PAN OS Networking Configuration

Which of these is a valid way to define a source IP in a policy?

Which THREE items are defined in an IKE Crypto Profile?

What is the purpose of 'Path Monitoring' in HA?

A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?

How can you verify the status of a tunnel interface?

In GlobalProtect, what is the 'Portal' vs. 'Gateway'?

An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a subnet. The firewall interface is configured with a static IP address. Which additional step is required to enable DHCP server functionality on that interface?

A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?

In a Site-to-Site VPN, which setting determines how the firewall handles traffic that does not match the phase 2 selector?

What is the purpose of an 'Aggregate Ethernet' interface?

Which TWO interface types support IP addresses?

A network engineer is configuring a Palo Alto Networks firewall to use DHCP on an interface for management access. The engineer wants the firewall to obtain an IP address from a DHCP server and also send its hostname to the DHCP server for DNS registration. Which DHCP client option should the engineer enable?

A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?

An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?

What is the default behavior when a firewall is configured for HA but the control link fails?

An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?

What happens if a zone is not assigned to an interface?

Which TWO issues can prevent BGP from reaching the 'Established' state?

Which TWO items must match for an OSPF adjacency to form?

When configuring an interface for DHCP client, where do you set this?

Which THREE items can be assigned to a Security Zone?

An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?

A administrator is configuring a VPN. What does the 'Local IP' in the IKE Gateway represent?

A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?

A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?

A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?

A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)

What is the primary function of a Virtual Router?

Which THREE routing protocols can be configured on a PAN-OS virtual router?

How does the firewall determine which virtual router to use for a packet?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?

When using OSPF, what is the 'Router ID' used for?

A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)

A network engineer is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The engineer wants the firewall to assign IP addresses to guests and also provide DNS server information. Which configuration step is necessary to achieve this?

A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?

A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?

What is a 'Layer 3' interface in PAN-OS?

Which component is required to enable a firewall to act as an OSPF Area Border Router (ABR)?

A network engineer is configuring a Palo Alto Networks NGFW with a single virtual router that has two ISP-facing interfaces: ethernet1/1 (default route to 203.0.113.1) and ethernet1/2 (default route to 198.51.100.1). The engineer wants the firewall to automatically use ethernet1/2 when ethernet1/1 fails. What should the engineer configure?

An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?

How do you add a new interface to an existing zone?

What is the benefit of using a Loopback interface for a GlobalProtect portal?

When configuring OSPF on a PAN-OS firewall, what is the impact of setting the dead interval to a value different from the neighbor?

Why might OSPF adjacency stay in 'ExStart/Exchange' state?

You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?

A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?

Which TWO settings are configured in a Virtual Router?

A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?

Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?

An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)

In BGP, which attribute is used to influence the path selection for outgoing traffic?

An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?

A network architect is designing a Palo Alto Networks firewall deployment with two virtual routers. The firewall has two interfaces, Ethernet1/2 and Ethernet1/3, both assigned to different zones. The architect wants to ensure that traffic from Ethernet1/2 can reach Ethernet1/3 without being routed through an external device. Which configuration is necessary?

Which TWO conditions can trigger an HA failover?

Which option is required to use an interface in a security policy?

A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?

An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?

Where do you configure the 'Heartbeat' interval for HA?

An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?

Which THREE components are involved in a VPN tunnel setup?

A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?

What is the purpose of an Aggregate Ethernet (AE) interface?

Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?

A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?

Which object type is required to enable GlobalProtect access for remote users?

You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?

An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?

A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?

A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?

Which TWO components are involved in configuring GlobalProtect?

Which TWO commands are useful for troubleshooting OSPF?

What is the purpose of a Security Zone?

Which TWO types of failover can be configured in HA?

Which THREE factors can affect the speed/throughput of a VPN tunnel?

A security engineer is configuring a new Palo Alto Networks firewall in a data center. The firewall has two ISP connections: one primary and one backup. The engineer wants to ensure that outbound traffic uses the primary ISP and only fails over to the backup ISP if the primary fails. The engineer has configured two default routes with different metrics. Which additional configuration is required to ensure that the firewall can detect a failure on the primary ISP path and automatically switch to the backup?

What is the purpose of an HA Control Link?

In BGP, what is a 'Route Map' used for?

An administrator is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a single physical link that delivers both internet traffic (untagged) and IPTV multicast traffic (VLAN 300). The administrator wants to give the IPTV traffic its own security zone and apply a distinct security policy, while keeping the internet traffic in the existing untagged zone. Which configuration should the administrator use on the physical interface?

