Palo Alto PSE Strata key terms

A logical grouping of interfaces and subnets that share the same trust level. Zone-based rules decide which traffic is allowed between segments, and a zone must be assigned to each interface before policies apply.

A firewall rule whose source and destination fields reference security zones rather than individual IP addresses. Traffic is evaluated by the zone pair it traverses, which simplifies rule sets across many subnets.

The core policy object that matches traffic on zone, address, user, application, and service, then applies an action such as allow, deny, or drop. Rules are evaluated top-down within the rulebase.

The traffic classification engine that identifies applications by inspecting signatures, protocol behavior, and heuristics, even when they use nonstandard ports or encryption. The identified application then drives policy and security profiles.

A feature that maps IP addresses to directory users and groups so policies can reference identities instead of addresses. Mapping sources include agents, server monitoring, captive portal, and authentication logs.

The set of scanning engines, including antivirus, anti-spyware, vulnerability protection, and file blocking, that inspects allowed traffic for threats. Content-ID profiles attach to security rules to enforce protection.

A container that bundles multiple security profiles, such as antivirus, anti-spyware, URL filtering, and file blocking, so one reference on a rule applies them all. It reduces configuration effort and enforces consistent protection.

A rule that rewrites source or destination addresses and ports as traffic crosses the firewall. Source NAT hides internal addresses, while destination NAT publishes internal services to external clients.

A logical routing instance that holds interfaces, static routes, and dynamic routing protocols. Multiple virtual routers let one firewall serve separate networks with independent routing tables.

A physical or logical port through which traffic enters or leaves the firewall. Each interface is configured with a mode, such as layer 3, layer 2, virtual wire, or tap, and is bound to a zone.

An interface deployment mode that transparently bridges two ports so the firewall sits inline without requiring IP addressing or routing changes. Security policy still applies to the inspected traffic.

A web page presented to unauthenticated users before they receive network access. It can collect credentials to build User-ID mappings or display acceptable-use terms for guest networks.

A decryption method where the firewall intercepts outbound TLS sessions, presents its own certificate to the client, and re-encrypts traffic to the server. It enables inspection of encrypted outbound sessions.

A decryption method for traffic destined to internal servers, where the firewall uses the server's certificate and private key to decrypt inbound TLS sessions. It requires importing the server key pair.

A rulebase that determines which TLS and SSH sessions are decrypted, bypassed, or blocked. It is evaluated separately from security rules and usually references certificates and URL categories.

A policy object that categorizes web destinations and allows, alerts, blocks, or continues based on category. It can also enforce safe search and credential-submission controls.

A cloud service that analyzes submitted files and links in a sandbox, then generates signatures that firewalls download to block newly discovered malware. It complements on-box antivirus with unknown-threat detection.

A cloud-delivered service that inspects DNS queries and blocks domains associated with malware, phishing, and command-and-control activity. It catches threats before a TCP connection is ever established.

A cloud-based web classification service that uses real-time analysis and machine learning to categorize previously unseen URLs and block phishing or malicious pages faster than static databases.

A cloud-delivered engine that detects unknown command-and-control traffic and evasive exploits using inline machine learning and behavioral analysis, complementing signature-based anti-spyware and vulnerability profiles.

A cloud service that discovers and controls sanctioned and unsanctioned SaaS applications, including data sharing and tenant restrictions. It gives visibility into application use that traditional web filtering cannot see.

Cloud Access Security Broker: a control point that mediates access between users and cloud services, enforcing policy for shadow IT discovery, data sharing, and tenant restrictions.

A service that inspects content and file transfers for sensitive data patterns, such as credit card numbers or personal identifiers, and blocks or alerts on policy violations. It can apply to web, SaaS, and email traffic.

A centrally managed DLP deployment where policy and incident data are administered from a cloud console and applied across multiple firewalls. It differs from on-box DLP profiles configured per device.

A cloud service that discovers unmanaged devices on the network, profiles their behavior, and recommends policies. It addresses devices that cannot run agents and often lack authentication.

A cloud-delivered management console for configuring and monitoring firewalls, policies, and security services across an organization. It provides centralized policy, visibility, and health monitoring.

A folder, snippet, or device grouping in Strata Cloud Manager that determines where configuration objects and rules apply. Scopes are hierarchical, so settings inherit downward and can be overridden locally.

A Strata Cloud Manager capability that analyzes rule usage, identifies redundant or shadowed rules, and suggests consolidation. It helps reduce rulebase complexity and tighten security posture.

A cloud-delivered security platform that provides firewall and security services from distributed cloud locations for mobile users, branches, and cloud workloads. It is managed through Strata Cloud Manager.

A link between an organization's network and Prisma Access infrastructure, established through IPsec tunnels or dedicated interconnects. It carries traffic between on-premises or cloud networks and the security service.

A deployment where two firewalls pair so one takes over if the other fails. Active-passive and active-active modes synchronize sessions and configuration to minimize disruption.

The process by which a standby firewall in a high-availability pair becomes active after detecting a failure of its peer. Link, path, and health monitors trigger the transition.

The continuous replication of session state between HA peers so established connections survive a failover. Without it, users would need to re-establish sessions after a switchover.

A centralized management appliance or virtual machine for configuring and monitoring multiple firewalls. It uses device groups and templates to push policy and network settings consistently.

The operation that validates and applies pending configuration changes to the running firewall. Until a commit succeeds, edits exist only as candidate configuration.

The editable copy of the firewall configuration where changes are staged before being validated and committed. It allows multiple edits to be reviewed together before taking effect.

The ordered collection of security, NAT, decryption, and other policy rules evaluated for each session. Order matters because the first matching rule typically determines the action.

A configuration object that defines how users are authenticated, such as against a local database, RADIUS, LDAP, or SAML identity provider. It is referenced by administrative and end-user authentication features.

A Panorama construct that groups firewalls sharing policy, letting administrators push security rules to many devices at once. It separates policy management from network template configuration.