NETSEC AnalystDemo

The Device Health dashboard provides operational health and performance visibility for onboarded NGFWs, including historical health-score trends that help identify and prioritize persistent firewall issues. CVE remediation and security-profile adoption are separate security-posture and feature-adoption concerns, rather than the Device Health dashboard’s trend view.

For the best security, Palo Alto Networks recommends setting Vulnerability Protection actions to reset-both for critical-, high-, and medium-severity events. This terminates the connection at both the client and server ends, blocking the detected exploit attempt.

For destination NAT, Security policy rules match the original, pre-NAT source and destination addresses, but use the post-NAT destination zone. The destination address must therefore be the pre-NAT address rather than the translated internal-server address.

Strata Cloud Manager includes live, inline best-practice checks that continuously validate configurations and provide guidance directly where remediation can occur. Built-In Best Practices in Strata Cloud Manager

show running resource-monitor displays data-plane resource utilization, including CPU statistics, and is the appropriate operational command for an overview of CPU resources consumed by the firewall data plane.

The PAN-OS CVEs capability identifies devices affected by known vulnerabilities using device telemetry and enabled features. After reviewing the applicable CVEs and selecting the impacted devices, Strata Cloud Manager can generate upgrade recommendations that identify an appropriate PAN-OS version and vulnerability-related upgrade information.

A single bi-directional static source NAT policy maps the web server’s private source IP to its public IP and automatically supplies the reciprocal inbound translation from the public destination IP to the private server IP. Palo Alto Networks documents this configuration for public-facing servers.

Classified DoS Protection profiles apply thresholds to each individually classified source, allowing the two offending IP addresses to be limited without applying a combined limit that could affect legitimate sources. For SYN floods, SYN Cookies validate the TCP handshake and drop traffic that fails it, whereas Random Early Drop can randomly discard legitimate traffic. Palo Alto Networks recommends starting with SYN Cookies when fair treatment of legitimate traffic is required.

Disabling Merge with Device Candidate Config prevents Panorama from merging and committing pending local candidate configuration changes together with the pushed configuration. This avoids failures caused by incomplete or invalid local changes.

A Traffic Distribution Profile using Best Available Path steers the specified application over the available link with the best path-quality metrics and fails over to a better path when quality degrades. A Path Quality Profile supplies latency and packet-loss thresholds used to qualify paths, while the Traffic Distribution Profile determines the selection method. Weighted distribution is intended for weighted load sharing rather than selecting the optimal path.

Certificate pinning requires the application to receive the expected server certificate or public key. SSL Forward Proxy decryption substitutes a proxy-generated certificate, so pinned-certificate validation fails. SSL decryption exclusions allow the application to connect without interception and retain the original certificate.

When a URL matches multiple URL categories, Palo Alto Networks enforces the strictest applicable URL Filtering profile action. The action precedence is block, override, continue, alert, then allow. Because Computer-and-Internet-Info is set to block, it takes precedence over the continue, alert, and allow actions assigned to the other matching categories.

Suppressing an irrelevant NGFW alert prevents it from continuing to create unnecessary incident noise when the underlying condition is intentionally not being remediated. Strata Cloud Manager supports suppressing incidents that do not matter to a deployment.

Palo Alto Networks Data Filtering supports File Properties patterns, which match file metadata and associated values, and Regular Expression patterns, which identify custom data patterns. Proximity keywords can refine regular-expression detection, but they are not a separate pattern type.

Session-start logging can generate additional traffic-log entries during application identification and increases management-plane CPU consumption. Logging only at session end produces a single, final session record and consumes fewer resources.

Filtering traffic logs for the malicious IP address returns the traffic sessions involving that indicator. The resulting source and destination fields identify the affected internal hosts and show the volume, timing, and direction of their communications. Palo Alto Networks documentation describes filtering traffic logs by an IP address to obtain a complete picture of hosts that established connections.

Strata Cloud Manager Pro includes AI-Powered Autonomous Digital Experience Management (ADEM), which monitors mobile-user application experience and exposes application experience scores and trends for selected time ranges. Therefore, an average application test score for the specified user over 60 days is the expected application-experience response. Strata Cloud Manager Licenses and View Application Experience for a Specific User describe the Pro entitlement and per-user application experience score trends.

DNS Rewrite is available for an IPv4 destination NAT policy rule only when its destination address translation type is Static IP. Static translation provides the fixed original-to-translated address mapping used to rewrite matching IP addresses in DNS responses.

A matching PBF policy is evaluated before normal routing and directs the packet to the next hop specified by that policy, overriding the routing-table decision for that traffic.