An administrator is configuring a site-to-site VPN between two PAN-OS firewalls. The VPN will use a tunnel interface to route traffic. The administrator has created the IKE gateway and IPsec crypto profile. Which additional configuration is required to assign an IP address to the tunnel interface?

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The ISP provides a single physical link that must carry both the untagged corporate traffic and a VLAN-tagged guest network. The engineer assigns the physical interface as a Layer 3 interface and creates a subinterface. Which additional step is required to allow the guest VLAN traffic to flow through the firewall?

Which THREE items are required to configure a Site-to-Site VPN?

Why might a static route not be visible in the routing table?

Which interface type is used to manage the firewall over the network?

An administrator is configuring a new Palo Alto Networks firewall and needs to assign an IP address to a physical interface that will be used as a Layer 3 gateway for a subnet. The interface must be able to route traffic between different zones. Which interface type should the administrator configure?

In an HA active/passive configuration, which mechanism ensures the passive firewall is ready to take over traffic?

Which setting in a Security Policy rule determines whether traffic is permitted or denied?

An engineer is configuring a new Palo Alto Networks firewall at a branch office. The ISP provides a /30 public subnet on GigabitEthernet1/1, and the internal network uses 10.10.10.0/24 on GigabitEthernet1/2. The branch also has a separate guest network 10.20.20.0/24 that must be reachable from the corporate network via an IPsec tunnel. The engineer wants the firewall to route traffic between the internal, guest, and tunnel networks without creating multiple virtual routers. Which configuration should be used?

Which THREE things must be configured to allow HA between two firewalls?

A network administrator is setting up a Palo Alto Networks firewall and needs to configure an interface for outbound internet access. The ISP provides a static IP address, and the administrator wants to ensure that return traffic from the internet can reach the internal network. Which type of interface configuration is required?

An administrator is configuring a Palo Alto Networks firewall to support a site-to-site VPN with a remote peer. The administrator needs to ensure that the firewall can route traffic to the remote network through the VPN tunnel. Which two configurations are required on the firewall to enable routing of traffic into the tunnel? (Choose two.)

Which TWO items must be configured to allow external management access?

An engineer is configuring a new virtual router on a PA-3220. The virtual router will use OSPF to exchange routes with a neighboring router. The engineer wants to ensure that the firewall forms an OSPF adjacency and advertises the connected subnet of the firewall's Layer 3 interface. Which two configuration steps are required in PAN-OS? (Choose two.)

An engineer is configuring a new Palo Alto Networks firewall for a branch office. The branch uses a single ISP connection, and the engineer wants to dynamically learn the default route from the ISP's router without manually configuring a static route. The ISP's router is configured to send OSPF LSAs, but the firewall is not forming an adjacency. The engineer has verified that the interface is up and IP addressing is correct. Which configuration step is required on the firewall to successfully form an OSPF adjacency with the ISP router?

Which command confirms that an OSPF neighbor relationship is in the 'Full' state?

Which TWO actions must be performed to successfully configure a zone protection profile on a zone?

What is the effect of changing the HA heartbeat interval?

What happens to established sessions during an HA failover?

An administrator is configuring a Palo Alto Networks firewall to route traffic between two internal networks. The firewall has two Layer 3 interfaces, Ethernet1/1 and Ethernet1/2, each assigned to different security zones and different virtual routers. The administrator wants traffic from the trust zone to reach the untrust zone, but the firewall is not routing the traffic. What is the most likely cause?

What is the function of a 'Tap' mode interface?

Which TWO protocols can be used to manage the firewall?

In HA, what is the difference between 'Active/Passive' and 'Active/Active' modes?

When configuring HA, what is 'Preemption'?

A network engineer is configuring a site-to-site VPN between two PA-5220 firewalls. The engineer wants to ensure that if the primary ISP link fails, the VPN tunnel automatically re-establishes over a backup ISP link without manual intervention. Both firewalls have two ISP connections and the VPN is configured with a tunnel interface. Which PAN-OS feature should the engineer configure to achieve this?

Which tab is used to configure physical interface settings like speed and duplex?

A network engineer is configuring a Palo Alto Networks firewall to participate in OSPF with neighboring routers. The engineer wants to ensure that the firewall becomes the Designated Router (DR) on a broadcast network. Which two OSPF parameters should the engineer configure to influence DR election? (Choose two.)

Which THREE items can be used as a 'Source' in a security policy?

When configuring a Static Route, what does the 'Metric' field do?

An engineer needs to configure a Palo Alto Networks firewall to act as a DHCP server for a network segment connected to Ethernet1/1. The engineer wants the firewall to assign IP addresses from the 192.168.10.0/24 subnet. Which configuration step is required?