Palo Alto PSE Strata cheat sheet

Security policy evaluation order: rulebase is read top-down, first match wins; a rule with action deny stops evaluation, so place specific allows above broad denies.

Zone-based enforcement: traffic must enter a source zone and exit a destination zone; intrazone traffic is controlled by the intrazone-default rule, interzone by interzone-default, both deny by default.

App-ID classification sequence: IP/port, then protocol decode, then application signature, then heuristics; SSL/TLS decryption is required to identify apps inside encrypted sessions.

Content-ID order: threat prevention (anti-virus, anti-spyware, vulnerability) runs before URL filtering and file blocking within the same policy; decryption policy is evaluated before security policy for the session.

NAT types: source NAT (SNAT) translates source for egress and is defined in a NAT policy above security policy; destination NAT (DNAT) maps inbound public IP/port to an internal server.

AppOverride forces a port-based application signature on a custom port, overriding default port mapping; do not use it as a substitute for proper App-ID policy.

Security profiles attach threat prevention, WildFire, URL filtering, and file blocking to a rule; profile group bundles multiple profiles for reuse across rules.

Decryption policy matches by URL category, source/destination, and user; SSL Forward Proxy is used for outbound inspection, SSL Inbound Inspection for internal servers.

WildFire submits files to a cloud sandbox and returns a verdict (malicious, benign, phishing, grayware) that feeds anti-virus and file-blocking signatures; verdicts propagate to all subscribers.

DNS Security (DNS Sinkhole/ADNS) blocks malicious domains at resolution, catching command-and-control before a TCP session is established; requires a DNS Security license.

URL Filtering uses a cloud-hosted category database; PAN-DB categories include credential-phishing and newly registered domains that update without a content release.

Threat Prevention combines anti-spyware, anti-virus, and vulnerability protection; inline ML and cloud-delivered signatures are enabled via content updates and licenses.

IoT Security discovers unmanaged devices via behavioral analysis of traffic and applies policy recommendations; it does not require an agent on the device.

SaaS Security (SaaS Inline / CASB) enforces data-loss and access controls for sanctioned SaaS apps; SaaS Security API uses API-based out-of-band scanning.

Advanced Threat Prevention adds inline ML-based detection and evasive-threat coverage beyond standard signatures; requires the appropriate subscription.

Enterprise DLP and SaaS Security share data patterns and profiles; DLP inspects content in allowed traffic and can block or alert based on data pattern match.

Strata Cloud Manager (SCM) is the cloud management plane for NGFWs, Prisma Access, and SD-WAN; it provides unified policy, objects, and monitoring across deployments.

Configuration is organized into folders and snippets; folders form a hierarchy and policies inherit downward, while snippets are reusable object/policy fragments applied to folders.

Policy types in SCM include security, decryption, NAT, and application override; each is managed per-folder and pushed to managed firewalls.

Deployment profiles define how firewalls connect to SCM; a firewall must be onboarded with a registration token and authenticated before policy push.

Prisma Access uses SCM for service connection and remote network configuration; mobile users and remote networks are configured as separate onboarding types.

Monitoring in SCM aggregates logs from managed devices; log forwarding and data-lake storage support reporting and AIOps insights.

Role-based access control in SCM uses roles (superuser, administrator, viewer) scoped to folders; permissions are inherited down the folder tree.

Configuration versioning and commit history allow rollback; changes are staged, validated, then committed to devices, with a push status per device.

PAN-OS hardware platforms include PA-series (PA-400, 1400, 3400, 5400, 7000 series) and VM-series virtual firewalls for public/private cloud.

Management interfaces: MGT port for out-of-band management; dedicated HA ports for HA1 (control) and HA2 (data) links; console port for serial access.

HA modes: Active/Passive and Active/Active; HA1 carries control/heartbeat, HA2 synchronizes sessions; HA3 is used for packet forwarding in some topologies.

Panorama provides centralized management for multiple firewalls; templates define device/network settings, device groups define policy and objects.

Software firewalls (VM-series) support the same PAN-OS feature set subject to licensing and platform limits; VM-Series can run on ESXi, KVM, Hyper-V, and public clouds.

Licensing: support, subscriptions (Threat Prevention, WildFire, URL, DNS, etc.), and capacity licenses are separate; a base license is required before subscriptions activate.

Commit types: candidate config is validated then committed; commit force overrides validation warnings; partial commits are not supported for all changes.

Factory reset and maintenance mode: boot into maintenance mode via console to reset config, install PAN-OS, or retrieve logs; password recovery requires console access.