75 of 109 questions · Page 1/2 · Pan Os Networking Configuration topic · Answers revealed
Which of these is a valid way to define a source IP in a policy?
An address object is a named, reusable container holding one or more IP addresses, subnets or ranges. Referencing it as the source in a policy rule satisfies the requirement while simplifying administration and keeping rules readable.
Why this answer
You can use an IP address, subnet, or Address Object to define the source IP in a policy rule.
Which THREE items are defined in an IKE Crypto Profile?
The hashing algorithm provides integrity verification and authentication of IKE phase 1 packets, such as SHA-256. It is one of the three settings, with encryption algorithm and Diffie-Hellman group, that the IKE Crypto Profile defines.
Why this answer
IKE Crypto Profiles define encryption algorithms, hashing algorithms, and Diffie-Hellman groups for Phase 1.
What is the purpose of 'Path Monitoring' in HA?
Path Monitoring probes configured destination IP addresses to confirm that critical downstream resources remain reachable through a firewall's path. If probes fail, the firewall triggers failover, satisfying the stem's requirement to track reachability of critical resources rather than just interface or link state.
A network administrator is deploying a Palo Alto Networks firewall in Layer 3 mode. The firewall has two interfaces: ethernet1/1 connected to the internet and ethernet1/2 connected to the internal network. The administrator wants to enable the firewall to route traffic between these interfaces and perform security inspections. Which configuration is required to allow traffic to flow between the two interfaces?
In PAN-OS, a virtual router is required to route traffic between Layer 3 interfaces. By assigning both interfaces to the same virtual router, the firewall can make forwarding decisions based on its routing table. This enables traffic to flow from the internet interface to the internal interface and vice versa, while security policies still apply between zones.
Why this answer
To route traffic between Layer 3 interfaces, PAN-OS uses virtual routers. Assigning both interfaces to the same virtual router allows the firewall to use its routing table to forward packets between them. While security policies are needed to permit the traffic, the fundamental routing configuration is the virtual router assignment.
Exam trap
The trap here is assuming that a security policy alone enables routing, overlooking the need for a virtual router.
How can you verify the status of a tunnel interface?
This operational command queries the tunnel interface's live state, returning status, IP address and whether the tunnel is up or down. It satisfies the verification requirement by reading the interface directly, rather than inferring health from routing or log output.
Why this answer
The 'show interface tunnel.<id>' command displays the status, packet counts, and errors for the tunnel interface.
In GlobalProtect, what is the 'Portal' vs. 'Gateway'?
The Portal serves as the configuration distribution point, delivering agent settings and gateway lists to endpoints, while the Gateway terminates the actual VPN tunnels and enforces security policy on user traffic. This separation satisfies the stem's distinction: the Portal only brokers configuration, whereas the Gateway handles the data plane.
Why this answer
The Portal is responsible for distributing the configuration/client software, while the Gateway handles the actual tunnel and traffic enforcement.
An engineer is configuring a new firewall in a high-availability (HA) active/passive pair. The engineer wants to ensure that the HA1 control link and HA2 data link are properly configured for redundancy. The engineer decides to use the management interface for HA1 and a dedicated data interface for HA2. Which statement is correct regarding this configuration?
When using the management interface for HA1, you must configure HA1 IP addresses on both firewalls, and they must be in the same subnet to communicate. The management interface is not automatically configured for HA; you must explicitly set the HA1 IP address and ensure connectivity. This is a correct requirement for this configuration.
Why this answer
When using the management interface for HA1, you must configure HA1 IP addresses on both firewalls in the same subnet. This ensures that the control link can communicate. The management interface is not automatically set up for HA; explicit configuration is required.
This is a valid and supported configuration, though often a dedicated HA1 interface is preferred.
Exam trap
The trap here is assuming that the management interface cannot be used for HA1 or that it requires no additional configuration.
To enable DHCP server functionality, you must configure it under the interface's advanced settings. This includes specifying an address pool, lease times, and other options. The interface must have a static IP address. This option is correct because it directly describes the necessary configuration step in PAN-OS.
Why this answer
The correct answer is to enable DHCP server in the interface's advanced settings and define an address pool. PAN-OS allows an interface with a static IP to function as a DHCP server. This is configured under the interface's IPv4 or IPv6 settings, where you specify the address pool, lease times, and other parameters.
No external relay is needed.
Exam trap
The trap here is confusing DHCP server with DHCP relay or client, or thinking a security policy rule is required to enable the service.
A network engineer is configuring a Palo Alto Networks firewall to connect to an ISP using PPPoE. The ISP requires the firewall to obtain its public IP address dynamically via PPPoE. Which interface type should be configured on the firewall's Ethernet interface?
A PPPoE interface is specifically designed to establish a PPPoE session with the ISP, allowing the firewall to obtain an IP address dynamically and authenticate if required. This interface type supports the necessary PPPoE negotiation and is the correct choice when the ISP mandates PPPoE for connectivity.
Why this answer
The PPPoE interface type on a Palo Alto Networks firewall is specifically designed to negotiate a PPPoE session with an ISP, including authentication and dynamic IP address assignment. When an ISP requires PPPoE, configuring the Ethernet interface as a PPPoE interface is the correct approach. Other interface types like Layer 3 with DHCP or Layer 2 do not support the PPPoE protocol and would fail to establish the required connection.
Exam trap
The trap here is assuming that DHCP client on a Layer 3 interface can replace PPPoE, but PPPoE requires session negotiation and authentication that DHCP does not provide.
Proxy IDs define the phase 2 selectors, so traffic not matching them is handled according to the Proxy ID setting — permitting any, dropping, or negotiating a separate tunnel. This directly governs non-matching traffic behaviour.
