PCNSE cheat sheet

Interface modes: tap (mirrored traffic, monitor only), virtual wire (bump-in-the-wire, no MAC/IP change), Layer 2, Layer 3, and tunnel; only Layer 3 interfaces participate in routing through a virtual router.

A vsys is a virtual firewall instance with its own policy, objects, interfaces, zones, and administrators; a virtual router is the Layer 3 routing instance inside a vsys, and Layer 3 zones must be bound to one.

HA link roles: HA1 carries control traffic and configuration sync, HA1 backup provides redundancy, HA2 carries session and forwarding-table sync, HA3 carries forwarded packets between peers.

HA peers must match on hardware model, PAN-OS version, content release version, and subscription licensing before an HA pair can form.

Active/passive has one forwarding peer at a time; active/active has both peers forwarding with floating IP addresses and requires HA3 links between the devices.

Select PAN-OS by the vendor's preferred release for the platform rather than the newest version, because preferred releases are chosen for stability over feature recency.

Sizing must be done with App-ID, Threat Prevention, and TLS decryption enabled; each enabled feature lowers the achievable throughput below the datasheet maximum.

Panorama sizing is driven by managed firewall count and log volume; high log retention requires dedicated log collectors or Panorama in Panorama mode with collectors.

Decryption planning: SSL forward proxy requires distributing a forward trust CA to endpoints (GPO or MDM), while inbound inspection requires importing each internal server certificate and private key.

Panorama separation of duties: templates and template stacks carry network configuration (interfaces, zones, virtual routers, HA), device groups carry policy and objects, and device-level settings stay local to the firewall.

Template stack conflict resolution: the template placed highest in the stack wins, and the 'force template values' option overwrites locally configured network values on the firewall during push.

Device group hierarchy: a child device group inherits objects and rules from its parent, and parent rules are evaluated as part of the child's rulebase ordering.

The default rulebase ends with interzone-default (deny) and intrazone-default (allow); explicit rules must be placed above them to change that behavior.

Source NAT types: dynamic IP and port translates to the egress interface address or a pool and also translates the source port; dynamic IP uses a pool without port translation; static IP is one-to-one.

A destination NAT rule with the bi-directional option enabled also performs source NAT, so return traffic from the internal server uses the firewall's translated address.

Zone protection profiles attach to a zone and act before session creation: flood protection (SYN, ICMP, UDP, other IP), reconnaissance (port scan, host sweep), and packet-based attack protection.

Service routes define which interface and source IP the firewall uses for management-plane services such as DNS, email, SNMP, syslog, and dynamic updates.

HA2 may run over dedicated HA ports or in-band across data interfaces; HA1 backup and HA2 backup add redundant paths for the respective control and data synchronization traffic.

A Panorama change is two phases: Commit to Panorama validates and saves the candidate configuration, then Push to Devices delivers it, either to all devices or a selected device group or firewall.

Log types include traffic, threat, URL filtering, WildFire, data filtering, decryption, authentication, HIP match, system, config, and correlation logs.

Log forwarding profiles are attached to security rules and control where logs go: Panorama, syslog servers, SNMP trap receivers, email, or HTTP; syslog requires a server profile.

Failover triggers include HA1 hello loss, link monitoring failure, path monitoring failure, and manual administrator action; preemptive mode lets the higher-priority device reclaim the active role.

Path monitoring pings configured destination IP addresses from a source interface, while link monitoring watches the physical state of specified interfaces; both are configured per HA group.

The configuration log records every change with administrator, client, time, and a diff; the system log records operational events such as commits, HA transitions, and license changes.

Dynamic Updates scheduling covers Apps and Threats, WildFire, PAN-DB URL filtering, DNS Security, and antivirus; content updates require a valid support entitlement.

User-ID sources include the PAN-OS integrated agent, the Windows-based User-ID agent, the Terminal Services agent, XML API, captive portal, and syslog parsing; mappings can be verified in the User-ID monitor.

Dataplane capture sequence: set a filter with 'debug dataplane packet-diag set filter match ...', choose stages (firewall, drop, transmit), enable capture, then read the result with 'view-pcap no-file no-delta'.

Flow basic traces a packet through the dataplane and reports session lookup, security policy match, NAT translation, and the forwarding or drop decision for that packet.

'test security-policy-match' reports which security rule matches a given source, destination, application, and user without sending traffic; 'test nat-policy-match' does the same for NAT rules.

'show counter global filter severity drop' lists drops per dataplane and the module responsible; 'show counter interface' reports interface-level errors and discards.

'show session all filter source destination ' and 'show session id ' confirm whether a session was created and show its state, application, and NAT details.

Packet capture on the management interface uses tcpdump from the CLI; dataplane traffic must be captured with the packet-diag facility because tcpdump sees only management-plane traffic.

Decryption failures are usually certificate related: verify the forward trust and forward untrust chains, confirm endpoints trust the CA, and read the decryption log for the specific error.

A blocked commit is a validation error naming the offending object or policy; 'show jobs all' shows job status and 'show commits' shows commit history and results.

HA troubleshooting uses 'show high-availability state' and 'show high-availability interface' to confirm peer connectivity, link states, and the current active/passive role.

Decryption policy is evaluated before security policy; no-decrypt rules exempt traffic by category, source, destination, or URL, and decrypted traffic is then matched against security rules.

SSL forward proxy presents a certificate generated from the firewall's forward trust CA, so endpoints must trust that CA; the forward untrust certificate is presented to sites that fail certificate validation.

SSL inbound inspection requires the internal server certificate and its private key imported into the firewall, and is used to inspect sessions destined to protected internal servers.

A Threat Prevention profile combines anti-spyware, vulnerability protection, and anti-virus; it only takes effect when attached to a security rule directly or through a security profile group.

Anti-spyware actions are alert, block, and DNS sinkhole; sinkhole rewrites responses for malicious domains so clients connect to a firewall-owned address instead of the malicious server.

WildFire verdicts can block subsequent identical files when inline forwarding is enabled; WildFire functionality requires a WildFire subscription license on the firewall.

Route-based IPSec VPN uses an IKE gateway (phase 1), an IPSec crypto profile (phase 2), and a tunnel interface added to a virtual router; policy-based VPN instead uses proxy IDs on the tunnel.

GlobalProtect uses a portal to deliver client configuration and the gateway list, and a gateway to terminate tunnels; HIP profiles enforce endpoint posture inside security policy.

URL filtering matches PAN-DB categories; for HTTPS traffic the URL is only visible when SSL decryption is applied, otherwise matching falls back to certificate CN/SAN or destination IP.