PCNSA - Fact Sheet¶

Quick Reference¶

Exam Code: PCNSA PAN-OS: 11.x (currently 11.0/11.1) Duration: 80 minutes Questions: 60 Passing Score: ~70% Cost: $155 USD Validity: 2 years Recommended Course: EDU-210 Firewall Essentials

PCNSA exam page PAN-OS 11.x admin guide LIVEcommunity

Domain Weights¶

The Three IDs (core concept - high yield)¶

PAN-OS classifies every flow with three identification engines that run in the single-pass parallel processing (SP3) data plane.

Why this matters on the exam: Security policy can match on application, source user, URL category, and HIP - not just IP/port. Allowing "web-browsing" to "facebook-base" is more precise than allowing tcp/443.

Single-Pass Parallel Processing (SP3)¶

Packet in
  │
  ├─> Decryption (if SSL/TLS decrypt policy matches)
  │
  ├─> Single-pass: parse once
  │     - App-ID
  │     - User-ID
  │     - Content-ID (threats, URL, file, WildFire)
  │     - Policy match
  │
  └─> Parallel processing across multiple cores
       - Networking, signatures, decoders happen on dedicated chips
Packet out

The "single pass" means the firewall does not decode the packet multiple times for each feature (unlike legacy UTMs that chained AV, IPS, URL filtering as separate processes). The "parallel processing" means signature matching, networking, and policy can happen on different cores simultaneously.

Portfolio (memorize the families)¶

NGFW form factors:

• PA-Series - hardware appliances (PA-410 SOHO up to PA-7080 datacenter)
• VM-Series - virtualized for ESXi, KVM, Hyper-V, AWS, Azure, GCP, OCI, NSX
• CN-Series - containerized firewall for Kubernetes (sidecar / cluster)

Interface Types¶

Every dataplane interface must be in a security zone for traffic to be inspected.

Zones¶

• Intrazone - traffic source and destination zone are the same
• Interzone - traffic crosses zones
• Universal - default rule type, matches both intrazone and interzone
• Implicit defaults at the bottom of the security policy:
• intrazone-default = allow, no logging
• interzone-default = deny, no logging
• You can override implicit defaults to enable logging or change behavior. They cannot be deleted.

Security Policy Rule Fields¶

A security policy rule is matched on these fields (left-to-right in the GUI):

application-default service is preferred: PAN-OS uses the application's known port(s) instead of forcing you to specify tcp/443. If a SaaS app uses non-standard ports legitimately, App-ID handles it.

Policy Evaluation Order¶

1. PAN-OS evaluates rules top-down.
2. First matching rule wins. No more rules are evaluated.
3. If no rule matches, traffic hits the interzone-default (deny) or intrazone-default (allow).
4. NAT rules are evaluated before security policy lookup, but security policy uses pre-NAT IP, post-NAT zone.
5. App-ID may shift the matched rule mid-session if the application changes (App-ID dependency / app-shift). Configure with care.

NAT Translation Types¶

PAN-OS NAT is configured in Policies > NAT. Each rule has an Original Packet (match) and Translated Packet (action) section.

Source NAT (outbound)¶

Destination NAT (inbound / port forwarding)¶

• Translate destination IP (and optionally port) so external clients can reach internal servers
• Match on pre-NAT destination IP and pre-NAT zone, but translate before routing decision
• Common: external 203.0.113.10:443 → internal 10.0.0.50:443
• Security policy must use post-NAT zone (the internal zone) but pre-NAT destination IP when it is a destination NAT scenario - critical exam fact

U-turn NAT (hairpin)¶

• Internal users access an internal server using its public IP (because of split-DNS issues or hard-coded URLs)
• Source NAT + destination NAT applied in the same rule so the server sees the firewall as the source (avoids asymmetric routing)
• Source translated to firewall's internal interface IP; destination translated to internal server IP

NAT Rule Match Order¶

NAT rules are also top-down, first match wins.

Common CLI Commands (memorize)¶

PAN-OS CLI has two modes: operational (>) and configuration (#). Type configure to enter config mode.

