Palo Alto PCNSE - Network Security Engineer - Advanced PAN-OS HA Panorama Decryption Routing Troubleshooting

For stateful failover where TCP sessions survive the transition, Active/Passive HA with Session Synchronization is required. Configuration requirements: (1) HA1 link — control plane synchronization (heartbeat, HA state, routing, configuration sync), (2) HA2 link — data plane session synchronization (forwards active session table, connection tracking to standby firewall), (3) Both firewalls must be the same model and run the same PAN-OS version. With session sync enabled, the standby firewall maintains a copy of the session table and takes over seamlessly during failover. Without session sync (Option C), failover works but active sessions are dropped. Active/Active HA (Option B) provides load sharing but is more complex and doesn't provide the same seamless session continuity as Active/Passive for most deployments.

Comprehensive DNS threat protection in PAN-OS uses: (1) Anti-Spyware Profile > DNS Security — inspects DNS queries against Palo Alto's DNS Security intelligence, detecting: DNS tunneling (unusually long or encoded DNS queries), C2 communications via DNS (known malware C2 domains), DGA (Domain Generation Algorithm) domains, and malicious domains. (2) DNS Sinkholing — when a malicious domain DNS query is detected, instead of blocking the query (which the attacker might notice), the firewall returns a sinkhole IP address. When the infected host attempts to connect to the sinkhole IP, the firewall can identify and alert on the compromised host's outbound connection, providing visibility into infected endpoints. This combination provides both prevention and detection/remediation capabilities.

PAN-OS QoS requires two components: (1) QoS Profile (Network > QoS > QoS Profiles) — defines traffic classes (priority queues) with guaranteed bandwidth, burst, and maximum bandwidth settings. For example, Class 1 could have highest priority for VoIP, Class 4 for general web traffic. (2) QoS Policy (Policies > QoS) — match criteria rules (source zone/IP, destination zone/IP, application, service) that classify traffic into QoS classes defined in the QoS Profile. VoIP applications would be matched and assigned to the highest-priority class. Additionally, QoS must be enabled on the specific network interface where you want to enforce it. Without both components, QoS doesn't function. DoS Protection and Security Profiles are separate features.

Many organizations and PAN-OS default configurations include financial and banking sites in the SSL Decryption Exclusion list to avoid interfering with certificate pinning, mutual TLS, or regulatory requirements. If the URL category "financial-services" (or the specific domain) is in the Decryption Exclusion list, the firewall bypasses SSL inspection for those sites — traffic passes without decryption. If the site IS being decrypted but failing, Option A (certificate pinning/HSTS) is the cause — some banking applications validate the certificate chain and reject the firewall's re-signed certificate. The correct remediation depends on the cause: if in exclusion list and correctly excluded, it's working as designed. If pinning causes issues, add to exclusion list. Expired CA (B) would break ALL sites, not just one.

This is a critical PAN-OS exam concept: Security Policies are evaluated using PRE-NAT addresses. When a packet arrives destined for 203.0.113.50, the Security Policy sees destination 203.0.113.50 (before NAT translation occurs). The NAT rule translates the destination to 172.16.0.10 AFTER the Security Policy check. Therefore: the Security Policy rule must reference the original destination IP (203.0.113.50), the NAT rule translates to 172.16.0.10, and traffic flows to the internal server. If you write the Security Policy with destination 172.16.0.10 (post-NAT), the rule will never match — the firewall never sees 172.16.0.10 as the destination during security evaluation. This applies to both DNAT scenarios and SNAT doesn't change the destination evaluation.