Palo Alto SD-WAN Engineer study plan
Palo Alto SD-WAN Engineer · Give each week a clear focus.
8 weeks · About 7 hours per week
SD-WAN Deployment and Configuration
Map every SD-WAN deployment component (hub, branch, controller, Prisma SASE fabric) and draw the data-plane vs control-plane paths from memory
Configure a branch firewall template with SD-WAN enabled and verify the WAN interface profile is applied correctly
Compare the three SD-WAN interface types (hub-only, spoke, mesh) and write a one-line decision rule for each
List the prerequisites for onboarding a device into an SD-WAN fabric and check them against a lab device
Your checkpoint
A one-page topology diagram plus a completed prerequisite checklist for one lab branch device, with a screenshot-free written verification of each configuration step
SD-WAN Deployment and Configuration
Build a site-to-site SD-WAN topology with one hub and two branches in a lab, applying templates or variables consistently
Configure path quality profiles (latency, jitter, packet loss thresholds) and explain how each threshold triggers a path change
Configure a VPN cluster or overlay and verify tunnel establishment between all sites
Document the exact configuration objects created so they can be recreated without the UI
Your checkpoint
A written configuration runbook listing every object (template, stack, interface profile, path quality profile) with its key settings and a validation checklist
SD-WAN Routing and Policy
Configure static and dynamic routing (BGP) across the SD-WAN overlay and verify route propagation to every branch
Write policy rules that steer specific application traffic over a preferred path and explain the match and action order
Configure a traffic distribution profile (best path, weighted, priority) and predict which path a given flow takes
Test failover by simulating a path degradation and record the observed convergence time
Your checkpoint
A routing and policy matrix showing each application class, the matched policy, the selected path, and the measured failover time from the lab test
SD-WAN Routing and Policy & SD-WAN Security and Prisma SASE Integration
Define application-based and user-based SD-WAN policies and explain how they combine with security policy evaluation order
Configure a security policy that allows sanctioned SaaS traffic directly and backhauls unsanctioned traffic to the hub
Identify where SD-WAN policy, security policy, and decryption policy intersect and describe the evaluation sequence
Configure application override or custom application signatures for an internal app and confirm correct identification
Your checkpoint
A policy evaluation flow diagram (SD-WAN policy, security policy, decryption policy) plus a written test log showing five flows correctly allowed, backhauled, or blocked
SD-WAN Security and Prisma SASE Integration
Describe how Prisma SASE integrates with SD-WAN (fabric, service connection, explicit proxy) and diagram each traffic path
Configure a service connection to a Prisma SASE security service and verify traffic reaches it
Apply decryption policy to selected traffic and explain the tradeoffs of decrypting SaaS vs backhauled traffic
Configure threat prevention and URL filtering profiles on the SD-WAN path and validate with test traffic
Your checkpoint
A traffic-flow diagram covering direct internet, backhaul, and Prisma SASE service-connection paths, with a test log proving each security profile fires
SD-WAN Monitoring, Troubleshooting, and Operations
Use the SD-WAN monitoring dashboards to read path quality, application performance, and tunnel health for a simulated incident
Interpret a path quality event and trace it from alarm to affected flow using logs and flow tables
Configure log forwarding and a syslog or email alert for path degradation and tunnel down events
Run a packet capture on the SD-WAN interface and identify the tunnel encapsulation in the capture
Your checkpoint
An incident report for one simulated path-degradation scenario: timeline, evidence pulled from dashboards and logs, root cause, and remediation
SD-WAN Monitoring, Troubleshooting, and Operations & SD-WAN Deployment and Configuration
Perform a full configuration backup and compare two configurations to identify drift between hub and branch
Diagnose a tunnel that fails to establish by working through IKE, routing, and policy checks in order
Upgrade or roll back a device configuration in the lab and verify SD-WAN tunnels recover
Build a troubleshooting decision tree for the five most common SD-WAN failure symptoms
Your checkpoint
A troubleshooting decision tree document plus a written post-mortem of one deliberately broken tunnel you diagnosed and repaired
SD-WAN Deployment and Configuration & SD-WAN Routing and Policy & SD-WAN Security and Prisma SASE Integration & SD-WAN Monitoring, Troubleshooting, and Operations
Re-derive the key configuration objects, routing behaviors, security integration paths, and monitoring metrics for all four domains from memory
Take a timed practice assessment and log every missed question by domain and root cause
Re-review only the weakest two areas and correct the specific misconceptions identified
Write a final one-page cheat sheet of decision rules, defaults, and evaluation orders
Your checkpoint
A scored practice assessment with a per-domain error log and a one-page final cheat sheet covering all four domains
Milestones
Week 2: Can build a working hub-and-two-branch SD-WAN topology from templates and explain every object created, without notes
Week 4: Can trace any given flow through SD-WAN policy, security policy, and decryption policy and predict the outcome before testing
Week 6: Can diagnose a simulated path-quality incident end to end using only dashboards, logs, and packet captures, producing a defensible root cause
Week 8: Scores at least 80% on the timed practice assessment with no domain below 70%, and can recite the policy evaluation order and failover thresholds from memory