Operational mode (show / debug / system)¶

show system info                          # serial, model, PAN-OS version, uptime
show system resources                     # CPU, memory like top
show jobs all                             # commit / install jobs
show config running                       # current running config (XML)
show interface all                        # all interfaces summary
show interface ethernet1/1                # specific interface
show session all                          # active sessions (very long; pipe filters)
show session all filter source 10.0.0.5   # filter sessions by attribute
show session info                         # session table stats
show session id <session-id>              # detail on a single session
show running security-policy              # rules as evaluated by dataplane
show running nat-policy                   # NAT rules as evaluated
show routing route                        # routing table
show routing fib                          # forwarding information base
show arp all                              # ARP table
show user ip-user-mapping all             # User-ID mappings
show user user-ids                        # users known to firewall
show high-availability state              # HA state (active/passive/etc)
show high-availability all                # full HA detail
show counter global filter packet-filter yes   # global counters with filter
show log traffic direction equal backward       # last 100 traffic logs
show log threat                           # threat log
debug dataplane packet-diag set filter ...  # capture filter setup

Configuration mode¶

configure
# now in config mode, prompt is #
set deviceconfig system hostname FW-EDGE
set network interface ethernet ethernet1/1 layer3 ip 10.0.0.1/24
set zone trust network layer3 ethernet1/1
edit rulebase security rules Allow-Web
set from trust to untrust source any destination any application web-browsing service application-default action allow
top                                       # back to top of config tree
commit                                    # commit candidate config
commit force                              # force commit (skip validation warnings)
exit                                      # leave config mode

Useful one-liners¶

> show system software status              # is anything installing?
> request system software check            # check for new PAN-OS versions
> request content upgrade check            # check for App+Threat updates
> request anti-virus upgrade check         # AV update check
> request wildfire upgrade check           # WildFire signature check
> tail follow yes mp-log ms.log            # tail management plane log
> less mp-log devsrv.log                   # paginated read of a log
> ping host 8.8.8.8 source 10.0.0.1        # ping from a specific source
> test routing fib-lookup virtual-router default ip 8.8.8.8     # which FIB entry?
> test security-policy-match ...           # simulate which rule a flow matches
> test nat-policy-match ...                # simulate NAT match

test security-policy-match (high-yield)¶

Predicts which security rule will match without sending real traffic. Common form:

test security-policy-match \
  source 10.0.0.5 destination 8.8.8.8 \
  source-user "acme\jdoe" \
  destination-port 443 protocol 6 \
  application ssl from trust to untrust

test nat-policy-match is the same idea for NAT rules.

Security Profiles (Content-ID)¶

Profiles attach to security rules with action allow to add inline inspection. Sets of profiles can be bundled in a Profile Group.

Default profiles ship out of the box: default and strict. New rules default to none until you assign a group.

Zone Protection vs DoS Protection (commonly confused)¶

Rule of thumb: zone protection = "defend the front door from internet noise." DoS protection = "defend a specific server from a targeted flood."

High Availability (HA)¶

Active/Passive¶

• One firewall is active, one is passive.
• Failover triggers: link failure, path monitor failure, heartbeat loss, internal health check.
• Most common deployment.

Active/Active¶

• Both firewalls process traffic simultaneously.
• Used for asymmetric routing tolerance, not throughput doubling.
• More complex; requires HA3 link.

HA Links¶

What syncs vs what doesn't¶

• Syncs: running config, sessions, IPsec SAs, ARP, NDP, ND, FIB.
• Does not sync: management interface IP, hostname, HA cfg itself, log database.

Dynamic Updates (memorize the cadence)¶

Updates download from updates.paloaltonetworks.com. Configure under Device > Dynamic Updates.

Best practice: stagger schedules and use Threshold (e.g., wait 48 hours before installing the latest content) to avoid bad signature releases.

Licenses (commonly tested)¶

Subscriptions are PER-DEVICE and serialized to the firewall's serial number.

Logs¶

Log forwarding profile can send logs to:

• Panorama / Cortex Data Lake (most common)
• Syslog (TCP/UDP/SSL)
• SNMP traps
• Email
• HTTP(S) webhooks (for SOAR integration)

Panorama (centralized management)¶

• Manages many firewalls from one console.
• Device Groups = policy and object inheritance hierarchy.
• Templates / Template Stacks = network and device config (interfaces, zones, virtual routers, dynamic updates, log forwarding).
• Log Collectors = aggregated log database (M-Series Log Collector or VM dedicated to logging).
• Plugins = extend Panorama (Cisco ACI, AWS, Azure, GCP, Kubernetes, ServiceNow, etc.).
• Modes: Panorama mode, Log Collector mode, Management Only mode.

High-Yield Acronyms¶

Key URLs to Bookmark¶

• PAN-OS Admin Guide
• PAN-OS CLI Quick Start
• Networking docs
• Panorama admin guide
• Applipedia (App-ID database)
• URL Test (PAN-DB lookup)
• LIVEcommunity
• Compatibility Matrix