← Back to Portal

NetSec-Pro Study Material

Exam Crash Course

All six domains covered — policy evaluation, NAT order traps, App-ID behaviour, security profiles, WildFire, SSL decryption, GlobalProtect, IPsec VPN, Panorama, HA, five hard scenario questions, and ten exam-day cheats.

Device Management Essentials

  • Factory default: IP 192.168.1.1/24, credentials admin/admin — change immediately
  • All changes require Commit — including admin password changes
  • Panorama: Templates = device-level config (interfaces, zones, routing); Device Groups = security/NAT policies; Commit to Panorama ≠ Push to Devices
  • HA: HA1 = heartbeat/config sync; HA2 = session/state sync; Group ID = virtual MAC uniqueness
  • Upgrades: Sequential major versions only — 10.2 → 11.0 → 11.1
  • Admin roles: superuser (full access) vs superreader (read-only) — use superreader for auditors
Trap Never rely solely on LDAP auth — keep at least one local admin account as break-glass. If the LDAP server fails, you're locked out.

Networking Essentials

  • Interface types: L3 (IP, routing, zone) → L2 (MAC, zone) → VWire (transparent, optional zone) → Tap (passive SPAN, no blocking)
  • Virtual Router: Contains routing table; all L3 interfaces must be assigned to one
  • Routing priority (same prefix): Connected (0) > Static (10) > eBGP (20) > OSPF (30)
  • Zone Protection Profiles: Flood protection (SYN Cookies) + Reconnaissance (port scan/host sweep) + Packet-based (fragmentation). Must be ATTACHED to zone to take effect
Key Fact Zone Protection protects zone INGRESS. It does NOT protect traffic originating from within the zone (insider threats). Use DoS Protection Policies for per-source rate limiting.

App-ID & User-ID Essentials

  • App-ID uses DPI — signatures, protocol decoders, heuristics — NOT port numbers alone
  • Application shift: A session allowed as 'ssl' may be reclassified to 'google-drive-web'. If the new app isn't in any allow rule, the session is BLOCKED mid-session
  • 'application-default' service: Restricts the app to its standard ports. FTP on TCP/2121 won't match a rule using application-default
  • User-ID Agent: Monitors Windows Security Event Log (IDs 4624, 4634, 4647) for IP-to-user mapping. Port 5007
  • User-ID zones: Internal trusted zones ONLY. Never untrust
Trap Security profiles (Antivirus, IPS, URL Filtering) are COMPLETELY IGNORED on Deny rules. The exam will try to trick you into thinking attaching a profile to a Deny rule adds inspection.

Security Policy & NAT

  • Processing order: Route lookup → NAT lookup (post-NAT zone) → Security Policy (pre-NAT addresses, post-NAT zone) → Apply translation → Egress
  • Outbound SNAT: Security policy sees pre-NAT source (10.x) + post-NAT destination zone (untrust)
  • Inbound DNAT: Security policy sees post-NAT destination IP (private) + post-NAT destination zone (trust)
  • U-Turn NAT: src zone=trust, dst zone=trust. Needs DNAT + SNAT. Without SNAT, return traffic bypasses firewall → TCP reset
  • Bi-directional static NAT: Creates one rule but covers both inbound and outbound directions automatically
Trap 'web-browsing' App-ID ≠ HTTPS. web-browsing = HTTP/TCP-80 only. HTTPS traffic = 'ssl' App-ID. A rule allowing only 'web-browsing' blocks HTTPS silently.

WildFire

  • WildFire Analysis Profile = which files to submit (PE, PDF, Office, etc.)
  • Antivirus Profile (WildFire verdict section) = what action on verdict (block/alert/allow)
  • Standard analysis = ASYNC — file delivered while WildFire analyses (4–5 minutes)
  • WildFire Inline ML = synchronous local analysis before delivery
  • Signatures published every 5 minutes; configure updates every 15 minutes

SSL/TLS Decryption

  • SSL Forward Proxy: Decrypts outbound HTTPS. Forward Trust CA cert must be distributed to clients via GPO/MDM
  • No-Decrypt rule: Must be ABOVE the Decrypt rule. Banking, healthcare, certificate-pinned apps should be excluded
  • Decryption Profile: Enforces minimum TLS version, cipher suites, certificate validity

GlobalProtect VPN

  • Portal: Authenticates users, delivers gateway list and client config
  • Gateway: Terminates VPN tunnel, applies security policy. Tunnel interface assigned to a zone (e.g., 'vpn')
  • Split tunnel: Access Route defines which traffic goes via VPN. Omit 0.0.0.0/0 for split; include it for full tunnel
  • Pre-Logon: Machine-cert based tunnel before user login — enables domain auth at startup
  • ISP blocks UDP/500 or 4500? Use SSL/TLS mode (TCP/443)

