Palo Alto Networks Firewall Troubleshooting

• Knowledge of network and security concepts

Audience

• Security professionals
• Cybersecurity analysts
• Administrators

Palo Alto Networks is an enterprise cybersecurity platform that provides various types of network and cloud security and endpoint protection. Palo Alto Networks Firewall identifies, controls, and inspects SSL-encrypted traffic and applications.

This instructor-led, live training (online or onsite) is aimed at security professionals who wish to learn how to troubleshoot Palo Alto Networks' next-generation firewalls.

By the end of this training, participants will be able to:

• Understand the architecture of the next-generation firewall.
• Investigate and troubleshoot networking issues using firewall tools.
• Analyze advanced logs to resolve real-life scenarios.

Format of the Course

• Interactive lecture and discussion.
• Lots of exercises and practice.
• Hands-on implementation in a live-lab environment.

Course Customization Options

• To request a customized training for this course, please contact us to arrange.

Introduction

• Overview of Palo Alto Networks' next-generation firewalls

Using Tools and Resources

• Basic troubleshooting methodologies
• Options for information and support
• Using status monitoring tools
• Using maintenance mode

Understanding Flow Logic

• Session flow and app-ID
• Overview of flow logic
• TCP sessions and states
• Tracing packet flow

Packet Captures and Packet-Diagnostics Logs

• Understanding packet capture concepts
• Configuring packet captures
• Using debug-level diagnostic log features
• Interpreting the flow-basic output
• Using hardware assistance and offloading

Host-Inbound and Transit Traffic

• Troubleshooting transit traffic
• Blocking tor
• Troubleshooting host-inbound traffic

Using System Services

• Identifying performance issues
• Using baseline service performance
• Performance troubleshooting use cases
• Using system services daemons
• Gathering more data

Certificate Management and SSL Decryption

• Verify SSL decryption is applied via the certificate chain
• Accessing the site via its IP vs FQDN
• Intermediate CA missing
• Excluding URLs / certificates
• Using client authentication and SSL decryption exclusion
• Working with external factors that complicate SSL decryption

User-ID

• User-ID mapping flow
• Troubleshooting User-ID

GlobalProtect

• Using connection sequence
• Troubleshooting GlobalProtect

Support Escalation and RMAs

• Case management
• Dealing with hardware failure and return merchandise authorizations (RMAs)
• Managing escalation and support events

Summary and Next Steps