Palo Alto SD-WAN Engineer flashcards
Palo Alto SD-WAN Engineer · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Prisma SD-WAN controller
- The management plane that stores configuration, pushes policy to ION devices, and provides the portal/API used for monitoring and operations.
- ION device
- The branch appliance in Prisma SD-WAN that terminates overlay tunnels, enforces policy, and forwards traffic between the LAN and WAN interfaces.
- Site object
- Logical container for one location that holds its ION devices, WAN interfaces, service links, and network policy; devices must be assigned to it.
- Interface profile
- Per-WAN-interface settings including provisioned bandwidth, ISP, and cost, used by path selection and QoS; bandwidth must match the circuit's committed rate.
- Service link
- Logical tunnel endpoint (VPN, internet, or private WAN) used for path selection; a physical interface can carry multiple service links with different tags.
- Policy stack order
- Rules are evaluated top-down and the first match wins; the catch-all default rule sits at the bottom, so specific rules must be placed above it.
- Path quality profile
- Latency, jitter, and loss thresholds that determine whether a WAN path is acceptable; traffic is re-steered when the active path degrades beyond them.
- Service-link tag
- Label such as VPN, internet, or MPLS that policy references to choose which service links an application may use; missing tags yield no viable path.
- BGP on the LAN side
- The ION peers with the LAN core to advertise branch prefixes into the fabric and learn LAN routes, enabling overlay reachability.
- Prisma SASE
- Combined offering of Prisma SD-WAN branch fabric, Prisma Access cloud-delivered security, and security services such as URL filtering and WildFire.
- Security zone
- Logical grouping such as trust or untrust that defines where traffic enters or exits; zone-based rules must reference the correct source and destination zones.
- SSL/TLS decryption
- Inspection of encrypted traffic required for URL filtering and threat inspection; decryption policies are separate from security rules and must be enabled.
- WildFire
- Cloud malware sandboxing service whose verdicts arrive asynchronously, so a file may be allowed initially and blocked later when the verdict returns.
- DNS security
- Prisma SASE protection that requires the branch to forward DNS through a proxy to Prisma SASE; a local resolver bypasses it.
- Path quality metrics
- Latency, jitter, and loss measured per path; a red path in the portal means the active path exceeded its quality profile thresholds.
- Flow view
- Portal view showing per-flow path selection, application identification, and bytes, used to confirm whether an application is steered as intended.
- Commit validation
- Staged configuration changes are validated before applying; failures such as bandwidth over-subscription or duplicate prefixes block the commit and show a message.
- Device offline troubleshooting
- Check the management interface default route, DNS resolution, and outbound HTTPS 443 reachability to the controller's FQDN.
- HA redundant pair
- Two ION devices at a branch sharing a virtual IP and synchronizing state so overlay tunnels fail over without re-establishing from the far end.
- Zero-touch provisioning
- Onboarding method where an ION with outbound HTTPS 443 reachability and a valid claim code in the correct tenant receives its full configuration from the controller.
- Inline vs bridge mode
- Inline or router mode forwards traffic through the ION with routing participation; bridge mode transparently forwards without changing IP addressing.
- QoS bandwidth allocation
- Per-application-class guarantees within an interface profile; the sum of guarantees must not exceed provisioned interface bandwidth or the commit is rejected.
- Application identification
- Layer-7 signature-based recognition of applications that drives policy matching, so an Office365 rule differs from an any or IP-prefix rule.
- Route preference
- Administrative distance or BGP local preference and MED that determine which underlay or learned route the ION selects when multiple paths exist.
- Prisma Access service connection
- IPsec or GRE connection used when a branch should send traffic to a specific Prisma Access location; the branch's service link must map to it.
- Local vs cloud inspection
- Security enforcement can occur on the ION for local or on-prem traffic or in Prisma Access for internet-bound traffic, so the same rule may apply at either point.
- Security rule ordering
- Security rules are first-match; a broad allow-any rule placed above a specific deny rule bypasses the deny, making order a security control.
- Tunnel up but no traffic
- Usually a policy or steering issue rather than connectivity; check the flow view and policy stack before troubleshooting the tunnel itself.
- Event timeline
- Portal view of configuration pushes, tunnel flaps, and policy changes with timestamps, used to correlate a user-reported outage with a specific change.
- Configuration history
- Portal record of committed configurations that can be reviewed and rolled back to after a bad change.
- Support case data
- Site ID, device serial, timestamp, and relevant event or flow exports, captured to shorten resolution when opening a support case.
- Baseline before change
- Recording path quality and application performance per site before a policy change so post-change behavior can be compared against it.