NetSec-Pro Study Guide 2026 — CLI, Web UI & SCM Procedures

Purpose: Step-by-step configuration reference for hands-on exam scenarios.

Companion: [Crash Course](NETSEC-PRO-CRASHCOURSE.md) for concepts · [Labs](NETSEC-PRO-LAB-SCENARIOS.md) for full exercises.

---

How to Read This Guide

Each procedure includes:

• Web UI path — where to click in PAN-OS / Panorama / SCM
• CLI commands — configure mode set commands
• Verification — how to confirm success
• Exam relevance — which domain this maps to

---

Domain 1 Procedures

1.1 Create Zones and Assign Interfaces

Web UI: Network → Interfaces → Ethernet → configure → Zone (dropdown)

CLI:

configure
set network interface ethernet ethernet1/1 layer3 ip 10.0.0.2/24
set zone untrust network layer3 ethernet1/1
set network interface ethernet ethernet1/2 layer3 ip 10.0.1.1/24
set zone trust network layer3 ethernet1/2
commit

Verify: show interface all · show zone

---

1.2 Create a Security Policy Rule

Web UI: Policies → Security → Add

CLI:

configure
set rulebase security rules allow-web from trust to untrust source any destination any
  application web-browsing service application-default action allow
  profile-setting group strict
  log-setting default
commit

Exam notes:

• Use application-default not any service
• Attach a profile group to every production allow rule
• Attach a log forwarding profile per rule

Verify: show running security-policy · test with traffic

---

1.3 Configure User-ID Agent

Web UI: Device → User Identification → User-ID Agents → Add

CLI:

configure
set deviceconfig setting user-id-collector setting include-user-list yes
set deviceconfig system setting user-id-collector yes
# Agent config typically done via GUI or Panorama template
commit

Verify: show user ip-user-mapping all · show user group name <group>

---

1.4 SSL Forward Proxy Decryption

Web UI: Device → Certificate Management → Generate → Forward Trust CA

Then: Policies → Decryption → Add

CLI (abbreviated):

configure
# Generate Forward Trust CA (GUI recommended for cert generation)
set rulebase decryption rules decrypt-outbound from trust to untrust
  source any destination any action decrypt
  type ssl-forward-proxy
commit

Prerequisites:

• Forward Trust CA deployed to all client trust stores
• No-Decrypt exclusions above decrypt rules for cert-pinned apps

Verify: show session all filter decryption eq yes

---

1.5 Packet Flow Verification

CLI diagnostics:

show session all
show session id <id>
show counter global filter packet-filter yes
test security-policy-match from trust to untrust source 10.0.1.10 destination 8.8.8.8 protocol 6 destination-port 443

Exam relevance: Domain 1 — know test security-policy-match for policy troubleshooting.

---

Domain 2 Procedures

2.1 VM-Series Bootstrap (init-cfg.txt)

type=dhcp-client
hostname=FW-BRANCH-01
vm-auth-key=<one-time-key-from-SCM>
tplname=Production-Stack
dgname=EMEA-Firewalls
plugin-op-commands=aws-gwlb-inspect:enable

Exam trap: vm-auth-key is one-time per device; tplname/dgname are case-sensitive.

---

2.2 Register Firewall to Panorama

Web UI: Device → Setup → Management → Panorama Settings

CLI:

configure
set deviceconfig system panorama-server 10.10.10.5
set deviceconfig system panorama-server-2 10.10.10.6
commit

On Panorama: Panorama → Managed Devices → Add (serial number)

---

Domain 3 Procedures

3.1 Enable Threat Prevention Profiles

Web UI: Objects → Security Profiles → Vulnerability Protection → clone strict

CLI:

configure
set profiles vulnerability strict rulebase entry 1 action reset-both
  severity critical,high,medium
commit

3.2 Configure DNS Sinkhole

Web UI: Objects → Security Profiles → Anti-Spyware → DNS Signatures → sinkhole

Requires: DNS Security license for full cloud DNS threat intel

Verify: Query a known malicious test domain; check Threat log for sinkhole action.

---

3.3 Configure WildFire Analysis Profile

Web UI: Objects → Security Profiles → WildFire Analysis → default → forward all

Attach to allow rule via Security Profile Group.

