Palo Alto Firewall Training - Beginner to Expert 2026

Understand how a network firewall serves as the first line of defense, separating trusted and untrusted networks and enforcing explicit allow rules with an implicit deny.

Understand why legacy firewalls fail to stop sophisticated threats and how Palo Alto's next generation firewall uses multiple security parameters and content inspection to detect and drop malicious traffic.

Explore Palo Alto firewall's next-generation features, emphasizing app id, content id, and user id, ssl inspection, and the single pass parallel processing architecture for high throughput and secure policy enforcement.

Navigate the Palo Alto firewall dashboard to inspect high-level device information, customize a multi-column layout, view system resources, manage licenses and sessions, and perform configuration commits.

Configure dns and http server on the Palo Alto firewall by updating device setup services, add primary and secondary dns, configure an ntp server, then commit and verify via cli.

Configure the Palo Alto firewall management interface for initial setup, switching from dhcp to static ip, and enable https, ssh, and ping while learning http and telnet access.

Configure a two-zone topology to establish traffic flow through a Palo Alto firewall by defining inside and outside zones, configuring interfaces and routing, and applying NAT and security policies.

Learn how the Palo Alto firewall's virtual router routes traffic using static, dynamic, and default routing, and grasp routing basics, static routes, default routes, and administrative distance.

Configure static routing on a Palo Alto firewall in a simple topology, with inside and outside zones, interfaces and loopbacks, and verify connectivity via static routes and a security policy.

Configure RIP version two on a Palo Alto firewall and connected routers, advertise loopback and interface networks, and verify learned routes with show ip route and ping tests.

Secure RIP dynamic routing with an authentication profile and keychain on Palo Alto and Cisco routers to prevent intruders from learning routing information.

Configure OSPF on a Palo Alto firewall, an interior gateway protocol that uses area zero backbone, router IDs, ABRs, and cost and hello timers with multicast addresses 224.0.0.5 and 224.0.0.6.

Configure a Palo Alto firewall to run default routing alongside OSPF in a single topology, with plans to use redistribution for cross protocol reachability.

Learn how to redistribute routes between different routing protocols on a Palo Alto firewall, using a redistribution profile and export rules, and secure traffic with a bidirectional security policy.

Understand how Palo Alto firewall security policies control traffic by top-down matching and default intra- and inter-zone rules. Learn to create, override, revert, and manage policies in the GUI.

Configure a NAT profile and granular security policy on a Palo Alto firewall, enabling inside-to-outside connectivity, testing with two users, and later restricting one user to YouTube.

Explore security policy actions in Palo Alto firewalls, including allow, deny, drop, and reset client/server/both, plus test via DNS, ICMP unreachable, and packet captures.

Understand shadow policy in Palo Alto firewall: a new policy that is a subset of an existing one, and how top-to-bottom rule evaluation and sequencing determine which rule applies.

Group security policies into staff, student, and guest for a university firewall scenario; map policies to tags, color codes, and manage order, cloning, and grouping in Palo Alto firewall.

Explore ssl and tls and how their handshake provides privacy, authentication, and data integrity. See how client hello, server hello, certificates, and session keys enable encrypted web traffic.

Understand ssl and tls in real-time Wireshark captures by examining the three-way handshake, client hello, server hello, and certificate validation through trusted roots like DigiCert.

Understand how ssl/tls decryption enables a two-session model where the firewall decrypts and re-encrypts traffic for content scanning and malware detection.

Explore ssl/tls decryption in Palo Alto firewall and three methods—ssl proxy (inside to outside), inbound ssl (outside to inside), and ssh proxy—and how certificates and the tls handshake enable inspection.

Configure ssl forward proxy on a Palo Alto firewall by creating a self-signed certificate, distributing it to clients as trusted, and enabling a decryption policy to inspect inside-to-outside traffic.

Explore how content ID enables Palo Alto firewalls to inspect content with security profiles, scanning allowed traffic for malware, viruses, and malicious URLs.

Explore antivirus profile operations in Palo Alto firewalls, using content identification to block malicious HTTP traffic, configure default or custom profiles, set exceptions, and review threat logs.

Learn how to configure Palo Alto's anti spyware profile, including policy categories, signatures, and custom patterns, and test with SSL decryption to block spyware in http(s) traffic.

Learn to configure Palo Alto vulnerability protection to detect and drop vulnerable traffic, including scan activity from external attackers targeting a DMZ server, using Kali Linux and Nmap.

Block social networking traffic with Palo Alto URL filtering using PAN DB or BrightCloud, attach to security policy, and use custom categories with continue or password-protected override.

Define a file blocking security profile in Palo Alto firewall to block PDF and EXE downloads, monitor results via data filtering logs, and apply the policy in a lab topology.

Learn how wildfire analysis in Palo Alto forwards suspicious file content to the cloud for zero-day threat analysis, using the wildfire license and sandbox feedback to block unknown malware.

Learn how data filtering in Palo Alto firewall detects and blocks sensitive information, using predefined patterns, custom keywords, and regular expression, and apply it via security policies.

Configure a DDoS protection profile in Palo Alto, apply it to the security policy, and monitor threat logs as ICMP, UDP, and TCP floods are blocked.

Understand packet buffer protection on Palo Alto firewall interfaces, including threshold based alerts and random early drop to block flood traffic, with configuration and monitoring steps.

Create and attach a zone protection profile to your DMZ and outside zones to block flooding and reconnaissance traffic, including TCP SYN flood, ICMP flood, and general scanning.

Create security profile groups, like antivirus, anti spyware, url filtering, and data filtering. Attach the group to security policies to simplify management across policies and test traffic flows.

