Palo Alto NetSec Architect cheat sheet

Single-pass parallel processing (SP3) architecture: one pass through the dataplane applies App-ID, Content-ID, User-ID, and networking functions simultaneously; throughput sizing must assume threat prevention enabled, not App-ID alone.

App-ID classification order: decryption, then application signature/context, then heuristics, then port/protocol default; unknown-tcp/unknown-udp are separate from the incomplete/insufficient-data states.

User-ID sources: agent (read-only domain controller monitoring), terminal server agent, captive portal, XML API, Cloud Identity Engine, and clientless VPN; group mapping refresh interval defaults to 20 minutes.

Decryption design: forward proxy for outbound, inbound inspection for published servers, and SSH proxy for outbound SSH; TLS 1.3 requires the forward proxy with a trusted CA chain and client trust of the forward-trust certificate.

HA design: active/passive shares one virtual MAC set and uses HA1 (control) plus HA2 (data) links; active/active requires per-device floating IPs and switch/routing support for asymmetric paths.

Zones define the security boundary: inter-zone traffic is denied by default, intra-zone traffic is allowed by default; tap and virtual-wire interfaces have no IP and no routing or NAT participation.

Session sizing: max sessions and max sessions-per-second differ by platform and by whether App-ID/Content-ID is on; SSL forward proxy sessions consume far more memory than plaintext sessions.

Segmentation via virtual systems (multi-vsys) or vsys-less multi-tenancy: each vsys has its own policy, objects, and admin roles; inter-vsys traffic is routed or via external zones, not implicit.

Initial access: management interface default 192.168.1.1/24; configure via CLI (set mgt-config) or the web UI; a license and content subscription must be installed before dynamic updates.

Deployment modes: L3 (routed), L2, virtual wire (bump in the wire, no MAC/IP change), and TAP (passive, receive-only, no blocking); virtual wire supports two interfaces only per pair.

Zero Touch Provisioning (ZTP) requires a registered serial number, outbound HTTPS to the ZTP service, and a configured auth key or registration PIN; Panorama can push the first config.

Panorama: device groups hold policy and objects, templates hold network/device settings; template stacks bind templates to devices; commit to Panorama then push to managed devices.

HA pair bring-up: same model, same PAN-OS version, matching licenses, HA1/HA2 links on dedicated ports, config sync enabled, and preemptive disabled by default.

Interface types: aggregate ethernet (LACP), subinterfaces (802.1Q VLAN tags), loopback (for management/BGP peering), and tunnel interfaces for IPSec/SSL VPN.

Routing: static, OSPF, BGP, and RIP supported; virtual routers separate routing tables; policy-based forwarding overrides the virtual router lookup for matching traffic.

Licensing: base, subscription (Threat Prevention, WildFire, URL, DNS Security, GlobalProtect), and support; expired subscriptions stop signature and URL updates but policy remains enforced.

Policy evaluation is top-down, first match wins; a rule action of allow, deny, or drop (silent) applies; the implicit interzone-default deny is logged only if configured to log at session end.

Rule anatomy: source/destination zone, source/destination address, source user, application, service, URL category, action, profile group, and scheduling; application-default uses the app's ports.

Security profiles: Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, WildFire Analysis, DNS Security, and Data Filtering; grouped in a profile group applied to allow rules.

NAT order: destination NAT (DNAT) is evaluated before policy, source NAT (SNAT) after policy; NAT rules are first-match; use bi-directional NAT for server publishing.

App-ID in policy: specifying an application narrows the rule; service any plus application default is the recommended pairing; unknown-tcp/udp rules should be tightly scoped and profiled.

Decryption policy is separate and evaluated before security policy; no-decrypt rules should cover categories that break under inspection (finance, health, certificate-pinned apps).

User-ID policy: source user or source hip match requires user mapping; unknown-user is a distinct match value and should be handled explicitly in policy.

Zone protection profiles: flood protection (SYN, ICMP, UDP, other IP), reconnaissance protection (scan thresholds), packet-based attack protection, and protocol protection; applied per zone.

Log types: Traffic, Threat, URL, WildFire, Data, Config, System, HIP, and Decryption; each has its own log DB and retention; logs can be forwarded to Panorama, syslog, SNMP, or email.

Session detail view (show session all / session id) shows the applied rule, NAT translation, App-ID, and the security profile verdicts; filter with show session filter.

Packet capture: tcpdump on the dataplane via CLI (tcpdump filter) and packet capture in the web UI with stage filters (firewall, drop, receive, transmit); useful to prove where a packet is dropped.

Global counters: show counter global filter severity drop or delta yes; drop counters such as flow_do_not_like, ctd error, and session setup failures point to policy, routing, or resource issues.

Commit failures: validate with the commit error detail; common causes are duplicate objects, unresolved references, HA config mismatch, and template/template-stack conflicts in Panorama.

Content updates: dynamic updates for apps/threats, antivirus, WildFire, and URL; check with request content upgrade info; scheduled updates require an active subscription.

High availability failover triggers: path monitoring, link monitoring, HA1/HA2 heartbeat loss, and NFS/disk failure; split-brain is avoided by heartbeat and the HA state machine.

Panorama monitoring: managed device health, commit status, and log collection; use the Panorama commit scope (device group/template) to isolate push failures.