Palo Alto Networks PCNSE Complete Course + Exam

learn to assign a static ip address on eve-ng by logging in as root, clearing old config, setting 192.168.0.150/24, and configuring dns 8.8.8.8 for reboot-persistent ip.

Learn to add a Palo Alto firewall to EVE-NG by uploading the image with file transfer tools, renaming it, and configuring a new lab.

Add a Cisco router to Eve-ng by uploading and configuring a router image, setting permissions, and creating a Cisco OS node to boot and run tests.

Add a Cisco switch to eve-ng by uploading the image, setting permissions, and creating an IOU license; then verify with show ip and show interfaces.

Deploy a Palo Alto Networks next-generation firewall on AWS, configure a management interface in your VPC, attach an elastic IP, and log in via SSH or PuTTY to commit changes.

Understand how the Palo Alto Networks firewall processes traffic through a sequence: session setup, zone checks, APD content I.D. and user I.D. inspection, decryption, and security policy enforcement.

Configure non-local administrator accounts on Palo Alto Networks firewalls by linking external authentication servers (RADIUS, TACACS+, LDAP) and an authentication profile for single sign-on and optional multi-factor authentication.

Learn to configure a virtual wire to transparently connect two firewall interfaces, allowing traffic to pass without routing or switching while applying security policies and zones.

Deploy a virtual wire on a Palo Alto firewall by binding interfaces 1/1 and 1/2, configuring zones, and applying a zone-based policy to allow traffic while inspecting traffic.

Switch to layer 2 interfaces on a Palo Alto firewall, create VLANs and sub-interfaces, and assign security zones to segment traffic and apply allow or block policies.

Configure a layer 2 interface deployment on a Palo Alto firewall without sub-interfaces, create inside and outside zones, and implement a policy to allow inside-to-outside traffic, then verify connectivity.

Configure a layer 2 deployment on a Palo Alto firewall using trunk interfaces and subinterfaces with VLAN 100, create zones, implement a policy to allow inter-zone traffic, and verify connectivity.

Perform a router on a stick layer 2 deployment with inside and outside zones on a Palo Alto firewall, creating vlan subinterfaces and trunk connections.

Configure layer 3 interfaces on the Palo Alto firewall by assigning IPv4 or IPv6 addresses, linking them to a virtual router and a security zone to enable routing.

Configure a Palo Alto firewall with layer 3 interfaces and inside and outside zones, and permit inside-to-outside traffic with a policy. Set a default route and enable ping, then commit.

Explore Palo Alto Networks firewall deployment options: tap mode for passive monitoring, virtual wire for monitoring and blocking traffic, and layer 2 and layer 3 deployments for switching and routing.

Configure interface management profiles on a layer 3 Palo Alto interface, enabling ping and HTTPS, assign zones, and implement cross-zone traffic policy before committing and testing access.

Configure two virtual routers and link them to exchange traffic, create layer 3 zones and virtual wires, and implement policies and static routes to enable ping between networks.

Configure and advertise networks using OSPF between a Cisco router and a Palo Alto firewall, establish area 0 adjacencies, assign interfaces, virtual routers, and verify routes and neighbors.

learn to create an inter-zone security policy in a Palo Alto firewall using the policy and security tabs, set source and destination zones, select icmp, and enable logging.

Schedule a policy to be active during specific hours by creating a schedule in the objects tab and applying it daily from 6 a.m. to 4 p.m.

Create address objects to reuse in security policies, specify source or destination addresses by object names instead of numbers, then apply them to a policy to control traffic.

Explore NAT types, including source NAT translating private IP addresses to public IPs for outbound traffic and destination NAT exposing internal servers to the internet, with DMZ options.

Source nat translates a private ip to the firewall's public ip for outbound traffic, possibly changing the port, with static ip as one-to-one and dynamic ip or dip for sharing.

Build and configure a Palo Alto firewall lab topology with dmz, inside and outside zones, multiple interfaces, virtual routers, and nat policies.

Explore how quality of service prioritizes and shapes network traffic in Palo Alto Networks firewalls, allocating bandwidth, prioritizing VoIP and video, and configuring egress interfaces and QoS policies.

Explore QoS components on Palo Alto Networks firewalls, including app id and user id classification, policy rules, bandwidth management, and ingress and egress interfaces to prioritize traffic.

Palo Alto Networks firewalls use App-ID to identify apps by behavior, allow DNS regardless of port 53, block BitTorrent, and decrypt SSL/SSA with signatures and decoders for allow or deny.

Explore how application shift detects traffic moving between applications within a session, using steps like the three-way handshake and SSL, with emphasis on application dependent behavior in Palo Alto Networks.

Explore implicit applications on the Palo Alto firewall, such as Twitter and Facebook, and see how implicit policies allow web browsing, with app details from Palo Alto Networks.

Explore how application filters group apps by attributes like category, subcategory, technology risk, and characteristics to control access, with automatic classification of new apps and dynamic updates in the firewall.

Create static application groups as defined sets of apps to apply to policy rules; add apps like social networking, then commit to save changes, unlike application filters that auto-update.

Create and manage application groups in a Palo Alto firewall, including adding Twitter, Facebook, and YouTube, nesting groups, committing changes, and applying groups to security policies.

Learn to create a custom service in the Palo Alto firewall by defining a new service in the object tab and applying it to a policy to allow nonstandard ports.

Explore content id inspection and enforcement with clear policy, and review security profiles including vulnerability protection, antivirus, and anti spyware profiles, plus file blocking, data filtering, and telemetry protection.

