← Back to Portal
PCNSA Study Material
Quick Reference Cheat Sheet
10 golden rules, interface type comparison, NAT order, policy evaluation, App-ID essentials, security profile types, key port numbers, and exam trap catalogue — everything on one page.
1
Policy order is top-to-bottom, first match wins. More specific rules must be above more general rules.
2
NAT before Security Policy (with post-NAT zone). Outbound SNAT: security policy uses pre-NAT source IP + post-NAT destination zone. Inbound DNAT: security policy uses post-NAT destination IP + post-NAT destination zone.
3
Security profiles only apply to Allow rules. Attaching a profile to a Deny rule has zero effect.
4
All changes require a Commit. No change takes effect until committed — including admin password changes.
5
User-ID should only be enabled on trusted internal zones. Never enable on untrust — attackers can spoof identity.
6
WildFire Analysis Profile = what to forward. Antivirus Profile = what action to take on verdicts. Both must be attached.
7
No Decrypt rule must be ABOVE the Decrypt rule in decryption policy — first match wins.
8
Layer 3 interfaces must be in a Security Zone or traffic is dropped before policy evaluation.
9
Panorama Commit ≠ Push. Commit saves to Panorama DB. Push to Devices distributes to managed firewalls. Both are required.
10
PAN-OS upgrades are sequential by major version. 10.2 → 11.0 → 11.1. Cannot skip major versions.
| Type | IP Address? | Routing? | Zone? | Use Case |
|---|---|---|---|---|
| Layer 3 | Yes | Yes (Virtual Router) | Yes | Standard routed firewall (most common) |
| Layer 2 | No | No (MAC forwarding) | Yes | Transparent switch-like deployment, zone-based policy |
| Virtual Wire | No | No (fully transparent) | Yes (optional) | Inline, bump-in-wire, minimal network change |
| Tap | No | No | Yes | Passive visibility only (SPAN port) — no blocking |
| HA | Dedicated HA IP | No | No | HA1 (heartbeat/config) and HA2 (session sync) |
| NAT Type | Direction | Security Policy: Source | Security Policy: Dest Zone | Security Policy: Dest IP |
|---|---|---|---|---|
| Source NAT (DIPP/PAT) | Outbound | Pre-NAT (private) | Post-NAT zone (untrust) | Pre-NAT destination |
| Destination NAT (DNAT) | Inbound | Pre-NAT (public) | Post-NAT zone (trust) | Post-NAT (private IP) |
| U-Turn / Hairpin NAT | Internal | Pre-NAT (private) | Trust (same zone) | Post-NAT (private) |
| Static NAT (1:1) | Both | Depends on direction | Depends on direction | Depends on direction |
Traffic flow: Ingress → Route lookup → NAT lookup (post-NAT zone determined) → Security Policy check → NAT translation applied → Egress
| Profile Type | Protects Against | Key Actions |
|---|---|---|
| Antivirus | Known malware (viruses, worms, spyware) in files | Allow, Alert, Drop, Block, Reset |
| Anti-Spyware | C2 communication, spyware phone-home, DNS sinkhole | Allow, Alert, Drop, Block IP, Sinkhole |
| Vulnerability Protection | Exploits targeting CVEs (IPS) | Allow, Alert, Drop, Block IP, Reset Both |
| URL Filtering | Malicious/inappropriate websites by category | Allow, Alert, Block, Continue, Override |
| WildFire Analysis | Unknown/zero-day files (forwards for sandbox analysis) | Forward (submit) — blocking via Antivirus profile |
| File Blocking | Specific file types (by content, not extension) | Allow, Alert, Block, Continue |
| Data Filtering | Data exfiltration (CC numbers, SSNs) | Allow (alert), Block |
192.168.1.1/24
Factory default management IP
TCP 3978
Firewall ↔ Panorama management
UDP 500 / 4500
IKE / IKE NAT-T (IPsec VPN)
UDP/TCP 5007
User-ID Agent to Firewall
63 chars
Max security policy rule name length
1,000
Max custom App-ID objects per firewall
TCP/UDP 5060
SIP (VoIP signalling)
Admin dist: 10
Static route administrative distance
Admin dist: 20
eBGP administrative distance
Admin dist: 30
OSPF administrative distance
Every 5 min
WildFire signature publish frequency
TCP 443
GlobalProtect SSL/TLS fallback tunnel
Trap 1: 'web-browsing' ≠ HTTPS. web-browsing = HTTP on TCP/80. HTTPS = 'ssl' App-ID. Always include both in web access rules.
Trap 2: For INBOUND DNAT, the security policy destination is the POST-NAT IP (private) and POST-NAT zone. Opposite of outbound SNAT.
Trap 3: Security profiles on Deny rules = zero effect. Profiles only work on Allow rules.
Trap 4: Panorama Commit ≠ Push to Devices. Two separate steps required.
Trap 5: User-ID on untrust zone is a security risk — attackers can claim any identity. Only enable on internal trusted zones.
Trap 6: WildFire Analysis Profile = forwarding. Antivirus Profile = blocking based on verdict. Both required for WildFire protection.
Trap 7: A No-Decrypt rule must be ABOVE the Decrypt rule. Decryption rules are top-to-bottom like security rules.
Trap 8: Application = 'any', Service = 'service-https' allows ALL apps on TCP/443 — not just SSL. It is a port-based rule, not App-ID.
Trap 9: U-Turn NAT requires BOTH DNAT (translate public to private) AND SNAT (translate source to firewall trust IP) for correct return path.
Trap 10: IKE Phase 1 parameters must ALL match exactly. A single mismatch (e.g., SHA-256 vs SHA-1) causes complete Phase 1 failure.