Palo Alto Firewall PCNSA V11 Training

Explore firewall technologies and how they protect networks between trusted and untrusted zones. Identify generations from packet filter to next-generation firewalls and types like stateful, proxy, and cloud-based options.

Explore how next generation firewalls extend traditional security with app id, user id, content id, and deep packet inspection to allow or block traffic by application and user.

Examine how a web application firewall protects web apps from OWASP top ten vulnerabilities by inspecting HTTP/HTTPS traffic at layer seven, beyond traditional and next-generation firewalls.

Explore Palo Alto Networks, a USA-based cybersecurity company headquartered in Palo Alto, California, and its next-generation firewall with app id, user id, and content id. Check certifications such as PCC.

Explore zero trust security principles, emphasizing never trust, always verify, with identity verification for users and devices inside or outside the network, continuous monitoring, least privilege, and microsegmentation.

Discover Palo Alto’s SP3 architecture: single pass software and parallel processing hardware. See how control and data planes separate duties, with app ID, user ID, content ID, and signature matching.

learn how to download and install eve-ng community edition version 6.204 on vmware workstation pro, including creating a linux ubuntu vm, allocating resources, mounting the iso, and first login steps.

Upload iol switches to eve-ng via ftp with winscp, download images from Google Drive as zip, unzip into eve-ng bin, and ensure license file and naming for layer2 or layer3.

Upload and configure extra lab images in eve-ng for palo alto pcnsa training by adding ready-made images (pfSense, Windows Server, Linux, Kali), applying permissions, and enforcing naming and folder rules.

Upload the Palo Alto firewall image to eve-ng via winscp, create the folder and rename the image per qemu naming, set permissions, and log in as admin admin after startup.

Learn to upload and configure Palo Alto panorama in eve-ng, create a panorama folder, add an extra hard drive, apply fix permissions, and boot the lab with admin admin.

Set up the Palo Alto PCNSA lab with a multi-zone topology—management, DMZ, LAN, and WAN—featuring firewall v11, Panorama v11, Kali Linux, Windows clients, and pfSense with two ISPs.

Export and import readymade EVE-NG topologies to quickly set up labs, share with your friend the topology, and work with readymade images, while handling edition differences.

Configure ip addresses for pc1, pc2, pc3, attacker pc, and servers across 10.0.1.x, 10.0.4.x, and 10.0.5.x networks with gateways and dns, and plan active directory and vlan setup.

configure dmz switch by creating vlan 40 for server one and vlan 50 for server two, assign interfaces to vlans, set a trunk to the firewall, and save the configuration.

Configure Windows Server 2012–2019 as an NTP server by enabling time services, setting the global configuration and announce flag, and verify with the NTP server tool.

Master the initial configuration of a Palo Alto firewall, accessing via MGT or console on physical devices, using admin/admin, and setting static or DHCP IP via CLI or graphical interface.

Perform the initial HQ firewall configuration by changing the default admin password, choosing a static management IP (192.168.10.200) and gateway (192.168.10.1), and committing changes via CLI or GUI.

Explore four access methods for Palo Alto firewall: gui web interface, cli via ssh, telnet, or direct console, api with xml and rest, and Panorama for centralized management.

Learn to access Palo Alto firewall via XML API, log in, and run operational commands like showing administrators, ARP, and clock, using Postman and basic auth.

Explore the Palo Alto firewall dashboard through configurable widgets and layout columns, with functional category tab, system information, interfaces status, resources, logs, and admin login activity, plus CLI equivalents.

Navigate the Palo Alto firewall cli in operational and configuration modes, using show, run, and commit commands for troubleshooting and configuration.

Configure DNS and NTP on Palo Alto firewall, using graphical interface or CLI, including hostname, domain, login banner, time zone, and verification steps.

Explore how Palo Alto firewall uses security zones to group interfaces and enforce inter-zone policies, enabling network segmentation and zone-based traffic controls.

Create four layer three security zones on a Palo Alto firewall, including two internet zones, a LAN zone, and a DMZ, set the interfaces and subinterfaces accordingly, and commit.

Explore virtual routers on the Palo Alto firewall to join different subnets by grouping layer-3 interfaces, and configure static or dynamic routing with OSPF, OSPF3, BGP, and RIP.

Create a second virtual router named VR one in the Palo Alto firewall, assign the predefined zones and interfaces, then commit and apply changes to finish the configuration.

Learn Palo Alto firewall interfaces, including physical copper and fiber, and virtual interfaces such as VLAN, loopback, and SD-WAN; configure subinterfaces, layer 2/3, tap, and virtual wire modes.

Configure layer 3 interfaces on a palo alto firewall, create two wan subinterfaces for vlan 40 and 50 under dmz, and verify with a ping-only management profile.

Create and attach two interface management profiles on the Palo Alto firewall—ping-only for testing and a management profile for http, https, ssh—assigned to internal interfaces and never to internet-facing ones.

Configure two default routes on a Palo Alto virtual router for two ISPs, using different metrics on interfaces 1/1 and 1/2 to designate a primary path.

