Test
ping host 8.8.8.8
Trace Route
traceroute host 8.8.8.8
19. Commit Process
Palo Alto uses a candidate configuration.
Workflow:
Make Changes | ↓ Validate | ↓ Commit | ↓ Running Configuration
Commands:
commit
Check pending changes:
show config diff
20. Common Troubleshooting Checklist
User Cannot Access Internet
Check:
☐ Interface status
☐ IP addressing
☐ Default route
☐ NAT rule
☐ Security policy
☐ DNS
☐ Security profiles
Application Not Working
Check:
☐ Traffic logs
☐ App-ID detection
☐ Security policy
☐ SSL decryption
☐ Threat logs
VPN Problem
Check:
☐ Authentication
☐ Certificate validity
☐ Gateway status
☐ Client configuration
☐ Firewall rules
21. Palo Alto Certification Path
PCCET
Entry-level cybersecurity fundamentals
PCNSA
Firewall administration
PCNSE
Professional-level Palo Alto security engineer
Key PCNSE Topics:
- Security policies
- NAT
- VPN
- HA
- Panorama
- User-ID
- App-ID
- Threat Prevention
- Troubleshooting
22. Recommended Learning Sequence
- Firewall Architecture
- Management Interface
- Interfaces and Zones
- Virtual Routers
- Routing
- Security Policies
- NAT
- App-ID
- Content-ID
- User-ID
- VPN
- High Availability
- Panorama
- Troubleshooting
- Advanced Security Features
Quick Memory Formula
Palo Alto Security Stack
I-Z-R-P-N-A-U-T-H
- I = Interfaces
- Z = Zones
- R = Routing
- P = Policies
- N = NAT
- A = App-ID
- U = User-ID
- T = Threat Prevention
- H = High Availability
This guide covers the core knowledge required for Palo Alto firewall administration and preparation for PCNSA/PCNSE-level study.
