Deployment and Installation
Deployment modes and prerequisites
NGFW deployment begins with choosing the interface model: routed (L3) interfaces bound to zones, transparent/virtual-wire, or TAP for monitoring only. A common trap is assuming virtual-wire provides routing or NAT-it forwards at Layer 2 and still requires policy. Separate the management plane onto a dedicated out-of-band VLAN; mixing management and data traffic creates exposure and complicates HA.
Bring-up sequence
Order matters. Rack and cable, set console/admin credentials, configure DNS, NTP, and time zone, then register and license the device, apply content updates, install a baseline policy, and only then join HA. NTP before licensing and certificate enrollment prevents authentication and log-correlation failures. Verify license capacity (sessions, throughput, VPN peers) before cutover; an unlicensed feature can silently drop or throttle traffic.
Traps in exam questions
Watch for: factory-reset versus configuration revert, backups taken before upgrade, virtual versus hardware licensing, and whether the management interface may carry data. Confirm boot partition and software version compatibility before pairing HA units.
Rule of thumb
If a newly installed firewall passes no traffic, verify in order: link status, interface zone assignment, route, policy match, NAT, then license. Most broken installs are missing routes or zones, not policy.
Worked example
A branch firewall with management on 10.0.0.0/24 and data on the same 10.0.0.0/24 will conflict; move management to a dedicated VLAN and confirm NTP reachability before registration.