What is the purpose of an 'Aggregate Ethernet' interface?
Aggregate Ethernet (LACP) bundles multiple physical links into one logical interface, aggregating bandwidth beyond a single link's capacity while providing link-level redundancy if a member fails. This directly satisfies the stem's throughput and redundancy purpose, unlike a single uplink or a routed subinterface.
Why this answer
Aggregate Ethernet (AE) allows you to combine multiple physical interfaces into one logical interface for higher throughput and link redundancy.
Which TWO interface types support IP addresses?
A Layer 3 interface routes traffic and therefore requires an IP address, which is assigned directly to it. This satisfies the stem's requirement that the interface type supports IP addressing, unlike Layer 2 or tap interfaces.
Why this answer
Layer 3 and Loopback interfaces support IP addresses.
A network engineer is configuring a Palo Alto Networks firewall to use DHCP on an interface for management access. The engineer wants the firewall to obtain an IP address from a DHCP server and also send its hostname to the DHCP server for DNS registration. Which DHCP client option should the engineer enable?
The 'Send Hostname' option in the DHCP client configuration causes the firewall to include its hostname in the DHCP request (Option 12). This allows the DHCP server to register the hostname with DNS, enabling other devices to resolve the firewall's management IP by name. It is a specific setting separate from simply enabling the DHCP client.
Why this answer
The 'Send Hostname' option in the DHCP client configuration instructs the firewall to include its hostname in the DHCP request. This enables the DHCP server to register the firewall's hostname and IP address with DNS, facilitating name resolution. Simply enabling the DHCP client does not send the hostname, so that option is required.
Exam trap
The trap here is assuming that enabling the DHCP client automatically sends the hostname; in fact, you must explicitly enable the 'Send Hostname' option.
A network administrator is configuring a Palo Alto Networks firewall and needs to assign an IP address to an interface that will be used for management access. The administrator wants to ensure that the interface is dedicated for management and cannot be used for data traffic. Which interface type should be configured?
The management interface (MGT) is a dedicated out-of-band interface used exclusively for management access, such as SSH, HTTPS, and SNMP. It is separate from data interfaces and cannot be used for data traffic. Configuring the MGT interface with an IP address ensures dedicated management access as required.
Why this answer
The management interface on a Palo Alto Networks firewall is specifically designed for out-of-band management. It is separate from data interfaces and cannot be used for data traffic, ensuring dedicated management access. Assigning an IP address to the MGT interface allows administrators to connect via SSH or HTTPS without impacting data plane operations.
Other interface types like Layer 3 or loopback can be used for management but are not dedicated solely to that purpose.
Exam trap
The trap here is assuming that any interface with an IP address can serve as a dedicated management interface, but only the MGT interface is exclusively for management and isolated from data traffic.
An administrator is troubleshooting a routing issue on a PAN-OS firewall. The firewall has two virtual routers: VR1 and VR2. Interface ethernet1/1 is assigned to VR1, and ethernet1/2 is assigned to VR2. A packet arrives on ethernet1/1 destined for a network reachable via ethernet1/2. How does the firewall determine which virtual router to use for the packet?
In PAN-OS, the virtual router for a packet is determined by the ingress interface. The firewall looks up the destination in the routing table of the virtual router to which the ingress interface is assigned. If the route points to an egress interface in a different virtual router, the packet is dropped unless there is a route leaking configuration. So the ingress VR is used for the initial lookup.
Why this answer
The firewall uses the virtual router associated with the ingress interface to perform the route lookup. This means the routing table of that virtual router is consulted. If the route points to an egress interface in another virtual router, the packet is dropped unless route leaking is configured.
The egress virtual router is not used for the initial decision.
Exam trap
The trap here is assuming that the egress interface's virtual router or a global routing table is used; in fact, the ingress interface's virtual router is used for the lookup.
What is the default behavior when a firewall is configured for HA but the control link fails?
When the HA control link fails, each peer loses heartbeat visibility of the other and cannot determine its partner's state. Both may assume the active role simultaneously, producing a split-brain condition where duplicate IP and MAC addresses conflict on the network.
Why this answer
If the HA control link fails, the firewalls may lose synchronization, and both could potentially try to become 'Active' (a split-brain scenario) unless heartbeat link monitoring is correctly configured.
An engineer is configuring a Palo Alto Networks firewall to advertise a default route into an OSPF area. The firewall must originate the default route only when its own route to 0.0.0.0/0 is present and stable. Which OSPF configuration accomplishes this?
The 'Match' setting makes the firewall originate a default route into OSPF only when a matching default route (0.0.0.0/0) exists in its own routing table and is stable. This precisely satisfies the scenario: the default route is advertised conditionally, preventing black-hole routing when the firewall's own default route is absent.
Why this answer
The 'Match' option under OSPF Area configuration for advertising a default route ensures the firewall originates a default route into OSPF only when a corresponding default route exists in its routing table. This conditional advertisement prevents the firewall from attracting traffic it cannot forward, which is critical for stable routing in scenarios where the default route may be learned dynamically or withdrawn.
Exam trap
The trap here is assuming that any default route advertisement will be conditional, when in fact the 'Always' setting advertises unconditionally and can cause black-hole routing.
What happens if a zone is not assigned to an interface?
Security zones are the logical containers that policies reference when matching traffic. An interface without an assigned zone has no security context, so the firewall cannot evaluate it against any policy rule, leaving it unusable in policy definitions.
Why this answer
The interface cannot be used in a security policy, effectively making it unusable for traffic management through the firewall.
Which TWO issues can prevent BGP from reaching the 'Established' state?
