Hardware and Software Firewalls
Domain 4: Hardware and Software Firewalls
This domain tests platform selection and PAN-OS deployment options: PA-400, PA-1400, PA-3400, PA-5400, PA-7000, VM-Series, and CN-Series. The exam emphasizes sizing metrics, licensing, and feature support rather than port counts alone.
Core rules
- PA-400 series is for branch and small campus; PA-1400 for midsize; PA-3400 for large branch and midsize data center; PA-5400 for data center; PA-7000 for high-end data center and service provider. Choose by measured throughput, not model number.
- Size on the relevant throughput metric: App-ID, Threat Prevention, and decryption throughput differ. A platform that passes 20 Gbps of raw firewall throughput may not pass 20 Gbps with Threat Prevention enabled.
- VM-Series runs PAN-OS on hypervisors and public clouds; performance depends on allocated vCPUs, memory, and hypervisor limits. CN-Series provides containerized NGFW for Kubernetes.
- Licensing can be BYOL or pay-as-you-go in clouds; subscriptions must match the platform and deployment. HA is supported on hardware and VM-Series, with active/passive and active/active options.
- PAN-OS feature support varies by release and platform; verify release notes before designing decryption, SD-WAN, or high-availability features.
Worked example
A data center needs 15 Gbps of Threat Prevention throughput with multiple 100G interfaces. A PA-3400 is proposed because its raw firewall throughput looks high enough. Reasoning: the requirement is Threat Prevention, not raw throughput, and 100G interface density points to PA-5400 or PA-7000. Validate the model's Threat Prevention rating and interface modules, then reserve headroom for growth.
Traps
Sizing on firewall throughput alone is the most common error. VM-Series does not automatically match a PA-3400. PoE is available only on specific PA-400 models, not every branch firewall. A license purchased for a hardware appliance does not transfer to a VM-Series.