FIREWALL, NETWORK SECURITY and CYBERSECURITY COMPLETE GUIDE 1) FIREWALL – DETAILED DEFINITION Definition: A firewall is a network security device or software system that monitors, filters, and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between trusted internal networks and untrusted external networks, such as the internet, to prevent unauthorized access, data leakage, or attacks. Core Functions: ✔ Packet Filtering – Inspects packets based on IP, port, and protocol. ✔ Stateful Inspection – Tracks connection state and allows legitimate return traffic. ✔ Application Awareness – Controls traffic based on applications (L7). ✔ Intrusion Prevention – Detects and blocks malicious activity (NGFW). ✔ Logging and Reporting – Monitors network traffic, alerts on anomalies. Types: Hardware Firewall: Physical appliance, high throughput, HA support. Software Firewall: OS-based, flexible, low-cost. Virtual Firewall: Runs in virtualized environments (VMs, cloud). Cloud Firewall: Cloud-native, scalable, protects workloads. Host-Based Firewall: Installed on individual endpoints. Real-World Use: Perimeter protection (enterprise networks) Internal segmentation (data center east-west traffic) Endpoint security (host-based protection) Cloud workload security ================================================================================================================ 2) NETWORK SECURITY – DETAILED EXPLANATION Definition: Network security is the practice of protecting the integrity, confidentiality, and availability of computer networks and data while in transit and at rest. It involves both hardware and software technologies to prevent unauthorized access, misuse, modification, or denial of network resources. Key Components: Firewalls – Control traffic between networks based on rules. Intrusion Detection/Prevention Systems (IDS/IPS) – Detect/block attacks in real-time. Virtual Private Networks (VPNs) – Secure remote access and encrypt data in transit. Access Control – Limit network access to authorized users/devices. Network Segmentation – Divide networks to prevent lateral movement. Antivirus / Anti-malware – Detect and prevent malicious code spread. Monitoring and Logging – Continuous visibility into network traffic and anomalies. Goals: Prevent unauthorized access to internal networks. Protect sensitive data and applications. Maintain network availability and performance. Detect and respond to attacks in real-time. Real-World Example: Enterprise networks use firewalls, NGFW, VLANs, and IDS/IPS to protect internal resources and internet-facing servers. 3) CYBERSECURITY – DETAILED EXPLANATION Definition: Cybersecurity is the broader practice of protecting computer systems, networks, software, and data from cyber threats, attacks, and unauthorized access. It encompasses network security, endpoint security, application security, and information security policies. Key Domains: Network Security – Protecting network infrastructure (as above). Endpoint Security – Securing devices like computers, smartphones, and IoT devices. Application Security – Ensuring software applications are safe from vulnerabilities. Data Security – Encryption, backup, and secure storage of sensitive information. Identity and Access Management (IAM) – Ensuring correct access rights. Threat Intelligence and Response – Detecting, analyzing, and mitigating cyber attacks. Security Policies and Compliance – Enforcing regulatory standards and best practices. Goals: Protect digital assets from cyber attacks (malware, ransomware, phishing, APTs). Maintain confidentiality, integrity, and availability (CIA triad). Enable secure operations in digital and connected environments. Real-World Example: Multi-layer defense combining NGFW, endpoint protection, SIEM (Security Information and Event Management), cloud security, and employee awareness training. RELATIONSHIP BETWEEN FIREWALL, NETWORK SECURITY and CYBERSECURITY Firewall → Network-level protection tool. First line of defense for perimeter and internal traffic. Network Security → Practices and technologies to secure networks (firewalls, IDS/IPS, VPNs, segmentation). Cybersecurity → Holistic discipline that includes network security, endpoint protection, application security, data security, and policies. Hierarchy Example: Cybersecurity > Network Security > Firewalls/IDS/IPS 5) SUMMARY Firewall: Device or software controlling traffic based on rules; prevents unauthorized access. Network Security: Protects network infrastructure and traffic from attacks; includes firewalls, IDS/IPS, VPNs, segmentation. Cybersecurity: Comprehensive protection of all digital assets (network, endpoints, applications, data); includes technology, policies, and human factors. Real-world implementation requires layered defense (defense-in-depth), combining firewalls, NGFWs, IDS/IPS, antivirus, encryption, monitoring, and