PALO ALTO FIREWALL STUDY GUIDE

1. Palo Alto Networks Firewall Overview

What is Palo Alto Firewall?

A Palo Alto Networks Next-Generation Firewall (NGFW) provides:

Network security
Application identification and control
Threat prevention
Malware protection
URL filtering
User identification
VPN connectivity
Zero Trust security enforcement

Core Security Technologies

Technology	Purpose
App-ID	Identifies applications regardless of port/protocol
Content-ID	Detects and blocks threats/content
User-ID	Maps users to IP addresses
Device-ID	Identifies devices
WildFire	Cloud-based malware analysis
Threat Prevention	Blocks exploits, viruses, spyware
SSL Decryption	Inspects encrypted traffic

2. Palo Alto Firewall Architecture

Management Plane

Responsible for:

Configuration
Web GUI
CLI access
Logging
Reporting
Device management

Data Plane

Responsible for:

Packet forwarding
Security policy enforcement
NAT
VPN processing
Threat inspection

Control Plane

Responsible for:

Routing protocols
System management processes
HA communication

3. Initial Firewall Setup

Default Credentials


Username: admin
Password: admin

First steps:

✅ Change password
✅ Configure management IP
✅ Configure hostname
✅ Configure DNS
✅ Configure NTP
✅ Install licenses
✅ Update software/content

4. Palo Alto Configuration Hierarchy


Device
 |
 |-- Management
 |-- Licenses
 |-- Software Updates
 |-- Administrators
 |-- Authentication
 |
Network
 |
 |-- Interfaces
 |-- Zones
 |-- Virtual Routers
 |-- NAT
 |-- VPN
 |
Policies
 |
 |-- Security Rules
 |-- NAT Rules
 |-- QoS
 |-- Decryption
 |
Objects
 |
 |-- Addresses
 |-- Services
 |-- Applications
 |-- Security Profiles

5. Interfaces

Interface Types

Layer 3 Interface

Used for:

Routing
IP addressing
Security zones

Example:


ethernet1/1
IP: 203.0.113.2/30
Zone: Untrust

Layer 2 Interface

Used for:

Switching
VLAN environments

Virtual Wire

Used for:

Transparent firewall deployment

Tunnel Interface

Used for:

IPsec VPN
GRE tunnels

6. Security Zones

Zones control traffic movement.

Common zones:


Trust
Untrust
DMZ
Guest
VPN
Management

Example:


Inside Users
     |
   Trust Zone
     |
 Palo Alto Firewall
     |
 Untrust Zone
     |
 Internet

7. Virtual Router

The virtual router provides routing functionality.

Supports:

Static routes
OSPF
BGP
RIP

Example default route:


Destination:
0.0.0.0/0

Next Hop:
ISP Gateway

8. Routing Commands

Show routing table:


show routing route

Test route:


test routing fib-lookup virtual-router default ip 8.8.8.8

9. Security Policies

Security policies determine:

Who can communicate
What applications are allowed
When access is permitted

Policy evaluation:

Top to bottom
First match wins

Example:


Source Zone:
Trust

Destination Zone:
Untrust

Application:
web-browsing

Action:
Allow

10. Security Profiles

Security profiles inspect allowed traffic.

Antivirus

Detects:

Viruses
Malware

Anti-Spyware

Detects:

Command and control traffic

Vulnerability Protection

Blocks:

Exploits
Attacks

URL Filtering

Controls:

Website categories

File Blocking

Controls:

File uploads/downloads

WildFire Analysis

Detects:

Unknown malware

11. NAT Configuration

Source NAT

Used for internal users accessing Internet.

Example:


Private IP
192.168.1.10

Translated to

Public IP
203.0.113.5

Types:

Dynamic IP and Port
Static IP
Dynamic IP

Destination NAT

Used for publishing internal servers.

Example:

Internet:


203.0.113.20

Translated:


192.168.10.20

12. Application Identification (App-ID)

App-ID identifies applications.

Examples:

Traditional firewall:


Allow TCP 443

Palo Alto:


Allow:
ssl

Block:
unknown-tcp

Benefits:

Stops port-based attacks
Controls applications
Provides visibility

13. User-ID

Maps users to IP addresses.

Example:


192.168.10.50

=
John Smith

Sources:

Active Directory
Captive Portal
GlobalProtect
Agent-based identification

14. GlobalProtect VPN

Provides:

Remote access VPN
Always-on VPN
Device security checks

Components:

Portal

Provides:

Client configuration
Authentication

Gateway

Provides:

VPN tunnel termination
Security enforcement

15. High Availability (HA)

Used for firewall redundancy.

Modes:

Active/Passive

One firewall active.

Example:


PA-01 Active

PA-02 Passive

Active/Active

Both firewalls process traffic.

HA Synchronizes:

Configuration
Sessions
User information

16. Panorama Management

Panorama provides centralized management.

Functions:

Manage multiple firewalls
Push policies
Collect logs
Reporting

Hierarchy:


Panorama

Device Groups
       |
     Firewalls

Templates
       |
 Network Settings

17. Logging and Monitoring

Important logs:

Traffic Logs

Show:

Source
Destination
Application
Action

Threat Logs

Show:

Attacks
Malware
Exploits

System Logs

Show:

Firewall events

Configuration Logs

Show:

Changes made

18. Troubleshooting Commands

System Information


show system info

Interface Status


show interface all

Session Information


show session all

ARP Table


show arp all

Packet Capture


debug dataplane packet-diag

Ping Test


ping host 8.8.8.8

Trace Route


traceroute host 8.8.8.8

19. Commit Process

Palo Alto uses a candidate configuration.

Workflow:


Make Changes
      |
      ↓
Validate
      |
      ↓
Commit
      |
      ↓
Running Configuration

Commands:


commit

Check pending changes:


show config diff

20. Common Troubleshooting Checklist

User Cannot Access Internet

Check:

☐ Interface status
☐ IP addressing
☐ Default route
☐ NAT rule
☐ Security policy
☐ DNS
☐ Security profiles

Application Not Working

Check:

☐ Traffic logs
☐ App-ID detection
☐ Security policy
☐ SSL decryption
☐ Threat logs

VPN Problem

Check:

☐ Authentication
☐ Certificate validity
☐ Gateway status
☐ Client configuration
☐ Firewall rules

21. Palo Alto Certification Path

PCCET

Entry-level cybersecurity fundamentals

PCNSA

Firewall administration

PCNSE

Professional-level Palo Alto security engineer

Key PCNSE Topics:

Security policies
NAT
VPN
HA
Panorama
User-ID
App-ID
Threat Prevention
Troubleshooting

22. Recommended Learning Sequence

Firewall Architecture
Management Interface
Interfaces and Zones
Virtual Routers
Routing
Security Policies
NAT
App-ID
Content-ID
User-ID
VPN
High Availability
Panorama
Troubleshooting
Advanced Security Features

Quick Memory Formula

Palo Alto Security Stack

I-Z-R-P-N-A-U-T-H

I = Interfaces
Z = Zones
R = Routing
P = Policies
N = NAT
A = App-ID
U = User-ID
T = Threat Prevention
H = High Availability

This guide covers the core knowledge required for Palo Alto firewall administration and preparation for PCNSA/PCNSE-level study.

menu

Thursday, July 30, 2026