Deploy a Palo Alto firewall in layer two mode, using two VLAN zones (LAN and server) with no interface IPs, by associating zones to interfaces and applying a security policy.

Deploy a Palo Alto firewall in tap mode to monitor traffic and log transactions, mirroring data from the switch without making any security decisions.

Explore virtual wire mode, or v wire, to bind two interfaces into a transparent inline firewall, enabling monitoring and traffic control with app, user, and content identification.

Explore subinterfaces on a Palo Alto firewall to split one physical link into multiple VLANs, and configure subinterfaces with VLAN tags, zones, and routes.

Learn how Palo Alto's application identification blocks access by app, not just port or IP. See how to deny Facebook using application-based security policies and prevent port hopping.

Explore how the Palo Alto firewall's application dashboard, backed by the device database, identifies traffic against 4300 applications to enforce security policies that block Facebook and permit YouTube.

Explore how the Palo Alto firewall uses application shift to identify apps and enforce policies based on applications or subsets, enabling selective blocking or permitting of features within apps.

Understand application dependencies in Palo Alto firewalls, where groups of subsets require dependent apps (such as YouTube base on Google base) to apply accurate security policies.

Learn to create and use application groups in Palo Alto firewalls, add multiple applications to a single group, and attach it to a security policy to block social media sites.

Learn how application filters in Palo Alto firewall dynamically block social networking by auto-including apps under a subcategory, and apply a deny policy with commit.

Learn to create a custom application profile and define a security policy for internal apps not in the 4300 PanOS applications, using patterns and signatures.

Learn how Palo Alto application overrides prevent blocking internal apps by limiting inspection to layer four, and manage application updates via dynamic updates and scheduled patches.

Explore how Palo Alto firewall uses user ID—alongside content ID and app ID—to define policies for individual or grouped users, boosting visibility, policy control, and logging for forensic analysis.

Learn how to implement captive portal authentication on a Palo Alto firewall. Use authentication portals, user identification, and redirect traffic to login, with timers, MFA, and policy enforcement.

Explore how to configure DHCP on a Palo Alto firewall, including server and relay modes, and understand Dora—discover, offer, request, acknowledge—and IP provisioning via UDP ports 67 and 68.

Configure a DHCP relay agent on the Palo Alto firewall to forward DHCP broadcasts to the Windows DHCP server, enabling the DORA process across networks.

Explore nat on Palo Alto firewalls, translating private ips to public ips and using pat with ports, covering source and destination nat and IPv4/IPv6 translation.

Configure source nat with dynamic IP and port on a Palo Alto firewall, translating LAN source addresses to interface or pool translation IPs for DMZ traffic.

Configure static source NAT on a Palo Alto firewall by mapping a single translation IP to a specific source, creating a true one-to-one outbound address.

Explore destination nat in the Palo Alto firewall, translating internet traffic to internal servers via the firewall interface, using static or dynamic mapping, port forwarding, and load balancing.

Explore how u-turn nat lets private internal clients reach a public dmz server by translating source and destination ips across inside, outside, and dmz zones.

Master Palo Alto firewall object management by using address and service objects, static/dynamic address groups, tags, and FQDNs to simplify security policies across zones.

Explore the fundamentals of cryptography, including encryption, decryption, and hashing, to ensure confidentiality, integrity, and authentication using symmetric and asymmetric keys.

Explore how VPN tunnels protect data over untrusted networks with IPsec, encryption, and hashing, and distinguish site-to-site and remote access VPN concepts for Palo Alto firewall labs.

Explore IPsec, the internet protocol security framework at the network layer, delivering confidentiality, integrity, and authentication with anti-replay via AH and ESP, plus transport and tunnel modes.

Explore how the IKE protocol negotiates IPsec security associations, exchanges encryption and hashing parameters, and establishes phase one and phase two tunnels for VPN traffic.

Learn to configure a site-to-site IPsec VPN on Palo Alto firewalls, including zone setup, tunnel interfaces, IKE phase one, IPsec phase two, and testing connectivity.

Configure and manage GlobalProtect remote access vpn for Palo Alto firewall, including portal, gateway, tunnel, authentication, self-signed certificate, IPsec, and split tunneling.

Understand how two palo alto firewalls form a high-availability pair with synchronized configurations, enabling active active or active standby modes and seamless failover through hash links.

Configure Palo Alto firewall high availability to provide redundancy with two firewalls in an active-passive cluster, using four hash links for control and user traffic and config sync.

Configure syslog on a Palo Alto firewall to forward system, audit, configuration, and traffic logs to an external server. Create the profile, enable log forwarding, commit, and test.

Configure snmp on the Palo Alto firewall to monitor devices with a manager and agents, using v1/v2c/v3, management information base, community strings, and trap profiles.

Learn how to perform packet capture on a Palo Alto firewall for troubleshooting by defining filters and stages, enabling capture without commit, and analyzing captures with Wireshark.

Acc dashboard overview visualizes application command center logs with interactive graphs, enabling widget customization and analysis of network, globalprotect, and ssl activity.

Explore backup and restore workflows for Palo Alto firewalls, including candidate vs running configurations, commits, saves, reverts, and exporting or importing device state for complete backups.

Learn to set up a Palo Alto firewall lab in eve-ng by installing eve-ng, VMware Workstation, and WinSCP, importing the image, configuring networks, and handling backend image naming and permissions.

Deploy a Palo Alto firewall in VMware Workstation to build a practice lab by importing the pan-10 ovf and configuring bridged networks, then access the gui via https.