The Palo Alto Networks Network Security Professional (NetSec-Pro)

To fully manage a firewall from Strata Cloud Manager (SCM), it’s essential to establish trust and ensure reliable connectivity:

Configure NTP and DNS servers

The firewall must have accurate time (NTP) and name resolution (DNS) to securely communicate with SCM and related cloud services.

“To ensure successful management, configure the firewall’s NTP and DNS settings to synchronize time and resolve domain names such as stratacloudmanager.paloaltonetworks.com.”

(Source: SCM Onboarding Requirements)

Install a device certificate

A device certificate authenticates the firewall’s identity when connecting to SCM.

“The device certificate authenticates the firewall to Palo Alto Networks cloud services, including SCM. It’s a fundamental requirement to establish secure connectivity.”

(Source: Device Certificates)

These steps ensure trust, secure communication , and successful onboarding into SCM.

The Strata Logging Service offers scalable log storage to accommodate data growth, which ensures organizations can retain logs for compliance and threat hunting as their environments expand.

“The Strata Logging Service is designed to scale dynamically to accommodate growing log retention needs, allowing enterprises to maintain comprehensive visibility as they expand their network footprint.”

(Source: Strata Logging Service Overview)

When using AWS centralized deployments for Cloud NGFW, the service deploys NGFW instances into selected VPCs as additional workloads to secure that traffic.

“In centralized deployments, Cloud NGFW instances are deployed as security appliances within the selected VPCs, ensuring consistent traffic inspection and protection.”

(Source: Cloud NGFW Deployment Models)

This approach minimizes complexity and ensures direct security policy enforcement within AWS.

The best practice for Prisma Access data plane upgrades involves backing up configurations, scheduling upgrades during off-peak hours, and using a phased approach to minimize disruption and maintain continuity. As per the Palo Alto Networks documentation:

“To minimize disruptions, it is recommended to perform Prisma Access upgrades during non-business hours and in a phased manner, starting with less critical sites to validate the process before moving to critical locations. Backup configurations and validate the system’s readiness to avoid data loss and maintain service continuity.”

(Source: Prisma Access Best Practices)

To connect a remote network to Prisma Access via Strata Cloud Manager (SCM), the remote network requires an IPSec termination node . This acts as the VPN endpoint, ensuring secure connectivity between branch locations and Prisma Access.

“To onboard a remote network, configure the IPSec termination node on the customer’s premises. This VPN endpoint establishes the secure tunnel to Prisma Access for traffic backhauling.”

(Source: Onboard Remote Networks)

Key takeaway:

The IPSec termination node is fundamental for secure, encrypted connectivity.

Applications and threats

Panorama can push application and threat signature updates to managed firewalls, ensuring consistent application and threat visibility.

“Panorama uses dynamic updates to distribute the latest application and threat signature packs to all managed firewalls.”

(Source: Manage Content Updates in Panorama)

WildFire

Panorama also distributes WildFire signature updates to firewalls for real-time malware detection.

“WildFire updates provide the latest malware signatures to enhance detection and prevention, and can be deployed to all managed firewalls via Panorama.”

(Source: WildFire and Dynamic Updates)

Dynamic path selection is the foundation of SD-WAN, leveraging real-time performance data to dynamically route traffic over the best available path.

“Dynamic path selection continuously monitors performance metrics (loss, latency, jitter) and makes real-time routing decisions to ensure application SLAs are met across the WAN.”

(Source: Prisma SD-WAN Dynamic Path Selection)

Establishing dynamic path selection first ensures the rest of the SD-WAN optimizations (e.g., failover, QoS) work effectively.

Enterprise DLP uses cloud analysis to inspect and classify sensitive data in non-file-based formats (e.g., in-line data streams, SaaS communications).

“Enterprise DLP inspects data in non-file-based traffic flows, forwarding suspicious data patterns to the cloud for classification and verdicts.”

(Source: Enterprise DLP Overview)

The other services focus on file-based scanning (WildFire), URL access control (Advanced URL Filtering), or inline SaaS application controls (SaaS Security Inline).

Blocking non-compliant SSH versions and failing certificate validations are fundamental security measures:

Block sessions when certificate validation fails

“The SSH Proxy profile should block sessions that fail certificate validation to ensure that only trusted hosts are allowed.”

(Source: SSH Proxy Decryption Best Practices)

Block connections using non-compliant SSH versions

Older SSH versions may have vulnerabilities or lack modern encryption algorithms.

“To enforce stronger security, block SSH sessions that use older or deprecated versions of the SSH protocol that do not comply with your security posture.”

(Source: SSH Decryption and Best Practices)

Together, these measures minimize the risk of MITM attacks and secure SSH traffic.