Palo Alto Networks PCNSE Complete Course + Exam

Learn to add a Palo Alto firewall to EVE-NG by uploading the image with file transfer tools, renaming it, and configuring a new lab.

Add a Cisco router to Eve-ng by uploading and configuring a router image, setting permissions, and creating a Cisco OS node to boot and run tests.

Deploy a Palo Alto Networks next-generation firewall on AWS, configure a management interface in your VPC, attach an elastic IP, and log in via SSH or PuTTY to commit changes.

Understand how the Palo Alto Networks firewall processes traffic through a sequence: session setup, zone checks, APD content I.D. and user I.D. inspection, decryption, and security policy enforcement.

Learn to configure a virtual wire to transparently connect two firewall interfaces, allowing traffic to pass without routing or switching while applying security policies and zones.

Deploy a virtual wire on a Palo Alto firewall by binding interfaces 1/1 and 1/2, configuring zones, and applying a zone-based policy to allow traffic while inspecting traffic.

Perform a router on a stick layer 2 deployment with inside and outside zones on a Palo Alto firewall, creating vlan subinterfaces and trunk connections.

Configure interface management profiles on a layer 3 Palo Alto interface, enabling ping and HTTPS, assign zones, and implement cross-zone traffic policy before committing and testing access.

Configure and advertise networks using OSPF between a Cisco router and a Palo Alto firewall, establish area 0 adjacencies, assign interfaces, virtual routers, and verify routes and neighbors.

learn to create an inter-zone security policy in a Palo Alto firewall using the policy and security tabs, set source and destination zones, select icmp, and enable logging.

Schedule a policy to be active during specific hours by creating a schedule in the objects tab and applying it daily from 6 a.m. to 4 p.m.

Explore NAT types, including source NAT translating private IP addresses to public IPs for outbound traffic and destination NAT exposing internal servers to the internet, with DMZ options.

Source nat translates a private ip to the firewall's public ip for outbound traffic, possibly changing the port, with static ip as one-to-one and dynamic ip or dip for sharing.

Build and configure a Palo Alto firewall lab topology with dmz, inside and outside zones, multiple interfaces, virtual routers, and nat policies.

Explore QoS components on Palo Alto Networks firewalls, including app id and user id classification, policy rules, bandwidth management, and ingress and egress interfaces to prioritize traffic.

Palo Alto Networks firewalls use App-ID to identify apps by behavior, allow DNS regardless of port 53, block BitTorrent, and decrypt SSL/SSA with signatures and decoders for allow or deny.

Explore how application shift detects traffic moving between applications within a session, using steps like the three-way handshake and SSL, with emphasis on application dependent behavior in Palo Alto Networks.

Explore how application filters group apps by attributes like category, subcategory, technology risk, and characteristics to control access, with automatic classification of new apps and dynamic updates in the firewall.

Create static application groups as defined sets of apps to apply to policy rules; add apps like social networking, then commit to save changes, unlike application filters that auto-update.

Learn to create a custom service in the Palo Alto firewall by defining a new service in the object tab and applying it to a policy to allow nonstandard ports.

Explore content id inspection and enforcement with clear policy, and review security profiles including vulnerability protection, antivirus, and anti spyware profiles, plus file blocking, data filtering, and telemetry protection.

Clone a vulnerability protection profile from the objects menu and rename the clone, then edit rules, set actions to allow, and attach it to a policy after app id analysis.

Learn to create vulnerability protection exemptions for false positives, choosing signatures, applying IP-specific allowances, and saving changes to prevent alerts while preserving protection.

The Palo Alto firewall provides built-in antivirus protection that guards against viruses, worms, Trojans, and spyware, scanning executables, email, and encrypted content when decryption is defined, with default profiles read-only.

Clone the default anti spyware profile, customize actions and packet capture, and add the modified policy to the security policy for enhanced threat logging and IP blocking.

Examine DNS signatures and built-in domain detection in anti spyware profiles, implement sinkhole actions, and review threat logs to identify infected hosts and malicious domains.

Create a custom file blocking profile in security profiles to block PDA files, specifying PDA as the file type and blocking both uploads and downloads, then apply to a policy.

Data filtering profiles prevent sensitive information, such as credit card and social security numbers, from leaving a network by keyword filtering, using hash or algorithm-based detection to reduce false positives.

Telemetry collects and transmits firewall data, including applications, threats, and device health, for analysis and community-driven threat prevention while preserving anonymity. Admins can enable what to share via telemetry settings.

Palo Alto protects against denial of service with zone protection profiles and flexible policies at the network edge, configuring flood protection thresholds and automated mitigation actions.

Define DoS protection policies by matching source zone, interface, source address, destination zone, or service. Then choose an action—protect, allow, or deny—and apply limits or classify a single IP.

Create and configure a decryption policy with SSL certificates for proxy, proxy profile, and SSL inbound inspection. Learn to manage forward trusted and forward untrusted certificates and related policy settings.

Decrypt traffic to enable visibility, control, and security, enforce policies on decrypted traffic, and block malicious content; explain ssl/tls handshakes, certificates, and perfect forward secrecy for inbound and outbound connections.

Explain how public key infrastructure issues and manages certificates from root CA to intermediate and self-signed authorities, builds a chain of trust, and checks revocation via CRL or OCSP.

Examine a real Google certificate to confirm it is verified by Google Trust Services and view details like owner, expiry date, DNS, and fingerprints, including the certificate’s key algorithm.

Generate a self-signed certificate in the Palo Alto firewall via cert management, configuring the certificate name, common name with the internal interface IP, and a 365-day expiration.

Configure SSL forward proxy decryption by creating and enabling a forward trust certificate on the firewall, including naming, IP address, country, and state, to use as the forward trust certificate.

Configure ssl forward proxy policy on Palo Alto Networks by creating a decryption policy that matches inside to outside traffic and uses a trusted certificate for ssl forward proxy.

Create and attach an SSL forward proxy decryption profile to a decryption policy, enabling certificate verification, cipher suite controls, and session blocking for expired or untrusted certificates.

Identify and block zero-day malware using wildfire's cloud-based sandbox and signature-based detection, with threat intelligence cloud across regional clouds and global distribution to firewalls.

Understand wildfire licenses versus standard subscriptions, including Windows XP/7 analysis and broad file type analysis, with signatures updating every five minutes under wildfire.

Explore the wildfire private cloud wf-500, a local analysis appliance for files and malware in Windows XP and Windows 7 environments with hybrid cloud options and encrypted appliance-to-appliance communication.