PCNSE key terms

A traffic classification technology that identifies the application generating a session by analyzing signatures, protocol behavior, and, where needed, decrypted payload, regardless of port, protocol, or encryption. It is the foundation for application-based security policy.

A feature that maps source IP addresses to individual users or groups by consuming identity data from agents, captive portal, or directory services, so security policy and logs can be written in terms of users rather than addresses.

The collective name for the scanning engines and profiles that inspect allowed traffic, including threat prevention, anti-spyware, URL filtering, file blocking, WildFire, and data filtering, after App-ID has classified a session.

An ordered rule in the security policy that matches traffic by zone, address, user, application, and service, then applies an action such as allow, deny, or drop along with profiles and logging options.

A logical grouping of interfaces that share the same trust level and security requirements. Traffic moving between zones is subject to security policy, while traffic within a zone is not inspected by default.

A PAN-OS routing instance that holds a routing table and participates in routing protocols such as static routes, OSPF, BGP, and RIP. Interfaces and subnets are assigned to a virtual router to reach other networks.

A rule set evaluated after security policy that translates source or destination addresses and ports for traffic entering or leaving a zone. It supports source NAT, destination NAT, and static NAT with bidirectional options.

A pair of interfaces bound together that passes traffic transparently between two network segments without routing or switching. Security policy, profiles, and decryption can still be applied to the inspected traffic.

Two firewalls configured as an active/passive or active/active pair that synchronize sessions and configuration so that one takes over if the other fails, preserving connectivity and security enforcement.

A Panorama object that groups firewalls sharing a common policy ruleset. Policies pushed from the device group are combined with local rules on each managed firewall in a defined order.

A Panorama construct that combines templates containing network and device settings, such as interfaces, zones, and virtual routers, and applies them to managed firewalls in a defined order.

An architecture approach that groups assets into zones by trust and function and controls traffic between them with policy, limiting lateral movement and simplifying rule management. It is planned before deployment, not after.

The editable copy of the running configuration on a firewall. Changes stay in the candidate configuration until a commit validates and applies them to the running configuration, making them active.

The process by which Panorama sends device group and template configuration to managed firewalls, which then commit locally. Push scope, order, and target devices determine what each firewall receives.

A profile attached to security rules that specifies which log types are forwarded to external destinations such as Panorama, syslog servers, SNMP traps, or email, and at what severity.

A policy that forces traffic matching a custom signature or port to be identified as a specific application, useful for custom or internally developed applications that App-ID cannot recognize.

A rule set that determines which sessions are decrypted for inspection, which are excluded, and which use no decryption, based on source, destination, user, application, category, and certificate.

A decryption method for outbound traffic in which the firewall intercepts the client's TLS session, presents a certificate it signs with a trusted CA, and opens a separate session to the server.

Certificates the firewall presents to clients during SSL forward proxy. The forward trust certificate is signed by an internal CA trusted by clients; the forward untrust certificate is presented for sites that fail certificate validation.

A profile that defines the certificate and the allowed protocol versions and cipher suites a firewall uses when it acts as a TLS server, for example for decryption, captive portal, or GlobalProtect.

A security profile that detects and blocks spyware, command-and-control traffic, and malicious DNS queries using signatures and DNS Security categories, with actions configured per severity.

A security profile that inspects allowed traffic for exploits and protocol anomalies using signatures and applies actions such as alert, drop, or reset by severity and category.

A security profile that categorizes web requests and applies allow, block, continue, or alert actions by category, with optional credential enforcement and safe search enforcement for specific sites.

A security profile that sends eligible files to the WildFire cloud service for sandbox analysis and enforces verdicts, such as benign, malware, or phishing, returned for those files.

A subscription feature that detects and blocks malicious DNS queries and domain generation algorithm activity by comparing domains against threat intelligence and applying policy actions.

A profile applied to a zone's ingress that protects the firewall and network from floods, port scans, and malformed packets, with thresholds for SYN, UDP, ICMP, and other flood types.

A policy that classifies traffic by zone, address, and user and applies rate limits or drop actions to protect specific resources from denial-of-service floods, complementing zone protection.

A site-to-site tunnel between firewalls or third-party gateways that encrypts traffic using IKE for key negotiation and IPsec for data protection, defined by IKE gateways and crypto profiles.

A remote access solution with a portal that authenticates users and distributes configuration, and gateways that establish encrypted tunnels and enforce security policy for endpoints.

Application Command Center, a Panorama and firewall dashboard that visualizes traffic, threats, and application usage over time, with drill-downs to logs for investigation.

Subscription-delivered packages that add new application signatures, threat signatures, URL categories, and WildFire verdicts to the firewall. They are separate from PAN-OS software upgrades and have their own schedule.

The process of installing a new PAN-OS release on a firewall, typically requiring a base image, configuration backup, and consideration of HA pair upgrade order and content compatibility.

An exported copy of the firewall's configuration, used to restore settings after failure or to move configuration between devices. Panorama can also store configuration versions for managed firewalls.

A counter showing how many sessions a security rule has matched since it was last reset or since commit. Low or zero counts help identify rules that can be consolidated or removed.

A CLI capability that filters and captures packets on a firewall interface or across the dataplane, saving them to a file for analysis of connectivity, routing, and inspection problems.

System-wide metrics viewable from the CLI or GUI that track drops, resource usage, and error conditions across dataplane and management plane, useful for spotting where traffic is being discarded.

A bundled archive of logs, configuration, and diagnostic output generated by the firewall and sent to support for analysis. It includes system details but can contain sensitive data.

A table of all active sessions tracked by the firewall, showing source, destination, application, state, and policy match. It is used to verify whether traffic is being allowed and inspected.