security policies. CYBER THREATS, ATTACKS, SPOOFING and THREAT ACTORS COMPLETE GUIDE 1) TYPES OF CYBER ATTACKS and THREATS Cyber threats are actions or events that attempt to compromise the confidentiality, integrity, or availability (CIA) of digital assets. They can be broadly categorized into: A) MALWARE (Malicious Software) Viruses: Self-replicating programs that attach to files and spread. Worms: Standalone programs that spread across networks automatically. Trojans: Malicious programs disguised as legitimate software. Ransomware: Encrypts victim’s data and demands ransom for decryption. Spyware: Monitors user activity and steals sensitive data. Adware: Displays unwanted ads, sometimes tracking user behavior. Rootkits: Hide presence of malware or unauthorized activity at system/kernel level. Logic Bombs: Trigger malicious activity when certain conditions are met. Fileless Malware: Operates in memory without writing files to disk, evading detection. B) NETWORK ATTACKS Denial of Service (DoS) / Distributed DoS (DDoS): Overwhelm network resources to disrupt services. Man-in-the-Middle (MITM): Intercept communication between two parties. Packet Sniffing: Captures network traffic to steal sensitive information. ARP Spoofing / Poisoning: Manipulates MAC-IP mapping to intercept traffic. DNS Spoofing / Cache Poisoning: Redirects traffic to malicious servers. IP Spoofing: Fakes source IP to bypass filters or launch attacks. Session Hijacking: Takes over an active session to gain unauthorized access. Port Scanning: Probing for open ports and vulnerabilities. C) APPLICATION and WEB ATTACKS SQL Injection: Inserts malicious queries to manipulate databases. Cross-Site Scripting (XSS): Injects scripts into web pages for stealing cookies/session. Cross-Site Request Forgery (CSRF): Tricks user into executing unwanted actions. Directory Traversal: Access files/directories outside web root. Remote Code Execution (RCE): Executes malicious code on server. D) SOCIAL ENGINEERING Phishing: Deceptive emails to steal credentials or spread malware. Spear Phishing: Targeted phishing attack against specific individuals. Vishing: Voice call-based phishing. Smishing: SMS/text-based phishing. Pretexting: Creating a fabricated scenario to extract information. E) ADVANCED THREATS Advanced Persistent Threats (APT): Long-term, targeted attacks by skilled actors. Zero-Day Exploits: Attacks using unpatched vulnerabilities. Insider Threats: Authorized users misusing access intentionally or unintentionally. 2) THREAT ACTORS and TYPES Cyber attacks can be traced to threat actors, which vary in motivation and skill. A) INDIVIDUAL HACKERS Motivation: Curiosity, personal gain, notoriety. Skill Level: Low to high. B) SCRIPT KIDDIES Motivation: Fun, recognition. Skill Level: Low; use pre-written scripts/tools. C) HACKTIVISTS Motivation: Political or social causes. Target: Government, corporations, organizations. Tools: DDoS, website defacement. D) CYBERCRIMINALS Motivation: Financial gain. Target: Banks, online payment systems, e-commerce. Tools: Phishing, ransomware, malware, fraud. E) INSIDERS Motivation: Revenge, negligence, personal gain. Target: Organization’s internal network/data. Types: Malicious insider, negligent insider. F) NATION-STATES / APT GROUPS Motivation: Espionage, intelligence, sabotage. Target: Critical infrastructure, government, defense organizations. Highly skilled and well-funded. G) ORGANIZED CYBERCRIME GROUPS Motivation: Financial or political. Sophisticated attacks targeting multiple sectors simultaneously. 3) SPOOFING TECHNIQUES and TYPES Spoofing involves masquerading as another entity to gain unauthorized access or mislead systems/users. A) IP SPOOFING Faking source IP address in packets. Purpose: Bypass IP-based access control, launch DDoS, hide attacker location. B) MAC SPOOFING Changing network interface MAC address. Purpose: Bypass MAC filtering, evade network controls. C) ARP SPOOFING / POISONING Fakes ARP messages to associate attacker MAC with legitimate IP. Purpose: MITM attacks, intercept traffic, redirect packets. D) DNS SPOOFING / CACHE POISONING Alter DNS responses to redirect users to malicious sites. Purpose: Credential theft, malware distribution. E) Email / Sender Spoofing Fakes sender email address. Purpose: Phishing, social engineering, impersonation. F) Caller ID / Vishing Spoofing Fakes phone numbers. Purpose: Voice phishing, social engineering attacks. G) Website / URL Spoofing Malicious website mimics legitimate site. Purpose: Phishing, stealing credentials. H) SSL / Certificate Spoofing Presents fake digital certificates. Purpose: Decrypt HTTPS traffic, MITM attacks. 