Palo Alto Networks Certified Network Security Engineer (PCNSE) — Course Topics
Identify how Palo Alto Networks products work together to improve PAN-OS services
- Security components
- Firewall components
- Panorama components
- PAN-OS subscriptions and the features they enable
- Plugin components
- Heatmap and BPA reports
- Artificial intelligence operations (AIOps)/Telemetry
- IPv6
- Internet of things (IoT)
Determine and assess appropriate interfaces or zone types for various environments
- Layer 2 interface
- Layer 3 interfaces
- Virtual wire (vwire) interfaces
- Tap interfaces
- Subinterfaces
- Tunnel interfaces
- Aggregate interfaces
- Loopback interfaces
- Decrypt mirror interfaces
- VLAN interfaces
Identify decryption deployment strategies
- Risks and implications of enabling decryption
- Use cases
- Decryption types
- Decryption profiles and certificates
- Create a decryption policy in the firewall
- Configure SSH Proxy
Enforce User-ID
- Methods of building user-to-IP mappings
- Determine if User-ID agent or agentless should be used
- Compare and contrast User-ID agents
- Methods of User-ID redistribution
- Methods of group mapping
- Server profile and authentication profile
Determine how and when to use the Authentication policy
- Purpose of, and use case for, the Authentication policy
- Dependencies
- Captive portal versus GlobalProtect (GP) client
Define multiple virtual systems (multi-vsys) environment
- User-ID hub
- Inter-vsys routing
- Service routes
Configure Management Profiles
- Interface Management Profile
- SSL/TLS profile
Deploy and configure Security Profiles
- Custom configuration of different Security Profiles and Security Profile Croups
- Relationship between URL filtering and credential theft prevention
- Use of username and domain name in HTTP header insertion
- DNS Security
- How to tune or add exceptions to a Security Profile
- Compare and contrast threat prevention and advanced threat prevention
- Compare and contrast URL Filtering and Advanced URL Filtering
Configure zone protections, packet buffer protection, and DoS protection
- Customized values versus default settings
- Classified versus aggregate profile values
- Layer 3 and Layer 4 header inspection
Design the deployment configuration of a Palo Alto Networks firewall
- Advanced high availability (HA) deployments
- HA Pair
- Zero-Touch Provisioning
- Bootstrapping
Configure authorization, authentication, and device access
- Role-based access control for authorization
- Different methods used to authenticate
- The Authentication Sequence
- The device access method
Configure and manage certificates
- Usage
- Profiles
- Chains
Configure routing
- Dynamic routing
- Redistribution Profiles
- Static routes
- Route monitoring
- Policy-based forwarding
- Virtual routers versus logical routers
Configure NAT
- NAT policy rules
- Security rules
- Source NAT
- No-NAT Policies
- Use session browser to find NAT rule name
- U-Turn NAT
- Check HIT counts
Configure site-to-site tunnels
- IPsec components
- Static peers and dynamic peers for IPsec
- IPsec tunnel Monitor Profiles
- IPsec tunnel testing
- Generic Routing Encapsulation
- One-to-one and one-to-many tunnels
- Determine when to use proxy IDs
Configure service routes
- Default
- Custom
- Destination
- Custom routes for different virtual systems versus destination routes
- How to verify service routes
Configure application-based QoS
- Enablement requirements
- QoS policy rule
- Add a Differentiated Services Code Point/ToS component
- Qos Profile
- Determine how to control bandwidth use on a per-application basis
- Use QoS to monitor bandwidth utilization
Configure App-lD
- Create security rules with App-lD
- Convert port and protocol rules to App-lD rules
- Identify the impact of application override to overall firewall functionality
- Create custom apps and threats
- Review App-lD dependencies
Configure GlobalProtect
- GlobalProtect licensing
- Configure the gateway and the portal
- GlobalProtect agent
- Differentiate between logon methods
- Configure clientless VPN
- HIP
- Configure multiple gateway agent profiles
- split tunneling
Configure decryption
- Inbound decryption
- SSL forward proxy
- SSL decryption exclusions
- SSH proxy
Configure User-ID
- User-ID agent and agentless
- User-ID group mapping
- Shared User-ID mapping across virtual systems
- Data redistribution
- User-ID methods
- Benefits of using dynamic user groups (DUGs) in policy rules
- Requirements to support dynamic user groups
- How GlobalProtect internal and external gateways can be used
Configure WildFire
- Submission profile
- Action profile
- Submissions and verdicts
- Signature actions
- File types and file sizes
- Update schedule
- Forwarding of decrypted traffic
Configure Web Proxy
- Transparent proxy
- Explicit proxy
Configure templates and template stacks
- Components configured in a template
- How the order of templates in a stack affects the configuration push to a firewall
- Overriding a template value in a stack
- Configure variables in templates
- Relationship between Panorama and devices for dynamic update versions, policy
Configure device groups
- Device group hierarchies
- Identify what device groups contain
- Differentiate between different use cases for pre-rules, local rules, default rules, and
- Identify the impact of configuring a primary device
- Assign firewalls to device groups
- References
Manage firewall configurations within Panorama
- Licensing
- Commit recovery feature
- Automatic commit recovery
- Commit types and schedules
- Configuration backups
- Commit type options
- Manage dynamic updates for Panorama and Panorama-managed devices
- Software and dynamic updates
- Import firewall configurations into Panorama
- Configure Log Collectors
- Check firewall health and status from Panorama
- Configure role-based access control on Panorama
Manage and configure log forwarding
- Identify log types and criticalities
- Manage external services
- Create and manage tags
- Log monitoring
- Customize logging and reporting settings
- References
- Plan and execute the process to upgrade a Palo Alto Networks system
- Single firewall
- High availability pairs
- Panorama push
- Dynamic updates
- References
Manage HA functions
- Link monitoring
- Path monitoring
- HA links
- Failover
- Active/active and active/passive
- HA interfaces
- Clustering
- Election setting
Troubleshooting
- Troubleshoot site-to-site tunnels
- IPSec
- GRE
- One-to-one and one-to-many tunnels
- Phase 1 issues:
- Route-based versus policy-based remote hosts
- Tunnel monitoring
Troubleshoot interfaces
- Transceivers
- Settings
- Aggregate interfaces, LACP
- Counters
- Tagging
- 6.2.6 References
- Inbound decryption
- SSL forward proxy
- Identify what cannot be decrypted and configure exclusions and bypasses
- Certificates
Troubleshoot routing
- Dynamic routing
- Redistribution profiles
- Static routes
- Route monitoring
- Policy-based forwarding
- Multicast routing
- Service routes
General Troubleshooting
- Logs
- Packet capture (pcap)
- Reports
Troubleshoot resource protections
- Zone Protection profiles
- DoS protections
- Packet buffer protections
Troubleshoot GlobalProtect
- Portal and Gateway
- Access to resources
- GlobalProtect client
Troubleshoot policies
- NAT
- Security
- Decryption
- Authentication
Troubleshoot HA functions
- Monitor
- Failover triggers