BGP peers form sessions over TCP port 179, so any firewall policy blocking that port prevents the three-way handshake and the OPEN/KEEPALIVE exchange needed for Established. This directly satisfies the stem's constraint: a transport-layer block stops the neighbour relationship before BGP can negotiate.
Which TWO items must match for an OSPF adjacency to form?
Both routers must belong to the same OSPF area for an adjacency to form, since area membership determines link-state database synchronisation. Mismatched area IDs cause the routers to reject each other's Hello packets, preventing the neighbour relationship entirely.
Why this answer
OSPF requires Area ID and Hello/Dead timers to match to form an adjacency.
When configuring an interface for DHCP client, where do you set this?
DHCP client mode is configured per interface under Network > Interfaces, where the IPv4 tab exposes the addressing type selector. Setting it there binds the interface to request a lease from the upstream DHCP server.
Why this answer
In the Network > Interfaces > [Interface Name] > IPv4 tab, you can select 'DHCP' for the IP configuration.
Which THREE items can be assigned to a Security Zone?
Physical interfaces are the firewall's actual ports, each carrying a Layer 3 configuration and zone membership. Assigning them to a Security Zone is the foundational configuration step, satisfying the stem's requirement for zone-assignable interface types.
Why this answer
Physical interfaces, sub-interfaces, and tunnel interfaces can all be assigned to security zones.
An engineer configures a Layer 3 interface with IP 10.1.1.1/24 and assigns it to the 'trust' zone. A second interface with IP 10.1.1.2/24 is assigned to the 'untrust' zone. After committing, the engineer notices that traffic between the two zones is blocked, and the firewall logs show 'route lookup failed' for packets arriving on the trust interface destined to 10.1.1.2. What is the most likely cause?
This is correct because PAN-OS does not support routing between two interfaces that are in the same IP subnet. When interfaces are in the same subnet, the firewall treats them as part of the same broadcast domain and does not perform inter-interface routing. To allow communication, the interfaces must be in different subnets, or you must use a different design such as a virtual wire or aggregate interface.
Why this answer
The correct answer is that the firewall does not route between interfaces in the same subnet. PAN-OS requires each Layer 3 interface to be in a unique subnet to perform routing. When two interfaces share a subnet, the firewall cannot determine which interface to use for routing, resulting in a route lookup failure.
The solution is to assign different subnets or use a different design.
Exam trap
The trap here is assuming that because the firewall can have multiple interfaces, it can route between any of them regardless of subnet overlap.
The Local IP specifies the firewall's own interface address that terminates the IKE negotiation, satisfying the requirement to identify the local endpoint of the VPN tunnel. It must match the interface receiving peer traffic, since IKE Phase 1 and Phase 2 exchanges bind to this address for authentication and encapsulation.
A network administrator is setting up a new firewall and needs to configure the management interface. The firewall will be managed out-of-band, and the administrator wants to ensure that management traffic is isolated from data traffic. Which interface type should be used for the management interface?
The dedicated management interface (MGT) is specifically designed for out-of-band management. It has its own IP address and is isolated from data plane traffic. By default, it resides in the 'management' zone and is used for administrative access, ensuring management traffic is separate from data traffic, which meets the requirement.
Why this answer
The dedicated management interface is designed for out-of-band management, providing isolation from data traffic. It has its own IP address and is in a separate zone, ensuring that management access is not mixed with data plane traffic. This meets the requirement for isolation and secure management.
Exam trap
The trap here is confusing the management interface with a Layer 3 interface configured for management access.
A network engineer is configuring a Palo Alto Networks firewall to route traffic between two internal networks: 172.16.1.0/24 on Ethernet1/1 and 172.16.2.0/24 on Ethernet1/2. The firewall has a single virtual router. The engineer wants to ensure that traffic from 172.16.1.0/24 to 172.16.2.0/24 is routed correctly. Which configuration is required?
For the firewall to route between the two networks, both interfaces must be Layer 3 interfaces with IP addresses in their respective subnets and assigned to the same virtual router. The virtual router will automatically create connected routes for these subnets, allowing traffic to be routed between them. Security policies must also allow the traffic, but the routing itself requires this configuration.
Why this answer
To route between two directly connected networks, the firewall interfaces must be Layer 3 with IP addresses and assigned to the same virtual router. The virtual router automatically creates connected routes for these subnets, enabling routing. Security policies must also permit the traffic, but the routing configuration itself requires the interfaces to be in the same virtual router.
Exam trap
The trap here is thinking that a static route is needed for directly connected networks, when the virtual router automatically adds connected routes.
A network engineer is deploying a pair of PA-3220 firewalls in an active/passive high availability configuration. The firewalls connect to a Cisco switch that requires the use of Link Aggregation Control Protocol (LACP) for all uplinks. The engineer wants to ensure that the dataplane interfaces on both firewalls can be aggregated into a single logical link that the switch sees as one port-channel, even though only the active firewall forwards traffic. What should the engineer configure on the Palo Alto Networks firewalls?
Aggregate Ethernet (AE) interfaces allow multiple physical interfaces to be bundled into a single logical link. Configuring LACP in active mode on both firewalls ensures that the switch sees a single port-channel from each firewall. In an active/passive HA setup, the passive firewall's AE interfaces remain in a standby state but still participate in LACP, allowing for rapid failover without renegotiating the link aggregation.
Why this answer
Aggregate Ethernet (AE) interfaces are the correct method to bundle multiple physical links into a single logical link using LACP. The same AE interface name must be used on both firewalls to ensure consistent configuration and seamless failover. LACP in active mode allows the firewall to initiate the LACP negotiation with the switch, forming a port-channel.
This configuration ensures that the switch sees a single logical link from each firewall, even though only the active firewall forwards traffic.