4) SUMMARY Cyber threats include malware, network attacks, application attacks, social engineering, and advanced persistent threats. Threat actors range from individual hackers, script kiddies, and insiders to organized cybercrime groups and nation-states. Spoofing is a common technique to impersonate IPs, MACs, ARP, DNS, emails, websites, or even phone numbers. Effective cybersecurity requires multi-layered defense: firewalls, IDS/IPS, endpoint security, monitoring, user training, and threat intelligence. CYBERSECURITY VULNERABILITIES and EXPLOITS COMPLETE GUIDE Vulnerabilities are weaknesses in software, hardware, or processes that can be exploited by attackers. Understanding them is essential for proactive security. 1) VULNERABILITIES – DEFINITION Definition: A vulnerability is a flaw, weakness, or misconfiguration in a system, network, or application that can be exploited to compromise confidentiality, integrity, or availability. Key Points: Can exist in software, hardware, networks, or human processes. Not all vulnerabilities are exploited immediately. Vulnerabilities are assigned CVE identifiers (Common Vulnerabilities and Exposures) for tracking. 2) TYPES OF VULNERABILITIES A) SOFTWARE / APPLICATION VULNERABILITIES Buffer Overflow: Input exceeds memory bounds causing execution of malicious code. SQL Injection: Malicious input manipulates databases. Cross-Site Scripting (XSS): Injecting scripts into web pages. Cross-Site Request Forgery (CSRF): Tricks user into executing unwanted actions. Directory Traversal: Accessing unauthorized files or directories. Remote Code Execution (RCE): Allows attackers to execute code on a remote system. Misconfigurations: Weak default passwords, open ports, unnecessary services. B) OPERATING SYSTEM / NETWORK VULNERABILITIES Open Ports / Unpatched Services: Exposes network to attacks. Weak Encryption Protocols: Vulnerable SSL/TLS configurations. Misconfigured Firewalls / ACLs: Allows unauthorized access. ARP / DNS Spoofing: Exploits network trust relationships. C) HUMAN / PROCESS VULNERABILITIES Social Engineering: Phishing, pretexting, vishing. Poor Security Policies: Weak password policies, lack of access control. Insider Threats: Negligent or malicious employees. 3) EXPLOITS AND ATTACK TYPES A) KNOWN EXPLOITS Exploits targeting previously discovered vulnerabilities. Vendors often release patches to mitigate these. B) ZERO-DAY EXPLOITS Exploits targeting vulnerabilities unknown to the vendor or public. No patch available at the time of attack. High risk and often used in targeted attacks or APTs. C) N-DAY / PATCHED VULNERABILITIES Vulnerabilities with known patches. Exploited only if systems are unpatched or misconfigured. D) PRIVILEGE ESCALATION Exploit allowing user to gain higher permissions. Types: Vertical (gain admin/root), Horizontal (access same level but other accounts). E) DENIAL OF SERVICE (DoS/DDoS) Exploits system/network weaknesses to overwhelm services. Can be network-layer (flooding) or application-layer (HTTP flood). F) MEMORY / HARDWARE EXPLOITS Rowhammer: Bit-flipping in DRAM to gain access. Spectre / Meltdown: CPU speculative execution vulnerabilities. 4) VULNERABILITY CLASSIFICATIONS Local vs Remote: Local requires physical access, remote can be exploited over network. Authentication vs Unauthenticated: Some vulnerabilities require credentials, others don’t. Criticality: Low, Medium, High, Critical – based on CVSS (Common Vulnerability Scoring System). Exposure: Public-facing services are more at risk than internal systems. 5) VULNERABILITY MANAGEMENT Steps: Identify – Asset inventory, scanning, CVE database monitoring. Assess – Risk evaluation, business impact, criticality. Prioritize – Patch high-risk and exploited vulnerabilities first. Mitigate – Apply patches, configurations, access control, compensating controls. Monitor – Continuous vulnerability assessment and security monitoring. Tools: Nessus, OpenVAS, Qualys, Rapid7, Microsoft Baseline Security Analyzer 6) SUMMARY Vulnerabilities: Weaknesses in systems, apps, networks, or human processes. Exploits: Techniques attackers use to leverage vulnerabilities. Zero-Day: High-risk, unpatched, unknown to vendor. N-Day: Known vulnerability, can be mitigated with patches. Critical to implement vulnerability management: scanning, patching, monitoring, and layered defense. HACKERS TYPES and CATEGORIES Hackers can be classified based on their motivation, ethics, and methods. Understanding these types helps in cybersecurity planning and threat assessment. 1) WHITE HAT HACKERS Ethical hackers authorized to test systems for vulnerabilities. Motivation: Improve security, prevent attacks. Activities: Penetration testing, vulnerability assessments, bug bounty programs. Real-world example: Security consultants, Red Teams. 2) BLACK HAT HACKERS Malicious hackers who exploit vulnerabilities for personal gain or damage. Motivation: Financial gain, notoriety, disruption. Activities: Malware deployment, ransomware, data theft, DDoS attacks. Real-world example: Cybercriminal groups targeting banks, e-commerce. 