The lecture shows route monitoring in Palo Alto firewalls, using path monitoring to ping destinations and switch from a primary to a backup static route when failures occur.

Configure path monitoring on a Palo Alto firewall to automatically fail over from the primary isp one to isp two using metrics and ping checks.

Learn how Palo Alto firewall security policies control traffic by top-to-bottom, left-to-right evaluation, defining source and destination zones, with intra, inter, and universal rules to allow or deny access.

Create and verify four security policies on a Palo Alto firewall to manage traffic between LAN, DMZ, and internet in a lab topology, including LAN–DMZ, LAN–internet, DMZ–internet, and internet–DMZ.

Learn how NAT on a Palo Alto firewall translates private IPs to public addresses for internet access and IPv4 conservation, including source, destination, and U-turn NAT.

Explore how source network address translation translates the source ip and port for outbound traffic from internal subnets to the internet, using dynamic ip and port, or static ip.

Explore destination network address translation, translating public to private addresses in DMZs, including static IP, port forwarding, port translation, and dynamic IP load balancing across servers.

Configure source nat on a Palo Alto firewall to allow lan and dmz traffic to the internet via two isps, using dynamic ip and port translation across 1/1 and 1/2.

Configure destination net policies to expose two DMZ web servers from the internet, mapping public IPs to 10.0.4.1 and 10.0.5.2 with static NAT, then verify policy hits.

Understand how SSL inspection enables visibility into encrypted traffic by using a firewall as a middleman to decrypt and re-encrypt TLS and HTTPS connections, applying policy to allow or block.

Learn to generate a self-signed certificate on a Palo Alto firewall for ssl/tls interception, create a trusted and an untrusted certificate, and export the trusted cert for Active Directory deployment.

Learn to install a certificate on a client PC for a Palo Alto firewall, including exporting from HQ, distributing via Group Policy, and verifying installation across browsers.

Configure a LAN decryption policy with ssl forward proxy and the default profile to decrypt traffic to DMZ, and create a no decryption policy excluding government, financial, and shopping sites.

Install the self-signed Palo Alto certificate on the client, set two decryption policies with exclusions, and verify with the firewall monitor that Twitter is decrypted.

Explore how the Palo Alto firewall uses security profiles to perform antivirus, anti-spyware, vulnerability checks, and URL filtering on allowed traffic, with profile groups and content ID.

Explore how Palo Alto security profiles attach to allowed rules, covering antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, data filtering, and wildfire analysis, with daily updates for three profiles.

configure an antivirus security profile on the Palo Alto firewall, clone and apply it to the LAN-to-internet policy, then test and monitor blocks via logs.

Configure and name an anti spyware profile, attach it to the local area network to internet policy, ensure a valid threat prevention license and updated signatures, then test spyware blocks.

Configure a venerability protection profile in the Palo Alto firewall PCNSA v11 lab, attach it to the lan to internet policy, and test with Kali Linux tools.

Create and attach a file blocking security profile in the Palo Alto firewall PCNSA v11 lab, configure key file types to block, and verify blocks in monitor logs.

Configure a wildfire analysis profile using public cloud settings and any file type. Attach it to the land-to-internet security policy and verify wildfire submissions via GUI and CLI.

Configure a data filtering profile on the HQ firewall, attach it to the LAN to DMZ policy, and define credit card, confidential regex, and file property patterns.

Create and apply security profile groups to simplify policies by bundling antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, and wildfire analysis into a single entity.

Create two security profile groups—DMZ and WAN—and apply them to the DMZ and WAN policies, including vulnerability protection, data filtering, antivirus, anti-spyware, file blocking, and wildfire analysis, then commit.

Block access to malicious urls with Palo Alto URL filtering to reduce phishing and malware risk, using license-based databases such as Brightcloud or Penn DB and category-based policies.

Block malicious URLs using a security policy by applying URL category filters (adult, extremism, hacking, malware, etc.), denying traffic and logging sessions, then verify with URL filtering monitor and CLI.

Enable the URL filtering profile to block malicious URLs and apply it to LAN-to-internet traffic, then test categories such as adult, command and control, extremism, and malware while reviewing logs.

Block a custom URL category through a security policy by creating a custom URL category with blocked sites and applying it to the policy, then verify via URL filtering.

block url categories using an external dynamic list on a Palo Alto firewall, configuring edl from the dmz and applying a url policy to block udemy, msn, yahoo, bing.

Explore using external dynamic lists and custom URL categories in Palo Alto firewall URL filtering profiles, comparing security policy and profile-based blocking, and verify results via monitor and CLI checks.

Activate DNS security on Palo Alto firewall to monitor DNS requests, compare against known bad domains, and block or sinkhole malicious queries, with threat intelligence updates and logs.

Configure DNS security on a Palo Alto firewall, verify licenses, and sinkhole command-and-control, grayware, malware, and phishing domains to 50.50.50.50, then verify traffic via logs.