Deployment and Implementation
Deployment and Implementation
This domain tests repeatable deployment: initial firewall access, licensing, software baselines, Panorama onboarding, templates and device groups, HA, routing, NAT, and cloud bootstrap. The exam rewards designs that are reproducible and auditable, not hand-built one-offs.
Core rules
- Build a golden baseline: supported PAN-OS release, NTP/DNS, admin authentication, management interface restrictions, and licenses for subscriptions and support.
- Use Panorama templates for network configuration and device groups for policy. Order templates in a stack deliberately so shared settings and site overrides are predictable.
- Choose interface type by requirement: L3 for routing, L2 for bridging, virtual wire for transparent inspection, tap for monitoring. Configure virtual routers and routing protocols before policy cutover.
- Automate cloud and branch rollout with bootstrap: VM-Series or CN-Series registers to Panorama, pulls license and configuration, then joins HA or a scale set.
- Validate with commit validation, test policy match, and pre-change packet captures.
Worked example
A new VM-Series in AWS must be inspected inline. Deploy two instances in different availability zones, use a bootstrap bucket to register to Panorama, assign a template stack for VPC interfaces and a device group for policy, and place the firewalls behind a Gateway Load Balancer endpoint. Reason: GWLB provides symmetric flow steering; bootstrap avoids manual CLI; Panorama keeps policy consistent. If you instead attach public IPs directly, you create asymmetric return paths and bypass the inspection point.
Traps
Committing only local configuration when Panorama manages the device; template and device-group override confusion; missing license activation; HA link MTU mismatch; changing routing before policy; and forgetting that NAT and security policy are separate rulebases.