Exam trap
The trap here is confusing redundant interfaces with aggregate interfaces; redundant interfaces provide link failover but do not support LACP or port-channel aggregation.
A security engineer is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The engineer needs to enable OSPF on the firewall and ensure that it can form adjacencies with neighbors on multiple interfaces. Which two tasks must be completed to enable OSPF on the firewall? (Choose two.)
After creating a virtual router, you must enable OSPF globally within that virtual router. Then, you configure OSPF areas and assign interfaces to those areas. This enables the firewall to form adjacencies and exchange routes. These steps are essential for OSPF operation.
Why this answer
To enable OSPF on a Palo Alto Networks firewall, you must first create a virtual router and assign the relevant interfaces to it. Then, within that virtual router, you enable OSPF globally and configure areas and interface participation. These two tasks are essential for OSPF to form adjacencies and exchange routes.
Other tasks like BGP configuration, loopback interfaces, or enabling OSPF on the management interface are not required for basic OSPF operation.
What is the primary function of a Virtual Router?
A virtual router maintains the routing table, holding routes and selecting the next hop for each packet. This forwarding decision is its primary function, distinct from NAT, firewalling or VPN termination, which are separate features.
Why this answer
A Virtual Router maintains the routing table and processes packets based on destination IP, performing route lookups for traffic.
Which THREE routing protocols can be configured on a PAN-OS virtual router?
How does the firewall determine which virtual router to use for a packet?
The firewall selects the virtual router based on the ingress interface's assigned virtual router, then performs route lookup there. Egress interface, zone, or source address do not determine virtual router selection, so ingress interface assignment is the deciding factor.
Why this answer
The firewall uses the virtual router associated with the ingress interface to perform the routing lookup for the packet.
An engineer is configuring a new Palo Alto Networks firewall for a branch office. The service provider has assigned a single public IP address, but the branch needs to support both a guest network and a corporate network, each with its own public-facing services. The engineer wants to avoid purchasing additional public addresses. Which PAN-OS feature should be used to map the single public IP to multiple internal servers based on the destination port?
Destination NAT with port translation allows the firewall to map the single public IP to multiple internal servers by using the destination port as a differentiator. For example, traffic to port 80 can be sent to one web server and port 443 to another. This directly satisfies the requirement without needing additional public addresses.
Why this answer
Destination NAT with port translation enables the firewall to use the destination port to distinguish between multiple internal servers that share a single public IP address. This is the standard method for conserving public addresses while hosting several services. The other NAT types either do not consider the destination port or are meant for outbound or internal hairpin traffic, not inbound service publishing.
Exam trap
The trap here is confusing destination NAT with source NAT, assuming that any NAT can publish multiple services on one public IP.
The Router ID is a 32-bit value, formatted like an IPv4 address, that uniquely identifies each OSPF speaker within the OSPF domain. It appears in link-state advertisements and is used to elect the designated router on broadcast segments, satisfying the requirement to distinguish routers participating in the same OSPF topology.
A security administrator is configuring a new Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall must exchange routes with an OSPF neighbor and also advertise a static default route into OSPF. The administrator has already configured the router ID and enabled OSPF on the relevant interfaces. Which two additional configurations are required to successfully advertise the default route into OSPF? (Choose two.)
The static default route must exist in the virtual router's routing table for it to be redistributed. If the route is not present or is inactive (e.g., due to a down next-hop), it cannot be advertised. Therefore, configuring an active static default route is a prerequisite for redistribution into OSPF.
Why this answer
To advertise a static default route into OSPF on a Palo Alto Networks firewall, you must first ensure the static default route exists and is active in the virtual router. Then, you need to create a redistribution profile that matches the default route and apply it as an export rule in the OSPF configuration. This two-step process ensures that the default route is injected into OSPF and propagated to neighbors.
Without both steps, the default route will not be advertised.
Exam trap
The trap here is assuming that a simple checkbox or command like 'default-information originate' exists in PAN-OS, when in fact redistribution profiles are required.
To act as a DHCP server, the firewall must have DHCP server enabled on the Layer 3 interface, and an address pool must be defined. This allows the firewall to lease IP addresses to clients. Additionally, DNS and other options can be configured in the DHCP server settings. This is the fundamental step to provide DHCP services.
Why this answer
Enabling the DHCP server on the interface and configuring an address pool is the essential step for the firewall to assign IP addresses. The firewall can also provide DNS and other options within the DHCP server configuration. Other options like relay or security policies are not required for the firewall itself to be a DHCP server.
Exam trap
The trap here is confusing DHCP relay with DHCP server functionality, thinking that an external server is needed.
A network engineer is configuring a Site-to-Site VPN between two Palo Alto Networks firewalls. The engineer needs to assign an IP address to the tunnel interface. Where is this configuration performed?
The tunnel interface IP address is configured on the tunnel interface itself, which is found under Network > Interfaces > Tunnel. Each tunnel interface can have its own IP address, which is used as the source/destination for traffic within the VPN. This is the correct location for assigning the IP.
Why this answer
The tunnel interface IP address is configured on the tunnel interface, which is located under Network > Interfaces > Tunnel. This IP is used for routing and as the source address for traffic sent through the VPN. The other options are related to VPN configuration but do not include the tunnel interface IP setting.
Exam trap
The trap here is confusing the tunnel interface IP with the IKE or IPSec configuration, which handle peer authentication and encryption, not interface addressing.
A network engineer is configuring a PAN-OS firewall to participate in a dynamic routing environment. The firewall must form an OSPF adjacency with a neighboring router over a Layer 3 interface. The interface is already configured with an IP address and is assigned to a security zone. Which additional configuration step is required to enable OSPF on this interface?