Explore Content ID as a real-time threat prevention engine that analyzes allowed traffic via App ID, applying security profiles to detect viruses, spyware, and data loss.

Clone a vulnerability protection profile from the objects menu and rename the clone, then edit rules, set actions to allow, and attach it to a policy after app id analysis.

Create a custom vulnerability protection profile with injection and buffer overflow rules, configure alert and drop actions, then attach it to a security policy and commit.

Learn to create vulnerability protection exemptions for false positives, choosing signatures, applying IP-specific allowances, and saving changes to prevent alerts while preserving protection.

The Palo Alto firewall provides built-in antivirus protection that guards against viruses, worms, Trojans, and spyware, scanning executables, email, and encrypted content when decryption is defined, with default profiles read-only.

Clone the default antivirus profile, enable packet capture, set virus and wildfire actions, and add application or threat ID exemptions before applying to a security policy.

Block spyware on compromised hosts using anti spyware profiles in Palo Alto Networks, including default and strict predefined profiles you can clone to customize and add to security policies.

Clone the default anti spyware profile, customize actions and packet capture, and add the modified policy to the security policy for enhanced threat logging and IP blocking.

Examine DNS signatures and built-in domain detection in anti spyware profiles, implement sinkhole actions, and review threat logs to identify infected hosts and malicious domains.

Create a custom file blocking profile in security profiles to block PDA files, specifying PDA as the file type and blocking both uploads and downloads, then apply to a policy.

Data filtering profiles prevent sensitive information, such as credit card and social security numbers, from leaving a network by keyword filtering, using hash or algorithm-based detection to reduce false positives.

Create data patterns for social security numbers and credit cards, configure a data filtering profile, apply it to a security policy for inbound and outbound traffic, and commit.

Telemetry collects and transmits firewall data, including applications, threats, and device health, for analysis and community-driven threat prevention while preserving anonymity. Admins can enable what to share via telemetry settings.

Palo Alto protects against denial of service with zone protection profiles and flexible policies at the network edge, configuring flood protection thresholds and automated mitigation actions.

Define DoS protection policies by matching source zone, interface, source address, destination zone, or service. Then choose an action—protect, allow, or deny—and apply limits or classify a single IP.

Configure Palo Alto url filtering to identify and control web access using a 60–80 category database or custom domains, applying categories in security policies and logs, including ssl encrypted traffic.

Understand how the Palo Alto Networks firewall's default URL filtering profile blocks malware, phishing, and adult content, and how to clone or create new profiles.

Explore configuring safe search enforcement in Palo Alto Networks firewall by adjusting URL filtering profiles to enable safe search for Google, Yahoo, Bing, Yandex, and YouTube, with logging options.

Create a custom url category to block a site, assign it to a security policy with a deny rule, and test the blocked traffic on the outside interface.

Create and configure a decryption policy with SSL certificates for proxy, proxy profile, and SSL inbound inspection. Learn to manage forward trusted and forward untrusted certificates and related policy settings.

Decrypt traffic to enable visibility, control, and security, enforce policies on decrypted traffic, and block malicious content; explain ssl/tls handshakes, certificates, and perfect forward secrecy for inbound and outbound connections.

Explain how public key infrastructure issues and manages certificates from root CA to intermediate and self-signed authorities, builds a chain of trust, and checks revocation via CRL or OCSP.

Examine a real Google certificate to confirm it is verified by Google Trust Services and view details like owner, expiry date, DNS, and fingerprints, including the certificate’s key algorithm.

Explore CA certificate options for Palo Alto networks firewalls, including third-party certificates, CSR signing from a CA, and self-signed certificates, and understand their impact on ssl operation and client trust.

Generate a self-signed certificate in the Palo Alto firewall via cert management, configuring the certificate name, common name with the internal interface IP, and a 365-day expiration.

Configure SSL forward proxy decryption by creating and enabling a forward trust certificate on the firewall, including naming, IP address, country, and state, to use as the forward trust certificate.

Configure ssl forward proxy policy on Palo Alto Networks by creating a decryption policy that matches inside to outside traffic and uses a trusted certificate for ssl forward proxy.

Create and attach an SSL forward proxy decryption profile to a decryption policy, enabling certificate verification, cipher suite controls, and session blocking for expired or untrusted certificates.

Create a self-signed certificate for SSL inbound inspection, then configure a decryption policy from outside to DMZ and attach a decryption profile to govern cipher and protocols.

Identify and block zero-day malware using wildfire's cloud-based sandbox and signature-based detection, with threat intelligence cloud across regional clouds and global distribution to firewalls.

Learn how WildFire email protection detects malicious links and attachments, instantly updates antivirus signatures on Palo Alto Networks firewalls worldwide, and uses user ID technology to locate compromised hosts.

Understand wildfire licenses versus standard subscriptions, including Windows XP/7 analysis and broad file type analysis, with signatures updating every five minutes under wildfire.

Explore the wildfire private cloud wf-500, a local analysis appliance for files and malware in Windows XP and Windows 7 environments with hybrid cloud options and encrypted appliance-to-appliance communication.

Navigate to wildfire settings in device setup, choose between wildfire public cloud or private cloud, and enable wildfire 500 for private network analysis, with decrypted content reporting via content id.

Configure wildfire analysis profiles on the Palo Alto firewall and attach them to security policies; clone the default profile to create custom profiles sending files to wildfire public cloud.

Create wildfire analysis profile with a sensitive data rule for Microsoft Office files to the private cloud, send all others to the public cloud, and attach to the policy.