Palo Alto Network Security Analyst Bootcamp

• What makes a firewall next-generation, and single-pass processing
• Control and data planes, and what happens to a new connection
• Zones, interfaces and the virtual router (assumed by the exam, taught once)
• Commit, the ways to manage the firewall, and the EVE-NG base lab

LAB Build the EVE-NG base lab and the first FW1 configuration (EVE-NG, task sheet and solution guide)

• How Security rules are built and checked from the top down [2.1]
• App-ID, application-default and service ports [2.1]
• Objects that make rules readable, and rule shadowing [2.1]
• Custom applications and application override [2.4]

LAB Security rules with objects, App-ID and application override (EVE-NG, task sheet and solution guide)

• Active Directory basics for firewall work
• User mapping: where IP-to-user mappings come from [2.1]
• Group mapping with LDAP [2.1]
• Security rules for users and groups, checked from the CLI [2.1]

LAB User-ID with Active Directory and rules by group (EVE-NG, task sheet and solution guide)

• NAT types and the fields of a NAT rule [2.2]
• Pre-NAT IP, post-NAT zone in Security rules [2.2]
• Source NAT for users (DIPP) and destination NAT for servers [2.2]
• U-turn NAT, ARP for public addresses and checking NAT [2.2]

LAB Source NAT, destination NAT, port forwarding and U-turn NAT (EVE-NG, task sheet and solution guide)

• The seven security profile types and their actions [1.1]
• Security profile groups [1.1]
• Custom URL categories, data patterns and custom threat signatures [1.4]
• External dynamic lists [1.3]

LAB Security profiles, custom objects and an external dynamic list (EVE-NG, task sheet and solution guide)

• TLS and certificates in plain words
• SSL Forward Proxy and SSL Inbound Inspection [2.3]
• Decryption profiles [1.2]
• Decryption rules, exclusions and the Decryption log [2.3]

LAB Decrypt outbound and inbound HTTPS (EVE-NG, task sheet and solution guide)

• Zone protection against floods, reconnaissance and packet-based attacks
• DoS protection profiles and rules [1.8]
• Policy Based Forwarding over a second ISP [2.5]
• Monitoring the PBF path and symmetric return [2.5]

LAB Zone protection, DoS protection and a second ISP with PBF (EVE-NG, task sheet and solution guide)

• Which logs the firewall writes
• Server profiles and the Log Forwarding profile [1.5]
• Log Viewer filters and ACC [3.3]
• Strata Logging Service, incidents and alerts in Strata Cloud Manager [3.3]

LAB Forward logs to syslog, filter logs and read ACC (EVE-NG, task sheet and solution guide)

• Why manage firewalls centrally, and adding a firewall to Panorama [3.1]
• Templates, template stacks and variables [3.1]
• Device groups, pre rules and post rules, commit and push [3.1]
• Strata Cloud Manager folders, snippets, variables and Push Config [3.1]

LAB Manage FW1 from Panorama (EVE-NG, task sheet and solution guide)

• Command Center and Activity Insights [3.2]
• Policy Optimizer: from port-based rules to App-ID rules, and unused rules [3.2]
• Enterprise DLP and data security profiles [1.6]
• IoT security with Device-ID [1.7]

LAB Clean up the rule base with Policy Optimizer and plan DLP and Device-ID (EVE-NG, task sheet and solution guide)

• Why SD-WAN, and the parts of PAN-OS SD-WAN
• Templates, link tags and SD-WAN interface profiles [1.9]
• Path quality, SaaS quality, traffic distribution and error correction profiles [1.9]
• SD-WAN policy rules and SLAs [2.6]

LAB Design SD-WAN for two ISP links on Panorama (EVE-NG, task sheet and solution guide)

• A three-question method and following one connection [4.1]
• Commit, runtime and push errors on the firewall, Panorama and Strata Cloud Manager [4.2]
• Device usage and health [4.3]
• A review of every exam task

LAB Break the firewall, then find and fix seven faults (EVE-NG, task sheet and solution guide)