OSPF is enabled per interface within the Virtual Router configuration. You must create an OSPF area and then add the interface, specifying the area ID. This allows the firewall to send and receive OSPF hello packets on that interface, forming adjacencies. Without this step, the interface remains silent for OSPF even if it has an IP address and zone assignment.
Why this answer
OSPF on PAN-OS is configured within a virtual router. You must define an OSPF area and then add the Layer 3 interface to that area. This step activates OSPF on the interface, allowing it to form adjacencies.
Without adding the interface to an OSPF area, the firewall will not participate in OSPF on that interface, regardless of other settings.
Exam trap
The trap here is assuming that assigning an IP address and zone to an interface automatically enables routing protocols; OSPF must be explicitly configured per interface in the virtual router.
What is a 'Layer 3' interface in PAN-OS?
A Layer 3 interface carries an IP address and is bound to a virtual router, so PAN-OS routes traffic to and from it. This satisfies the stem's definition, distinguishing it from Layer 2 interfaces, which use VLANs and switching rather than routing.
Why this answer
A Layer 3 interface is assigned an IP address and is associated with a virtual router to route traffic based on the routing table.
Configuring interfaces in multiple OSPF areas is what defines an Area Border Router: the device must hold at least one interface in the backbone (Area 0) and another in a non-backbone area, maintaining separate link-state databases per area. This satisfies the stem's ABR requirement directly.
A network engineer is configuring a Palo Alto Networks NGFW with a single virtual router that has two ISP-facing interfaces: ethernet1/1 (default route to 203.0.113.1) and ethernet1/2 (default route to 198.51.100.1). The engineer wants the firewall to automatically use ethernet1/2 when ethernet1/1 fails. What should the engineer configure?
Path monitoring is a route monitoring feature that tracks the reachability of a specified destination IP address through a particular egress interface and next hop. When the monitored path becomes unreachable, the associated static route is removed from the routing table, allowing a backup default route to take over. This provides automatic failover without requiring dynamic routing protocols.
Why this answer
Path monitoring is the PAN-OS feature that enables a static route to be withdrawn when a monitored destination becomes unreachable. By configuring path monitoring on the default route through ethernet1/1, the firewall removes that route when the path fails, allowing the backup default route through ethernet1/2 to be used. This provides automatic ISP failover without dynamic routing.
Exam trap
The trap here is confusing Policy-Based Forwarding (PBF) with path monitoring; PBF is for policy-based routing, not for link health monitoring or automatic failover.
An engineer is troubleshooting a Palo Alto Networks firewall that is not forming an OSPF adjacency with a neighboring router. The engineer verifies that the interfaces are up, IP addresses are correct, and OSPF is enabled on both devices. The firewall is configured with an OSPF area ID of 0.0.0.1, and the neighbor is in area 0.0.0.0. The engineer checks the OSPF neighbor state and sees it stuck in EXSTART. What is the most likely cause of the problem?
In OSPF, the EXSTART state is where the master/slave relationship is determined for database exchange. If the MTU on the interfaces does not match, the routers cannot agree on the initial sequence numbers, and the adjacency remains stuck in EXSTART. This is a common cause of OSPF adjacency issues, and the scenario points to this as the likely culprit.
Why this answer
The EXSTART state in OSPF is part of the database exchange process where routers negotiate master/slave roles. If the Maximum Transmission Unit (MTU) on the interfaces does not match, the routers cannot successfully exchange database description packets, and the adjacency remains stuck in EXSTART. Checking MTU settings is a key troubleshooting step for this issue.
Area mismatches, hello interval mismatches, and duplicate router IDs would cause different neighbor states.
How do you add a new interface to an existing zone?
Editing the existing zone and adding the interface there binds the interface to that zone's policy set, satisfying the requirement to extend an existing zone rather than create a new one. Zone membership is defined by the zone object's interface list, so this is the mechanism that applies the zone's rules to the new interface.
Why this answer
In the Network > Zones tab, select the desired zone and add the interface to the 'Interfaces' list in the zone configuration window.
What is the benefit of using a Loopback interface for a GlobalProtect portal?
A loopback interface remains up regardless of physical link state, so its IP address stays reachable even if one path or member link fails. This satisfies the stem's requirement for a stable, always-available address that GlobalProtect portal clients and DNS records can reference consistently, avoiding outages caused by interface flapping.
Why this answer
A loopback interface provides a stable IP address that does not depend on the status of a physical link, ensuring the portal remains reachable even if a physical interface flaps.
OSPF neighbours must agree on dead interval values; a mismatch means each router expects hellos at different times, so the adjacency never reaches Full state. The timers are carried in hello packets and validated, causing the relationship to fail.
Why this answer
OSPF requires the Hello interval and Dead interval to match exactly between neighbors; a mismatch prevents adjacency formation.
Why might OSPF adjacency stay in 'ExStart/Exchange' state?
An MTU mismatch prevents OSPF neighbours from agreeing on the Database Description packet size, so the master/slave negotiation stalls and the adjacency remains in ExStart/Exchange. Correcting the interface MTU on both sides satisfies OSPF's requirement for identical link MTU before database exchange proceeds.
You are troubleshooting GlobalProtect and notice the client cannot reach internal resources. Which routing issue is most likely?
GlobalProtect clients terminate on the firewall, which then forwards traffic to internal networks via its virtual router. Without a route to the internal subnet in that virtual router, return or forward traffic is dropped, so the missing route directly explains the reachability failure.
Why this answer
If the virtual router handling the tunnel interface does not have a route to the internal network, the firewall cannot route the decrypted traffic to the destination.
