A network security engineer needs to ensure that virtual systems can communicate with one another within a Palo Alto Networks firewall. Separate virtual routers (VRs) are created for each virtual system. In addition to confirming security policies, which three configuration details should the engineer focus on to ensure communication between virtual systems? (Choose three.)
Correct Answer: A,D,E
For virtual systems (vSys) on a Palo Alto Networks firewall to communicate with each other, especially when separate virtual routers (VRs) are used for each vSys, the configuration must facilitate proper routing and security policy enforcement. The key aspects to focus on include: A: External zones with the virtual systems added: * External zones are special types of zones that are used to facilitate traffic flow between virtual systems within the same physical firewall. By adding virtual systems to an external zone, you enable them to communicate with each other, effectively bypassing the need for traffic to exit and re-enter the firewall. D: Add a route with next hop next-vr by using the VR configured in the virtual system: * When using separate VRs for each vSys, it's essential to configure inter-VR routing. This is done by adding routes in each VR with the next hop set to 'next-vr', specifying the VR of the destination vSys. This setup enables traffic to be routed from one virtual system's VR to another, facilitating communication between them. E: Ensure the virtual systems are visible to one another: * Visibility between virtual systems is a prerequisite for inter-vSys communication. This involves configuring the virtual systems in a way that they are aware of each other's existence. This is typically managed in the vSys settings, where you can specify which virtual systems can communicate with each other. By focusing on these configuration details, the network security engineer can ensure that the virtual systems can communicate effectively, maintaining the necessary isolation while allowing the required traffic flow.
PCNSE Exam Question 82
Which operation will impact the performance of the management plane?
A firewall architect is attempting to install a new Palo Alto Networks NGFW. The company has previously had issues moving all administrative functions onto a data plane interface to meet the design limitations of the environment. The architect is able to access the device for HTTPS and SSH; however, the NGFW can neither validate licensing nor get updates. Which action taken by the architect will resolve this issue?
Correct Answer: B
When administrative functions (licensing, updates) use a data plane interface, the firewall requires outbound connectivity to Palo Alto Networks servers (e.g., updates.paloaltonetworks.com) via that interface. If HTTPS /SSH work but licensing/updates fail, the issue is likely upstream blocking or misrouting. Validating upstream devices (Option B) ensures ports (e.g., 443) and destinations are accessible, resolving the issue. Option A (service route) is a prerequisite already implied but doesn't fix external issues. Option C (loopback) is unnecessary. Option D (OCSP) relates to certificates, not connectivity. Documentation emphasizes external validation. Reference: PAN-OS 11.2 Administrator's Guide, "Device Management" section - Service Routes and Connectivity Troubleshooting.
PCNSE Exam Question 84
Which three items must be configured to implement application override? (Choose three )
An administrator has configured a pair of firewalls using high availability in Active/Passive mode. Link and Path Monitoring Is enabled with the Failure Condition set to "any." There is one link group configured containing member interfaces ethernet1/1 and ethernet1/2 with a Group Failure Condition set to "all." Which HA state will the Active firewall go into if ethernet1/1 link goes down due to a failure?
