Network Security
Domain 1: Network Security
This domain tests how PAN-OS enforces policy on live traffic: App-ID, Content-ID, User-ID, zones, virtual routers, NAT, decryption, and HA. The exam favors traffic-flow reasoning over memorized menu paths.
Core rules
- PAN-OS uses a single-pass parallel processing architecture; App-ID, Content-ID, and User-ID are evaluated together, not in separate proxy passes.
- Security policy is top-down; the first match wins, and an implicit deny-all follows. Intrazone traffic defaults to allow; interzone defaults to deny.
- App-ID identifies the application by signature and protocol behavior, not by port. Allowing an application also allows its dependencies, so broad allow rules can admit more than intended.
- Security profiles (antivirus, anti-spyware, vulnerability, URL, WildFire, DNS) must be attached to an allow rule; without a profile, the rule permits but does not inspect.
- NAT is not a security control. Source NAT changes the source address, destination NAT publishes an internal server, and security policy must still allow the traffic; do not assume NAT hides or protects a host.
Worked example
A rule allows applications web-browsing and ssl from Trust to Untrust. Users reach an unsanctioned SaaS app over HTTPS. The firewall logs the session as ssl and permits it. Reasoning: without SSL forward proxy decryption, App-ID cannot reliably identify the inner application or URL; the broad ssl allow matches. Fix: enable decryption, trust the forward-proxy CA on endpoints, then add an explicit deny for the SaaS application and narrow ssl to only required apps.
Traps
Allowing web-browsing does not replace an explicit deny for a SaaS app. Decryption without endpoint CA trust breaks browsing. A NAT rule does not bypass security policy. HA failover does not copy sessions unless session synchronization is configured.