PCNSA cheat sheet

PAN-OS uses single-pass parallel processing: networking, security policy, threat inspection, and management run on dedicated processing resources, and content is scanned once per packet.

Product families: PA-220 through PA-5400/PA-7000 hardware firewalls, VM-Series for hypervisors and public clouds, CN-Series for Kubernetes, and Prisma Access for cloud-delivered SASE.

The three identification technologies are App-ID (application), User-ID (user and group), and Content-ID (threat and data inspection); security profiles implement Content-ID.

Panorama, available as M-100/M-600 appliances or as a virtual machine, centralizes policy through device groups, network settings through templates, and log collection.

GlobalProtect delivers remote-user VPN; WildFire performs cloud sandbox analysis; DNS Security, IoT Security, and URL Filtering are subscription services.

Management plane defaults: MGT port 192.168.1.1/24, HTTPS on 443, SSH on 22, and console access; the management plane is separate from the data plane.

High availability modes are active/passive and active/active; HA1 is the control link, HA2 carries session data, and HA3 forwards packets in active/active.

An unlicensed firewall still forwards traffic but loses subscription features such as Threat Prevention, WildFire, and URL Filtering.

Configuration tiers are candidate (editable), running (active), and committed versions; a Commit validates the candidate configuration and activates it.

Predefined admin roles are Superuser, Superuser (read-only), Device administrator, Virtual system administrator, and Virtual system superuser; role profiles customize permissions.

Administrators authenticate locally or through RADIUS, TACACS+, LDAP, Kerberos, SAML, or multi-factor authentication.

Log types include Traffic, Threat, URL Filtering, WildFire Submissions, Data Filtering, Decryption, Authentication, User-ID, HIP Match, GlobalProtect, System, Config, Correlation, and Tunnel.

Log forwarding profiles send logs to Panorama, syslog, SNMP, email, or HTTP; each log type has its own quota and discard policy.

Dynamic updates deliver Applications and Threats, Antivirus, WildFire, and URL database content; PAN-OS software upgrades are handled separately.

Policy Optimizer reports unused rules and rules still matching on ports instead of App-ID, and supports converting them to App-ID rules.

The Application Command Center and dashboard provide traffic, threat, and application visibility, while config audit compares committed configuration versions.

Security rule match fields: zones, source and destination addresses, source user, source HIP, application, service, URL category, and schedule; actions are allow, deny, drop, and reset-client, reset-server, or reset-both.

Rules are evaluated top-down and the first match wins; implicit bottom rules are intrazone-default (allow) and interzone-default (deny).

Zone types are Layer 3, Layer 2, virtual wire, tap, external, and tunnel; zone protection profiles attach to Layer 3 zones.

NAT policy is evaluated before security policy, but matching traffic still requires a security rule that permits the translated session.

Source NAT types are dynamic IP and port (hide), dynamic IP, and static IP; destination NAT provides port forwarding and U-turn NAT handles same-zone hairpin traffic.

Service 'application-default' restricts a rule to the ports an application uses by default, while 'any' opens all ports and weakens the rule.

Security profile groups bundle antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, WildFire analysis, and data filtering profiles.

Interface types include Ethernet, aggregate Ethernet with LACP, VLAN subinterfaces, loopback, and tunnel; virtual routers route between Layer 3 zones.

App-ID identifies applications using signatures, protocol decoding, and behavioral context, so traffic is classified regardless of port, protocol, or encryption.

Application objects carry category, subcategory, technology, risk (1-5), default ports, timeout, and characteristics such as evasive, pervasive, or used by malware.

Application filters are dynamic objects that match by category, subcategory, technology, risk, or characteristic and update automatically with content releases.

Unidentified traffic appears as unknown-tcp, unknown-udp, insufficient-data, or not-applicable; policy can treat each of these separately.

Dependent applications require their underlying application to be allowed, for example web-browsing and ssl, before the dependent app can function.

An application override forces traffic on defined ports to a custom application, bypassing signature-based identification for those ports.

SSL decryption through forward proxy, inbound inspection, or SSH proxy is required for App-ID and threat inspection inside encrypted sessions; decryption profiles control exceptions.

Policy Optimizer shows which applications each rule actually matches, supporting migration from port-based rules to App-ID rules.

URL Filtering requires a license and a URL Filtering profile attached to an allow rule; the profile sets an action for each URL category.

Category actions are allow, block, continue (allow with logging), override (a user may proceed with the override password), and alert.

PAN-DB is the cloud-hosted URL database; the firewall can also use an on-premises URL database or a local cache, configured under Device > Setup > Content-ID.

Custom URL categories contain URL lists, IP address lists, or category-match lists, and can be referenced in policy rules and filtering profiles.

HTTPS URL visibility depends on SSL decryption or on certificate and SNI inspection; undecrypted traffic limits category matching and header logging.

The URL Filtering profile also controls safe search enforcement, YouTube restricted mode, credential phishing detection and enforcement, and HTTP header logging.

External dynamic lists of URLs, domains, or IP addresses are hosted on an external server and refreshed on a schedule for use in policy and custom categories.

A blocked session returns a response page, and the URL Filtering log records category, URL, action, user, and source address.