Network Security
What this domain tests
Network Security on this exam checks whether you can explain how a Palo Alto Networks next-generation firewall makes a forwarding and security decision. Expect questions on zones, policy order, App-ID, User-ID, Content-ID profiles, NAT, and decryption.
Core rules
- A security policy is evaluated top to bottom; the first matching rule is applied. Put specific rules above broad rules, and remember the default interzone rule denies traffic while the default intrazone rule allows it. Many candidates lose marks by relying on implicit rules instead of an explicit deny.
- App-ID identifies the application from traffic behavior, not just TCP port 443. User-ID maps source IP addresses to users and groups through agents, GlobalProtect, or Captive Portal. Content-ID profiles add vulnerability, anti-spyware, antivirus, WildFire, URL filtering, file blocking, and DNS security to an allow rule.
- NAT changes addresses; destination NAT is resolved before the security policy lookup, while source NAT is applied after it. A NAT rule alone does not permit traffic.
- Decryption is often required before App-ID, URL filtering, and DLP can see inside TLS. Without decryption, a firewall may see only ssl, not the inner application.
Worked example
A trust-zone client at 10.1.1.50 opens HTTPS to 203.0.113.10. The team writes a rule allowing application web-browsing on service application-default, then reports that the session is denied. The traffic is TLS, so the firewall identifies ssl unless decryption is enabled. The fix is to allow the correct application, add a decryption policy for that destination, and attach URL filtering and threat profiles to the allow rule. Changing the service port to any would widen access without solving identification.
Traps that cost marks
Do not assume port 443 equals web-browsing. Do not put a broad allow above a specific block. Do not forget that User-ID needs a valid mapping source and that stale mappings can misattribute traffic. Do not attach threat profiles to a deny rule and expect inspection.