IPsec Site-to-Site VPN

  • Route-based VPN: Uses tunnel interface (tunnel.1). Needs static route + security policy (vpn zone → internal zone)
  • IKE Phase 1 (ISAKMP SA): Peer auth, DH key exchange, management tunnel. All parameters must match exactly
  • IKE Phase 2 (IPsec SA): Data encryption. Parameters must match
  • IKEv2 advantages over IKEv1: fewer messages, MOBIKE, built-in DoS protection, better EAP support
Trap Route-based IPsec VPN requires BOTH: (1) static route pointing remote subnet to tunnel interface AND (2) security policy allowing vpn zone traffic. Missing either one = traffic drops.

5 Hard Scenario Questions

Scenario 1 — Security Policy
A policy allows 'ssl' from trust to untrust. Mid-session, App-ID identifies the traffic as 'sharepoint-online'. A separate rule allows 'sharepoint-online' from trust to untrust BELOW the first rule. Does the session get blocked?
Yes, the session may be disrupted. When App-ID reclassifies the session to 'sharepoint-online', PAN-OS re-evaluates the security policy. The re-evaluation finds the 'ssl' rule first (it still matches because 'ssl' is in the allowed apps — BUT if the rule only lists 'ssl' and not 'sharepoint-online', the reclassified session hits the deny. Add all expected sub-applications to the allow rule.
Scenario 2 — NAT
An inbound NAT rule translates 203.0.113.5:443 → 10.0.1.10:443. The security policy must allow this. What source zone, destination zone, and destination IP should the policy use?
Source Zone = untrust, Destination Zone = trust, Destination IP = 10.0.1.10 (post-NAT). For inbound DNAT, use post-NAT destination IP and post-NAT zone. The public IP (203.0.113.5) is not used in the security policy.
Scenario 3 — WildFire
A WildFire Analysis Profile forwards all files. An Antivirus Profile is NOT attached to the same policy rule. WildFire returns a 'malicious' verdict for a downloaded file. Is the user protected?
No. The WildFire Analysis Profile only submits files for analysis. Without the Antivirus Profile (with WildFire verdict action = Block), no blocking occurs. The file is analysed and a signature is created globally, but the current session is unprotected. Both profiles must be attached to the same Allow rule.
Scenario 4 — GlobalProtect
A GlobalProtect user connects successfully and gets IP 172.16.50.10. They cannot reach internal servers at 10.0.1.0/24. The VPN tunnel interface (tunnel.1) is in a zone called 'vpn'. What should you check?
Two things: (1) Is there a security policy rule allowing traffic from 'vpn' zone to 'trust' zone? (2) Is there a route or tunnel configuration that includes 10.0.1.0/24 in the Access Route for split tunnelling? The tunnel being up does not guarantee routing or policy — both must be explicitly configured.
Scenario 5 — SSL Decryption
SSL Forward Proxy is enabled. Users report that banking apps on their phones are broken but desktop browsers work fine. What is the most likely cause and fix?
Certificate pinning in banking mobile apps. Mobile apps often use certificate pinning — they reject any certificate not matching the pinned value. The firewall's re-signed certificate fails the pin check. Fix: create a No-Decrypt rule for banking/financial-services URL category (or custom URL category for specific banking domains) placed ABOVE the Decrypt rule. Desktop browsers don't have pinning built-in so they work fine with the re-signed cert.

10 Exam-Day Cheats

  1. Policy evaluation: top-to-bottom, FIRST match wins — period
  2. NAT order: Route → NAT lookup (post-NAT zone) → Security Policy (pre-NAT addr + post-NAT zone) → Apply NAT
  3. SNAT policy: pre-NAT source IP, post-NAT dest zone
  4. DNAT policy: post-NAT dest IP, post-NAT dest zone
  5. web-browsing ≠ HTTPS. Always include 'ssl' for HTTPS access rules
  6. Security profiles = Allow rules only. Profiles on Deny = no effect, every time
  7. WildFire: Analysis Profile = forward; Antivirus Profile = block. Both required
  8. SSL FP: No-Decrypt ABOVE Decrypt; forward trust CA must be distributed to clients
  9. IPsec: Phase 1 = ISAKMP (control); Phase 2 = IPsec (data). ALL Phase 1 params must match
  10. Route-based VPN = static route to tunnel interface + security policy (vpn zone → trust zone)