Palo Alto SD-WAN Engineer key terms

A software-defined approach to wide area networking that centrally manages links and steers traffic across multiple transports using policies rather than static router configuration.

The Prisma SD-WAN construct that groups sites, policies, and device stacks so that connectivity and security rules are applied consistently across an organization's locations.

A logical grouping of SD-WAN hardware and its elements (ports, interfaces, WAN and LAN resources) inside the Prisma SD-WAN portal that defines how a site is built.

Palo Alto Networks Instant On Network appliance deployed at a branch or data center that terminates WAN links, runs routing, and enforces SD-WAN policy.

A remote location modeled in the SD-WAN portal with its own devices, WAN interfaces, and LAN subnets, typically managed through a configuration template.

A reusable set of interface, routing, and policy settings applied to many sites so that branch deployments stay consistent and require minimal per-site customization.

A physical or logical port on an SD-WAN device bound to a service provider circuit, carrying the IP addressing, bandwidth, and cost attributes used for path selection.

The port on an SD-WAN appliance that connects to internal networks and advertises local subnets into the overlay so other sites can reach them.

A logical tunnel fabric built on top of physical WAN links that lets sites exchange traffic as if directly connected, independent of the underlying transport provider.

The physical transport infrastructure, such as MPLS, broadband, or LTE circuits, over which the SD-WAN overlay tunnels are established.

An encrypted or logical connection between SD-WAN endpoints that carries overlay traffic, with its own state, path, and selection policy.

Measured characteristics of a WAN path such as latency, jitter, packet loss, and throughput, used to decide which link should carry a given application flow.

A defined set of acceptable latency, jitter, and loss thresholds assigned to an application class so the system can detect when a path no longer meets requirements.

The policy mechanism that chooses which WAN path or paths an application's traffic uses, based on application identity, path quality, and business priority.

The runtime decision process that evaluates available tunnels against policy and quality metrics and picks the best path for each flow.

A numeric weight assigned to a WAN interface that biases path selection, so lower-cost links are preferred when quality requirements are otherwise met.

A named category of applications sharing steering, SLA, and priority treatment, used to simplify policy creation across many individual applications.

The ordered collection of SD-WAN rules, from site-level to global, that the system evaluates top-down to determine how traffic is handled.

The routing protocol commonly used between SD-WAN devices and provider or core networks to exchange reachability information for site and data center prefixes.

A link-state interior routing protocol that SD-WAN appliances can run on LAN or WAN segments to dynamically learn and advertise internal subnets.

A configuration condition where prefixes learned on one interface are redistributed into another routing domain unintentionally, potentially exposing internal networks.

Palo Alto Networks converged cloud-delivered security and networking service that combines SD-WAN, secure web gateway, and zero trust capabilities in one platform.

The branch networking component of Prisma SASE that provides application-aware overlay networking, policy-based steering, and native integration with cloud security.

The cloud-hosted security stack, including secure web gateway, cloud access security broker, and firewall as a service, that inspects traffic from branches and remote users.

A logical link from an SD-WAN site to a Prisma SASE security service point, allowing branch traffic to be inspected in the cloud before reaching the internet or SaaS.

A modular integration in the SD-WAN portal that connects the fabric to a cloud service, such as security inspection or cloud on-ramp, without extra appliances.

A rule set that determines which TLS or SSL traffic is decrypted for inspection and which is exempted, balancing visibility against privacy and performance.

A security model that verifies identity and device posture for every session and grants least-privilege access, rather than trusting traffic based on network location.

A component that brokers access to private applications for remote users, enforcing identity and posture checks before allowing a connection into the internal network.

A portal visualization of sites, links, and tunnels with health indicators, used to spot degraded paths or down devices at a glance.

A chronological record of system and policy events generated by SD-WAN devices and the portal, used to correlate incidents and audit changes.

An automatically raised notification when a monitored condition crosses a threshold, such as a link down or an SLA violation, prompting operator action.

Collection and analysis of per-application flow records that shows which paths traffic used and how it performed over time.

A test packet stream sent between SD-WAN endpoints to continuously measure latency, jitter, and loss on each path independent of real user traffic.

A structured sequence of checks, from physical link and tunnel state through routing and policy, used to isolate the cause of an SD-WAN connectivity problem.

A saved snapshot of device or portal configuration that can be restored after a failure or used to compare and roll back unintended changes.

The controlled process of moving SD-WAN devices to a newer firmware release, typically staged by site or device group to limit service disruption.