A network engineer is setting up a site-to-site VPN between two Palo Alto Networks firewalls. The engineer wants to ensure that the VPN tunnel interface IP addresses are configured correctly. Where should the tunnel interface IP address be configured in PAN-OS?
The tunnel interface IP address is configured directly on the tunnel interface under Network > Interfaces > Tunnel. You select the tunnel interface and assign an IPv4 or IPv6 address. This address is used as the source/destination for traffic within the VPN tunnel. This option is correct because it accurately identifies the location for tunnel interface IP configuration.
Why this answer
The correct answer is to configure the tunnel interface IP address on the tunnel interface under Network > Interfaces > Tunnel > IPv4. In PAN-OS, a tunnel interface is a logical interface that must be assigned an IP address to route traffic through the VPN. This address is separate from the IKE and IPsec configurations, which handle authentication and encryption.
Exam trap
The trap here is assuming that the tunnel interface IP is part of the IKE or IPsec configuration, rather than a property of the tunnel interface.
Which TWO settings are configured in a Virtual Router?
Static routes are configured directly within a virtual router, satisfying the requirement for settings held at that layer. The virtual router maintains its own routing table, and static routes populate it to direct traffic between zones and interfaces. This is distinct from policy rules or interface settings, which reside elsewhere in the configuration.
A administrator needs to route traffic to an internal network via a tunnel. Where is the static route configured?
Static routes directing tunnel-bound traffic to an internal network are configured on the Virtual Router, which holds the routing table and forwards packets between zones and tunnel interfaces. This satisfies the requirement to route traffic through the tunnel, since the virtual router performs the actual next-hop lookup.
Why this answer
Static routes for tunnel traffic are configured in the Virtual Router associated with the tunnel interface.
Where do you configure the tunnel interface IP address in a Site-to-Site VPN setup?
The tunnel interface terminates the Site-to-Site VPN, so its IP address is configured under Network > Interfaces > Tunnel. This address provides the endpoint for routing and tunnel monitoring, which the physical interface cannot supply for the logical tunnel.
Why this answer
Tunnel interfaces act as logical points for VPN traffic and are assigned IP addresses in the Network > Interfaces > Tunnel tab.
An administrator is configuring a Palo Alto Networks firewall to act as a DHCP server for a guest network. The guest network is on a Layer 3 interface with IP address 192.168.100.1/24. The administrator wants to provide IP addresses to guests in the range 192.168.100.10 to 192.168.100.200, with a lease time of 1 hour, and also provide DNS server 8.8.8.8. Which two configuration items are required to accomplish this? (Choose two.)
To act as a DHCP server, the firewall must have DHCP server enabled on the interface facing the clients. The IP pool defines the range of addresses that can be leased. This is the core configuration for providing IP addresses to clients. Without this, the firewall will not respond to DHCP requests.
Why this answer
To configure the firewall as a DHCP server, you must enable DHCP server on the Layer 3 interface and define an IP pool with the desired range. Additionally, you must set lease time and DNS server settings within the DHCP server configuration to meet the specific requirements. These two steps are essential for the firewall to provide IP addresses and network parameters to clients.
In BGP, which attribute is used to influence the path selection for outgoing traffic?
Local Preference is exchanged only between iBGP peers within a single autonomous system, so it steers outbound path selection by ranking preferred exit points. Higher values win before AS_PATH is considered, letting the engineer satisfy the stem's requirement to influence outgoing traffic direction.
Why this answer
The 'Local Preference' attribute is used within an AS to influence the path taken by traffic leaving the AS; a higher value is preferred.
An engineer is configuring a new Layer 3 interface on a PA-5220 firewall. The interface will connect to a core switch and must participate in dynamic routing using OSPF. The interface is assigned to the 'trust' zone and a virtual router named 'VR-Trust'. After committing, the engineer notices that OSPF adjacencies are not forming. What is the most likely cause?
OSPF must be enabled on the virtual router and the interface must be added to the OSPF area. Without enabling OSPF on the virtual router, no adjacencies form regardless of interface configuration. The virtual router 'VR-Trust' must have an OSPF instance with the interface assigned to an area for OSPF to function.
Why this answer
OSPF must be enabled on the virtual router and the interface must be included in an OSPF area. Without this, the firewall will not send or process OSPF hello packets, preventing adjacency formation. The interface being Layer 3 and assigned to a zone is necessary but not sufficient; the OSPF configuration on the virtual router is the critical missing step.
Exam trap
The trap here is assuming that assigning an interface to a virtual router automatically enables OSPF on that interface.
A network architect is designing a Palo Alto Networks firewall deployment with two virtual routers. The firewall has two interfaces, Ethernet1/2 and Ethernet1/3, both assigned to different zones. The architect wants to ensure that traffic from Ethernet1/2 can reach Ethernet1/3 without being routed through an external device. Which configuration is necessary?
To route traffic between two interfaces, they must be in the same virtual router. The zones can be different, and security policies will control the traffic. No static route is needed if the networks are directly connected. This configuration allows the firewall to route between the two networks without external devices.
Why this answer
For the firewall to route traffic between two interfaces, they must be in the same virtual router. The virtual router automatically routes between directly connected networks. Different zones are fine and allow security policy enforcement.
No static routes or dynamic routing protocols are needed for directly connected networks.
Exam trap
The trap here is thinking that separate virtual routers can easily route between each other or that dynamic routing is required for directly connected networks.
Which TWO conditions can trigger an HA failover?
Hardware failure removes the active node's forwarding capability, so the peer detects the loss and assumes the active role. This is a genuine failure condition, distinct from administrative or link-state triggers, and directly satisfies the stem's failover trigger requirement.
Why this answer
Failovers can be triggered by hardware failure or by the firewall losing reachability to monitored paths.
