The Palo Alto Networks Network Security Professional (NetSec-Pro)

When using AWS centralized deployments for Cloud NGFW, the service deploys NGFW instances into selected VPCs as additional workloads to secure that traffic.

“In centralized deployments, Cloud NGFW instances are deployed as security appliances within the selected VPCs, ensuring consistent traffic inspection and protection.”

(Source: Cloud NGFW Deployment Models)

This approach minimizes complexity and ensures direct security policy enforcement within AWS.

Heartbeat polling is a core HA function to monitor connectivity between HA peers, leveraging ICMP pings to determine link health and availability.

“Heartbeat Polling uses ICMP pings to verify the connectivity and health of the HA peers. If heartbeat polling fails, the firewall considers the peer to be down and may initiate failover.”

(Source: HA Link and Path Monitoring)

If ICMP pings fail, checking heartbeat polling logs helps identify if link or path monitoring triggers the failover.

CASB integration should focus on comprehensive data protection, which includes encryption for data-at-rest and in transit , frequent key updates , and using strong encryption algorithms to ensure confidentiality and data integrity.

“CASB solutions should enforce encryption for data-at-rest and in transit, implement key rotation policies, and leverage robust encryption algorithms to protect sensitive SaaS application data.”

(Source: CASB Deployment Best Practices)

Advanced WildFire supports direct integrations into third-party security tools through the WildFire API , enabling automated threat intelligence sharing and real-time verdict dissemination.

“WildFire exposes a RESTful API that third-party applications can leverage to integrate WildFire’s analysis results and threat intelligence seamlessly into their own security workflows.”

(Source: WildFire API Guide)

The API provides:

Verdict retrieval

Sample submission

Report retrieval

“Use the WildFire API to submit samples, retrieve verdicts, and obtain detailed analysis reports for integration with your existing security infrastructure.”

(Source: WildFire API Use Cases)

Palo Alto Networks manages Prisma Access cloud infrastructure operations, including service upgrades and cloud-delivered updates. Administrators are responsible for managing endpoint software such as GlobalProtect client upgrades .

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.

“The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.”

(Source: Configure DNS Security)

Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.

Protecting against malicious and misconfigured domains requires two critical services:

Advanced Threat Prevention

Provides signature-based and advanced analysis to identify threats, including DNS-based attacks.

“Advanced Threat Prevention enables the NGFW to detect and prevent exploits and malware-based communications, including those leveraging DNS.”

(Source: Advanced Threat Prevention)

Advanced DNS Security

Specifically designed to detect and sinkhole malicious and misconfigured DNS queries.

“DNS Security uses real-time intelligence to block DNS-based threats, protect against data exfiltration, and automatically sinkhole suspicious domain lookups.”

(Source: DNS Security)

By combining these services in security policies, NGFWs ensure robust protection against domain-based threats and misconfigurations.

Dynamic analysis in WildFire refers to executing unknown files in a controlled environment (sandbox) to observe their real-world behavior. This allows the firewall to detect zero-day threats and advanced malware by directly analyzing the file’s impact on a system.

“WildFire dynamic analysis detonates unknown files in a secure sandbox environment, analyzing real-world effects, behaviors, and potential malicious activity.”

(Source: WildFire Analysis)

Applications and threats

Panorama can push application and threat signature updates to managed firewalls, ensuring consistent application and threat visibility.

“Panorama uses dynamic updates to distribute the latest application and threat signature packs to all managed firewalls.”

(Source: Manage Content Updates in Panorama)

WildFire

Panorama also distributes WildFire signature updates to firewalls for real-time malware detection.

“WildFire updates provide the latest malware signatures to enhance detection and prevention, and can be deployed to all managed firewalls via Panorama.”

(Source: WildFire and Dynamic Updates)