Paloalto Networks PSE-SoftwareFirewall - Palo Alto Networks Systems Engineer (PSE): Software Firewall Professional

Software next-generation firewall (NGFW) credits can be used to enable DNS security on Palo Alto Networks firewalls. These credits allow customers to activate DNS Security service, which provides real-time protection against DNS-based threats by leveraging machine learning and continuous analysis.

References:

Palo Alto Networks DNS Security: DNS Security

Palo Alto Networks Licensing Guide: Software NGFW Credits

Data-plane vCPU Licensing:

The CN-Series firewalls are licensed based on the number of data-plane vCPUs. This licensing model reflects the processing power dedicated to handling traffic and security enforcement within the containerized environment.

When implementing active-active high availability (HA), a floating IP address must be configured to allow the HA pair to share a single IP address that may be used as the network's gateway IP address. This floating IP address ensures that either of the active-active firewalls can assume control of the traffic without interruption in case of a failover.

References:

Palo Alto Networks High Availability Guide: Active-Active HA Configuration

Palo Alto Networks HA Configuration: HA Configuration

Within a Cisco ACI architecture, Palo Alto Networks Next-Generation Firewalls (NGFWs) are deployed using service graphs. Service graphs in Cisco ACI define the sequence of network services that traffic must pass through. By configuring service graphs, administrators can seamlessly integrate Palo Alto Networks firewalls into the fabric to inspect and secure traffic flows.

References:

Palo Alto Networks and Cisco ACI Integration Guide: Service Graphs Integration

Cisco ACI Service Graph Documentation: Service Graphs

CN-Series devices obtain a VM-Series authorization key from Panorama. Panorama is the centralized management platform for Palo Alto Networks firewalls, including CN-Series and VM-Series. It provides the necessary authorization keys and other configurations to ensure proper deployment and operation of the firewalls.

References:

Palo Alto Networks Panorama Documentation: Panorama Overview

Palo Alto Networks CN-Series Setup Guide: CN-Series Setup

Independent Upgrade:

The VM-Series plugin can be upgraded independently of the PAN-OS version. This allows for flexibility in maintaining and enhancing the plugin without the need for a complete PAN-OS upgrade.

ï‚·Full set of APIs enabling programmatic control of policy and configuration:

Palo Alto Networks provides a comprehensive set of APIs that allow for the automation and orchestration of security policies and configurations in an SDN environment.

Allow-list Security Model:

Prisma Cloud Compute provides runtime security by automatically creating an allow-list security model for each container and service. This model ensures that only expected and authorized behaviors are allowed, effectively preventing unauthorized activities.

ï‚·Enabling Threat Prevention on Palo Alto Networks firewalls provides comprehensive protection against inbound threats by inspecting traffic for exploits, malware, and other malicious activities.

ï‚·Reference: The Threat Prevention service is detailed in the PAN-OS documentation, highlighting its role in securing inbound traffic by leveraging various threat detection and prevention techniques.

ï‚·Palo Alto Networks Threat Prevention Documentation