Category ✅

1. Pre-Migration Planning ✅ Understand the Environment Identify the Checkpoint firewall model , software version, and licensing. Note the number of policies, NAT rules, objects, VPN settings, and security profiles . List down all interface configurations and IP addressing schemes . Check if there are any application-layer protections enabled on Checkpoint. ✅ Backup Existing Checkpoint Configuration Use SmartConsole to export the full configuration: # Run from CLI to take a b

1. What is Palo Alto Panorama? Answer: Palo Alto Panorama is a centralized management solution for Palo Alto Networks' firewalls . It allows administrators to control firewall policies, manage logs, generate reports, and automate deployments across multiple firewalls from a single interface. 2. What are the deployment modes of Panorama? Answer: Panorama can be deployed in three modes : Management Mode (Manages devices & policies) Log Collector Mode (Collects logs from fir

1. URL Filtering & Category Blocking (Without Security Profiles) Scenario: Your organization wants to block access to gambling websites, but you are not allowed to use Security Profiles or Custom URL Categories. ✅ Question: How can you achieve this requirement using only security policy rules? Expected Answer: · Create a new security policy rule. · Set the Source Zone (e.g., Inside), and Destination Zone (e.g., Outside). · Set Application to "any" and Service/Port t

Key Differences Between Device Group and Template in Panorama In Palo Alto Networks Panorama , Device Groups and Templates serve different purposes, but both are essential for centralized firewall management. Here's a clear breakdown of their differences: Key Differences Between Device Group and Template in Panorama In Palo Alto Networks Panorama , Device Groups and Templates serve different purposes, but both are essential for centralized firewall management. Here's a

Introduction Capturing packets (PCAP) for specific security rules is essential for troubleshooting and monitoring network traffic in Palo Alto Networks firewalls. This guide will walk you through the steps to enable packet capture for a specific rule using the CLI and WebGUI. Enabling Packet Capture for a Specific Rule To capture traffic hitting a specific rule, follow these steps: 1. Enable Packet Capture via CLI Log in to the CLI of the Palo Alto firewall and run the follow

Introduction If you have noticed that Traffic, Threat, or System logs are slow to load or not appearing in the MONITOR tab of your Palo Alto Networks firewall, it may be due to a software issue related to UI-Telemetry . This issue is documented under PAN-241504 and affects certain versions of PAN-OS. In this blog post, we will cover the symptoms, affected environments, root cause, and steps to resolve the issue. Symptoms When UI-Telemetry (cfg.features.ui-telemetry) is ena

Downloading GlobalProtect Agent Software When working with GlobalProtect, it is essential to ensure that you have the correct software version installed on your device. Below is a step-by-step procedure to download the GlobalProtect Agent Software from the Customer Support Portal. Procedure Open a Web Browser Launch a web browser and navigate to the Customer Support Portal . Login with a Valid Support Account Enter your credentials to log in to the portal. Navigate to Softwar

Network Setup You have a network setup as follows: Internal Laptop (Inside Zone) : 192.168.1.20 (Interface e1/2, IP: 192.168.1.2) Outside Zone (Internet) : e1/1, IP: 203.0.133.20 DMZ Server : 192.168.50.10 (DMZ Zone) Firewall Interfaces: Inside : e1/2 - 192.168.1.2 Outside : e1/1 - 203.0.133.20 DMZ : e1/3 Objective Configure Source NAT to allow the internal PC (192.168.1.20) to access the Internet using the firewall's external IP (203.0.133.20). Configure Destination NAT to

How to Schedule Configuration Export on Panorama If you want to schedule the export of running configurations from all managed devices (as well as Panorama itself), here’s how you can set it up: Step-by-Step Guide: Select the Protocol Type In Panorama, you can choose either FTP or SCP for exporting configurations. SCP is recommended because it provides encryption (introduced in PAN-OS 5.0), making the export more secure. Configure the Server for Export Make sure the FTP or S

How to Add a Locally Managed Firewall to Panorama Management If you're trying to add a locally managed firewall to Panorama, here's a step-by-step guide on how to get it set up: Quick Note: The instructions here apply to older Panorama versions. If you're using a newer version, you should check out the following documentation: Add A Firewall as a Managed Device (11.1 version) Add A Firewall as a Managed Device (10.2 version) What You Need to Do: Import the Firewall Configurat

How to Retrieve a History of All Software Upgrades and Downgrades on Palo Alto Devices Objective: Learn how to retrieve a history of all software upgrades and downgrades on your Palo Alto device, including information on past installations, successes, failures, and more. Procedure: To view a history of all software upgrades and downgrades, you can use the debug swm history command. This command provides a detailed log of every upgrade or downgrade attempt, including the statu

This will help to crack your interview -- Key Observations Symptom Analysis : Random periods of packet loss, latency, and performance degradation. Duplicate packets when pinging the ISP gateway. Dropped packets on the inside interface. Extremely high latency from the firewall's interfaces, while network core switches maintain normal sub-10ms latency. Cause : GlobalProtect Client Misbehavior : Clients with GlobalProtect enabled caused significant traffic generation even withou

To mitigate brute force attacks on your Prisma Access portal, follow this structured approach: Step-by-Step Solution Implement Embargo Rules with EDLs Why : Embargo rules are prioritized at the top of the security rule stack, blocking malicious IPs before pre-defined allow rules. How : Navigate to Prisma Access Configuration → Security → Embargo Rules . Create a new rule: Source : Add an External Dynamic List (EDL) of known malicious IPs (e.g., Palo Alto’s predefined EDL or a

Step-by-Step Guide: Setting Up Azure SAML Authentication for GlobalProtect Portal and Gateway Objective This guide provides detailed instructions to configure Azure SAML authentication for Palo Alto GlobalProtect Portal and Gateway, enabling secure remote access via SAML-based SSO. Prerequisites Admin access to Azure Portal and Palo Alto Firewall . GlobalProtect Portal and Gateway preconfigured with basic settings (IP/FQDN, certificates, etc.). A valid Azure AD subscription.

Login to the CLI of your device. Run the command> request tech-support dump Track the progress using:> show jobs all or > show jobs id <job id> Download from GUI: Device > Support > Tech Support File > Download Tech Support File

These steps are intended to help troubleshoot IPSec VPN connectivity issues. They are divided into two parts, one for each Phase of an IPSec VPN. Phase 1 - To rule out ISP-related issues, try pinging the peer IP from the PA external interface. Ensurethat pings are enabled on the peer’s external interface. If pings have been blocked per security requirements, see if the other peer is responding to the main/aggressive mode messages, or the DPDs. Check for the responses of the “

DPD is a monitoring function used to determine liveliness of the Security-SA (Security Association and IKE, Phase 1) DPD is used to detect if the peer device still has a valid IKE-SA. Periodically, it will send a “ ISAKMP R-U-THERE ” packet to the peer, which will respond back with an “ ISAKMP R-U-THERE-ACK ” acknowledgement. The Palo Alto Networks does not currently have a log associated with DPD packets, but can be detected in a debug packet capture. The following is a PCA