Which option is required to use an interface in a security policy?
Every interface must be assigned to a security zone before it can be referenced in a security policy rule, because policy matches on zones rather than physical interfaces. Without zone assignment, the interface cannot appear in policy.
Why this answer
You must assign a security zone to an interface; only then can that zone be used in a security policy rule.
A administrator needs to allow traffic between two zones using a specific sub-interface. Which configuration step is mandatory?
A sub-interface carries no zone membership until you assign it to a security zone; without this, policy lookup cannot match traffic and the interface stays unusable. Zone assignment is therefore the mandatory step that lets the firewall apply security policy to that sub-interface's tagged traffic.
Why this answer
Interfaces must be assigned to a security zone before they can be referenced in a security policy.
An engineer is configuring a pair of Palo Alto Networks firewalls in an active/passive high availability (HA) setup. The firewalls are connected to a Layer 3 switch that runs OSPF. The engineer wants the passive firewall to advertise a higher OSPF cost for the internal network so that traffic only uses the passive firewall if the active firewall fails. Which PAN-OS feature should be configured to achieve this?
Palo Alto Networks firewalls support OSPF dynamic cost, which allows the OSPF cost to be automatically adjusted based on the HA state. When the firewall is passive, it can advertise a higher cost, ensuring that traffic prefers the active firewall. This feature is designed exactly for this scenario, making it the correct choice.
Why this answer
OSPF dynamic cost based on HA state allows the firewall to automatically adjust its OSPF interface cost depending on whether it is active or passive. In an active/passive HA pair, the passive firewall advertises a higher cost, so OSPF routing prefers the active firewall. If a failover occurs, the newly active firewall lowers its cost, and traffic shifts accordingly.
This provides deterministic routing behavior without manual intervention.
Where do you configure the 'Heartbeat' interval for HA?
The heartbeat interval governing HA peer liveness detection is configured under Device > High Availability > General, where election and failover timers also reside. This satisfies the stem's requirement by placing the setting in the HA configuration area rather than interface, routing or security policy sections.
Why this answer
The heartbeat interval is configured in the HA > General > Election Settings or Heartbeat settings depending on the specific PAN-OS version and HA mode.
An administrator is configuring a new firewall and needs to set up a virtual router to route traffic between two subnets. The firewall has two interfaces: ethernet1/1 (IP 10.1.1.1/24) and ethernet1/2 (IP 10.2.2.1/24). The administrator wants to ensure that traffic from 10.1.1.0/24 to 10.2.2.0/24 is routed correctly. Which configuration is required?
When both interfaces are in the same virtual router, the firewall automatically installs directly connected routes for their respective subnets. Traffic between 10.1.1.0/24 and 10.2.2.0/24 will be routed without any static routes. This is the simplest and correct configuration for directly connected networks.
Why this answer
To route between two directly connected subnets, both interfaces must be assigned to the same virtual router. The firewall automatically creates directly connected routes for each interface's subnet. No static routes or dynamic routing protocols are needed because the routes are already in the routing table as connected routes.
Exam trap
The trap here is assuming that static routes are needed even for directly connected subnets.
Which THREE components are involved in a VPN tunnel setup?
The IKE Gateway defines the peer address, authentication, and Phase 1 parameters used to negotiate the tunnel. It satisfies the stem as an essential component, establishing the secure management channel before IPsec Phase 2 encryption is applied.
Why this answer
VPNs require IKE gateways, IPsec crypto profiles, and tunnel interfaces.
A network administrator is setting up a new Palo Alto Networks firewall and needs to configure a Layer 3 interface to connect to the internal network. The interface will be used to route traffic between different zones. Which configuration step is required to assign an IP address to the interface?
To assign an IP address to a Layer 3 interface, you must first set the interface type to Layer 3 and assign it to a virtual router. The virtual router is responsible for routing decisions, and the IP address is configured within the interface settings. This is the fundamental step for enabling routing on the interface.
Why this answer
To assign an IP address to a firewall interface for routing, the interface must be configured as a Layer 3 interface and associated with a virtual router. The virtual router handles routing decisions, and the IP address is set on the interface. This enables the firewall to route traffic between zones.
Other interface types like Layer 2, Tap, or Virtual Wire do not support IP address assignment for routing.
Exam trap
The trap here is assuming that any interface type can have an IP address; only Layer 3 interfaces support IP address assignment for routing.
What is the purpose of an Aggregate Ethernet (AE) interface?
An Aggregate Ethernet interface bundles multiple physical links into one logical interface, aggregating their throughput and providing link redundancy if a member fails. This satisfies the requirement for both higher bandwidth and resilience, unlike a single physical interface.
Why this answer
AE interfaces provide increased bandwidth and link redundancy by bundling multiple physical ports into a single logical interface.
Which TWO methods are used to troubleshoot GlobalProtect connectivity issues?
Firewall System and GlobalProtect logs record tunnel negotiation, authentication and gateway-selection events, so they pinpoint where connectivity fails. This satisfies the stem's troubleshooting requirement by exposing the actual failure reason, such as certificate rejection or portal unreachable, rather than merely confirming that a client cannot connect.
Why this answer
Troubleshooting often involves checking the client logs and reviewing the firewall's GlobalProtect logs.
A network engineer is configuring policy-based forwarding (PBF) on a Palo Alto Networks firewall. Traffic from the trust zone to any destination must be forwarded out of a specific next-hop based on the source IP address, but only for HTTP and HTTPS traffic. Which configuration element is required to achieve this?
Policy-based forwarding rules in PAN-OS can match on source address and applications. By specifying the source address and applications HTTP and HTTPS, the firewall will forward matching traffic to the designated next-hop. This is the correct way to implement selective forwarding based on both source and application, satisfying the requirement precisely without affecting other traffic.
