Palo Alto NetSec Architect flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

SP3 architecture

Single-pass parallel processing: the dataplane performs networking, App-ID, User-ID, and Content-ID in one pass, so throughput depends on which features are enabled.

App-ID shift

App-ID identifies applications by signature and context rather than port alone, so a rule allowing tcp/80 does not automatically allow the web-browsing application.

User-ID group mapping

Group mapping maps users to groups from directory sources; policy can match source user or source group, and unknown-user is a separate match value.

Virtual wire deployment

Two interfaces bridged without MAC or IP changes; the firewall inspects and blocks inline but does not route or NAT, so it is a transparent bump in the wire.

TAP interface

A passive receive-only interface that copies traffic for inspection and logging; it cannot block or drop traffic because it is not inline.

Active/passive HA

One device is active and one is standby; they share a virtual MAC set on the active device, and failover moves the floating IPs and MACs.

Zone default actions

Interzone traffic is denied by default and intra-zone traffic is allowed by default; the implicit interzone-default rule logs only if configured to log.

Forward proxy decryption

Outbound TLS inspection where the firewall presents a certificate signed by a trusted forward-trust CA and re-encrypts to the server.

Management interface default

The management port defaults to 192.168.1.1/24; the initial configuration is done over HTTPS or the console before licensing and updates.

ZTP requirements

Zero Touch Provisioning needs a registered serial number, outbound HTTPS to the ZTP service, and an auth key or registration PIN to fetch the bootstrap config.

Panorama device group

A device group holds policy rules and objects pushed to member firewalls; templates separately hold network and device settings.

Template stack

A template stack orders templates and binds them to managed devices; settings in higher templates override lower ones when values conflict.

HA1 and HA2 links

HA1 carries control and state synchronization; HA2 carries session and forwarding table data; both should use dedicated ports for reliable failover.

Aggregate ethernet

An LACP bundle of physical interfaces that acts as one logical interface; it provides link redundancy and increased bandwidth for HA or uplinks.

Virtual router

A separate routing table instance; interfaces and subinterfaces are assigned to a virtual router, and policy-based forwarding can override its lookup.

Subscription expiry effect

Expired content subscriptions stop signature, URL, and WildFire updates; existing policy still enforces, but detection quality degrades over time.

First-match policy

Security policy is evaluated top-down and the first matching rule's action applies; later rules are not evaluated for that session.

Application-default service

A service setting that uses the ports the application signature declares; it is the recommended pairing with an application in a rule.

Profile group

A container of security profiles (antivirus, anti-spyware, vulnerability, URL, file blocking, WildFire) applied to allow rules for content inspection.

Destination NAT order

Destination NAT is evaluated before security policy, and source NAT after policy; NAT rules are first-match, so ordering matters.

Bi-directional NAT

A NAT rule option that creates matching forward and reverse translations, commonly used when publishing an internal server to the internet.

No-decrypt rule

A decryption policy rule that excludes traffic from inspection, used for categories or apps that break or are legally restricted.

Zone protection profile

A per-zone profile for flood, reconnaissance, packet-based attack, and protocol protection; it applies before policy to protect the firewall itself.

Unknown-user handling

Policy can match unknown-user explicitly; without handling, unmapped users may fall through to a broader rule or the default deny.

Security profile application

Profiles attach to allow rules; if no profile is attached, traffic is permitted without antivirus, anti-spyware, or vulnerability inspection.

Traffic log fields

Traffic logs record the matched rule, App-ID, source and destination NAT, bytes, and session end reason, which is key for troubleshooting.

Session detail lookup

The session detail view shows applied rule, NAT translation, App-ID, and profile verdicts for a live session, identified by session ID.

Packet capture stages

Web UI capture can filter by stage (firewall, drop, receive, transmit) to show where a packet is dropped along the dataplane path.

Global drop counters

Counters filtered by severity drop or delta reveal why sessions fail, such as policy deny, routing failure, or resource exhaustion.

Commit failure causes

Common commit errors are duplicate object names, unresolved references, HA config mismatch, and Panorama template or device group conflicts.

Path monitoring

An HA health check that pings specified destinations from a monitored source IP; failure can trigger failover when path monitoring is enabled.

Panorama commit scope

Panorama pushes configuration by device group and template scope; isolating the failing scope narrows down a failed push to managed devices.