Network Security Architecture and Design
Network Security Architecture and Design
This domain tests whether you can turn business and threat requirements into a PAN-OS reference architecture: zones, segmentation, routing, high availability, and capacity. The exam favors designs that enforce policy close to the workload, keep the management plane separate, and scale inspection without creating asymmetric paths.
Core rules
- Start from trust boundaries, not product models. Map users, applications, data, and east-west flows into security zones; then choose L3, L2, virtual wire, or tap interfaces.
- Size for inspected traffic. A firewall's App-ID and Threat Prevention throughput, session count, new sessions per second, and decryption capacity are lower than raw throughput.
- Use App-ID, User-ID, and Content-ID together. Policy should identify the application and user, then apply profiles for antivirus, vulnerability, anti-spyware, URL, file blocking, and WildFire.
- Design HA around failure domains. Active/passive is simpler; active/active requires traffic symmetry and careful NAT/routing. Separate HA links from data links and monitor critical paths.
- For cloud and SASE, place VM-Series or CN-Series where traffic can be steered, and use Prisma Access for mobile and branch users.
Worked example
A branch has two ISPs and needs an HA pair. Put both ISP links into separate virtual routers or policy-based forwarding paths, run active/passive HA, and advertise the default route only from the active device. Health monitors track each ISP next hop. If ISP A fails, the active firewall removes that path and the passive takes over only if the whole device fails. Reason: path monitoring handles link failure; HA failover handles device failure. Do not run active/active with unsynchronized NAT unless return paths are guaranteed.
Traps
Sizing by datasheet 'firewall throughput'; flattening all internal traffic into one trust zone; ignoring return-path symmetry; forgetting decryption capacity; putting management traffic on the data plane; and designing HA links across a high-latency WAN.