Why this answer
Policy-based forwarding rules can match on source address and application. To forward only HTTP and HTTPS traffic from a specific source, the PBF policy must include both a source address match and application filters for those applications. This ensures that other traffic from the same source follows the normal routing table.
Exam trap
The trap here is assuming that a static route or a PBF policy without application filters can achieve selective forwarding, when only a PBF policy with the correct match criteria will work.
Which object type is required to enable GlobalProtect access for remote users?
A GlobalProtect Gateway is the object that terminates remote user connections, authenticating clients and assigning them internal IP addresses and security policy. Without a gateway, remote users have no tunnel endpoint, so it is required to enable GlobalProtect access.
You are configuring a BGP peer. The connection stays in 'Active' state. What is the most likely cause?
BGP remains in Active state when the router cannot complete the TCP three-way handshake with its peer. Blocked TCP port 179 or a missing route to the peer address prevents session establishment, so both must be verified.
An engineer is configuring a Palo Alto Networks firewall to participate in a dynamic routing environment. The firewall has two interfaces in the same virtual router: ethernet1/1 (192.168.1.1/24) and ethernet1/2 (10.0.0.1/24). The engineer wants to enable OSPF on both interfaces and ensure that the firewall becomes the designated router (DR) on the 192.168.1.0/24 network. Which configuration is required?
OSPF DR election is based on the highest OSPF priority. By default, priority is 1. Setting a higher priority on ethernet1/1 increases the likelihood that the firewall becomes DR, provided its priority is higher than other routers. If priorities tie, the router with the highest Router ID wins. So setting a higher priority is the direct way to influence DR election.
Why this answer
In OSPF, the DR is elected based on the highest priority. To make the firewall the DR on a specific network, you must set its OSPF priority on that interface to a value higher than any other router on the same network. The default priority is 1, so setting it to a higher number (e.g., 2 or more) ensures the firewall wins the election, assuming other routers have lower priorities.
Exam trap
The trap here is thinking that a higher router ID alone ensures DR status, but priority takes precedence in the election process.
A client is receiving a 'Gateway not reachable' error in GlobalProtect. What is a common troubleshooting step?
GlobalProtect gateway reachability depends on the firewall permitting the portal and gateway traffic, so confirming security policies allow it isolates a policy block from routing or certificate faults. This satisfies the stem's need for a common troubleshooting step when the client reports 'Gateway not reachable'.
Why this answer
Check if the portal/gateway IP is reachable via ping and if the correct security policies allow the GP traffic from the external zone.
A network administrator is configuring a new Palo Alto Networks firewall and needs to set up a default route to the internet. The next-hop IP address is 203.0.113.1, reachable via the ethernet1/1 interface. Which configuration step is required to ensure that the firewall can forward traffic to the internet?
A default route (0.0.0.0/0) in the virtual router directs all traffic without a more specific match to the specified next-hop. Since 203.0.113.1 is the ISP gateway reachable via ethernet1/1, this static route enables the firewall to forward internet-bound traffic. The virtual router must also have an interface in the same subnet as the next-hop, which is typically the case here.
Why this answer
The firewall uses its virtual router to make forwarding decisions. To reach the internet, it needs a default route pointing to the next-hop gateway. Adding a static route with destination 0.0.0.0/0 and the next-hop IP address ensures that all traffic without a more specific route is sent to the ISP.
This is the fundamental step for internet connectivity.
Exam trap
The trap here is confusing routing with NAT or policy-based forwarding; the question asks about forwarding traffic, which is achieved by a default route.
Which TWO components are involved in configuring GlobalProtect?
The Gateway is the GlobalProtect component that terminates client VPN tunnels and enforces security policy, authenticating users and assigning them internal access. It works alongside the portal, which delivers configuration, making the gateway essential to the stem's configuration requirement.
Why this answer
GP requires a Portal for distribution and a Gateway for traffic management.
Which TWO commands are useful for troubleshooting OSPF?
Displaying the OSPF routing information base shows which routes OSPF computed and their paths, letting you verify whether learned routes were installed or rejected. This satisfies the troubleshooting need by distinguishing a routing-table problem from an adjacency or link-state database problem.
Why this answer
The 'show routing protocol ospf neighbor' and 'show routing protocol ospf rib' commands are essential for debugging OSPF neighbors and learned routes.
What is the purpose of a Security Zone?
Security zones group interfaces sharing identical trust levels, enabling policy rules to reference a zone rather than individual interfaces. This satisfies the scenario's requirement for centralised policy control, since traffic between zones is inspected while intra-zone traffic may bypass rules. Palo Alto firewalls apply zone-based rules, simplifying administration as interface counts grow.
Why this answer
Security zones group interfaces to apply consistent security policies, acting as the foundation for the firewall's traffic control.
Which TWO types of failover can be configured in HA?
Path Monitoring uses ICMP pings to tracked destination IP addresses, triggering HA failover when a critical upstream path becomes unreachable even though local interfaces stay up. It satisfies the question's requirement for a distinct failover type alongside link monitoring.
Why this answer
HA failover can be triggered by 'Link Monitoring' (interface status) and 'Path Monitoring' (resource reachability).
Which THREE factors can affect the speed/throughput of a VPN tunnel?
The encryption algorithm affects VPN throughput because stronger ciphers such as AES-256 demand more computation per packet than AES-128 or ChaCha20. On CPU-bound firewalls, algorithm choice directly changes achievable tunnel speed, making it a genuine throughput factor.
Ready to test yourself?
Try a timed practice session using only Pan Os Networking Configuration questions.