---

Domain 4 Procedures

4.1 Content Update (Manual)

Web UI: Device → Dynamic Updates → Check Now → Download and Install

CLI:

request content upgrade check
request content upgrade download
request content upgrade install version <version>

Verify: show system info | match content-version

---

4.2 Configuration Snapshot

Web UI: Device → Setup → Operations → Save named configuration snapshot

CLI:

save config to snapshot-before-change.xml

---

4.3 Panorama Commit and Push

1. 1. Make changes on Panorama
2. 2. Commit (Commit → Commit to Panorama)
3. 3. Push (Commit → Push to Devices → select targets)
4. 4. Verify: Panorama → Managed Devices → check commit status per firewall

---

Domain 5 Procedures

5.1 Create External Dynamic List (EDL)

Web UI: Objects → External Dynamic Lists → Add

CLI:

configure
set external-list my-blocked-ips type ip recurring url https://example.com/blocked-ips.txt
commit

Use in security policy: source/destination → External Dynamic List → my-blocked-ips

---

5.2 Log Forwarding Profile

Web UI: Objects → Log Forwarding → Add

CLI:

configure
set log-settings profiles default match-list traffic send-to-panorama
set log-settings profiles default match-list threat send-to-panorama
commit

Attach to security rule: log-setting default

---

5.3 Panorama Device Group Policy

Web UI: Panorama → Policies → Security (select device group from dropdown)

Pre-rules and post-rules configured at device group level; local rules on firewall.

---

Domain 6 Procedures

6.1 GlobalProtect Portal + Gateway

Portal (client connects first):

• Network → GlobalProtect → Portals → Add
• Authentication profile (LDAP/SAML)
• Client config: list gateways

Gateway (tunnel termination):

• Network → GlobalProtect → Gateways → Add
• Interface, IP pool, tunnel settings
• Security policy for GP zone

Verify: show global-protect-gateway current-user · client connects and receives IP

---

6.2 Site-to-Site IPsec VPN

Web UI: Network → Network Profiles → IKE Crypto / IPsec Crypto → then Network → IPSec Tunnels

CLI (abbreviated):

configure
set network ike crypto-profiles ike-cp hash sha256 encryption aes-256-cbc dh-group group14
set network tunnel ipsec ipsec-tunnel peer-IP 203.0.113.5
  auto-key ike-gateway gw-name
commit

Add tunnel interface to virtual router; create static route or use BGP.

---

6.3 Source NAT

Web UI: Policies → NAT → Add

CLI:

configure
set rulebase nat rules snat-outbound from trust to untrust source 10.0.1.0/24
  destination any service any source-translation dynamic-ip-and-port
  interface-address interface ethernet1/1
commit

Exam note: NAT matches pre-NAT; security policy matches post-NAT zone.

---

SCM Quick Reference

Task	SCM path
------	----------
Onboard NGFW	Settings → Devices → Onboard (vm-auth-key)
Edit policy	Configure → Security → Policies
Push config	Commit → Push to devices
View AIOps	Monitor → AIOps dashboard
BPA report	Monitor → Best Practice Assessment

---

Per-Domain Checklists

Domain 1 Checklist

• [ ] Zones created and interfaces assigned
• [ ] Default rules understood (intra allow, inter deny)
• [ ] Allow rules use App-ID + application-default + profiles
• [ ] User-ID agent configured and mapping verified
• [ ] Decryption policy with No-Decrypt exclusions

Domain 3 Checklist

• [ ] All CDSS subscriptions identified and licensed
• [ ] Strict profile group on all allow rules
• [ ] WildFire forwarding enabled
• [ ] DNS sinkhole configured
• [ ] URL filtering categories blocked (malware, phishing)

Domain 5 Checklist

• [ ] Panorama device groups and templates structured
• [ ] Log forwarding profiles on all allow rules
• [ ] EDLs configured and refreshing
• [ ] Commit → push workflow tested

Domain 6 Checklist

• [ ] GlobalProtect portal and gateway operational
• [ ] IPsec S2S tunnel up (Phase 1 + 2)
• [ ] Certificates valid and not expiring
• [ ] NAT rules correct for outbound and published services

---

*For full lab exercises with architecture diagrams, see the [Labs folder](Labs/INDEX.md).*