3) GREY HAT HACKERS Hackers who operate in a gray area between ethical and malicious. Motivation: Curiosity, challenge, sometimes profit. Activities: Unauthorized access without permission but may report vulnerabilities afterward. Real-world example: Hackers who find security flaws and notify companies for rewards. 4) SCRIPT KIDDIES Inexperienced hackers using pre-made tools and scripts. Motivation: Fun, reputation, mischief. Activities: Simple attacks like website defacement, DDoS, scanning for open ports. Real-world example: Teenagers trying hacking tools without deep understanding. 5) HACKTIVISTS Hackers motivated by political or social causes. Activities: Website defacement, leaks, DDoS against organizations/governments. Real-world example: Anonymous collective campaigns against corporations/governments. 6) CYBERCRIMINALS Professional attackers motivated by financial gain. Activities: Phishing, ransomware, carding, identity theft. Real-world example: Organized crime groups exploiting banking and online platforms. 7) NATION-STATE / APT HACKERS Highly skilled, funded by government agencies. Motivation: Espionage, sabotage, intelligence gathering. Activities: Target critical infrastructure, sensitive data, long-term infiltration (APT). Real-world example: Groups like APT29 (Russia), APT41 (China). 8) INSIDERS Authorized users who abuse access intentionally or unintentionally. Motivation: Revenge, financial gain, negligence. Activities: Data theft, sabotage, accidental breaches. Real-world example: Disgruntled employees leaking confidential info. 9) RED TEAM and BLUE TEAM Red Team: Authorized ethical hackers simulating attacks to test defenses. Blue Team: Defensive security team monitoring, detecting, and responding to attacks. Real-world example: Enterprise security exercises and penetration testing drills. SUMMARY White Hat → Ethical / authorized Black Hat → Malicious / criminal Grey Hat → Semi-ethical / curious Script Kiddie → Inexperienced / tool-based Hacktivist → Political/social motives Cybercriminal → Financially motivated professional attackers Nation-State → Highly skilled, espionage / sabotage Insider → Internal threats, intentional or accidental Red/Blue Teams → Ethical testing and defense in enterprises ================================================================================================================ FIREWALL vs IDS vs IPS vs NGFW COMPLETE GUIDE Basic Purpose: Control, Detect, and Prevent malicious traffic in a network Used In: Enterprise, ISP, Telecom, Data Centers, Corporate Networks FIREWALL TYPES, GENERATIONS and REAL-WORLD DEPLOYMENT GUIDE Purpose: Comprehensive overview of firewall types, generations, deployment, and vendors in modern networks, including clear explanations. 1) FIREWALL TYPES (DEPLOYMENT BASED) A) HARDWARE FIREWALL Dedicated appliance with ASIC/NP chips for high-speed packet processing. High throughput, HA support, redundant PSU/fans. Used in enterprise, ISP, data centers. Vendors: Palo Alto Networks, Fortinet, Cisco, Check Point, Sophos, Juniper. Ideal for perimeter security, core edge, high-speed links. Provides predictable performance and stability for high-volume traffic. Real-world: Handles millions of concurrent sessions and protects critical network edges. B) SOFTWARE FIREWALL Installed on general-purpose OS (Windows/Linux), runs as a service/daemon. Examples: iptables, nftables, Windows Firewall, pfSense, OPNsense. Flexible, low-cost, good for labs/small setups. Limited hardware acceleration. Useful for protecting individual servers or lab environments without dedicated hardware. Real-world: Often used for endpoint or small office protection and custom network setups. C) VIRTUAL FIREWALL Runs as a VM in VMware, KVM, Hyper-V, or cloud hypervisors. Examples: Palo Alto VM-Series, FortiGate-VM, Cisco FTDv, Check Point CloudGuard. Ideal for virtualized data centers and private clouds. Scalable and same features as hardware firewalls. Offers centralized security in virtual environments without physical appliances. Real-world: Protects east-west traffic in virtualized data centers and multi-tenant environments. D) CLOUD FIREWALL Native cloud security or virtual appliance deployed in public cloud. Examples: AWS Security Groups, Azure Firewall, GCP Cloud Firewall, VM-Series in cloud. Elastic scaling, protects cloud workloads, integrated with cloud routing. Optimized for dynamically changing cloud infrastructures. Real-world: Provides automatic protection for cloud servers, VMs, and container workloads. E) HOST-BASED FIREWALL Installed on individual endpoints (servers/PCs) to protect single device. Examples: Windows Firewall, Linux nftables, endpoint security suites. Complements network firewall with per-device security. Real-world: Protects endpoints from lateral movement and local attacks even if network firewall is bypassed. F) FUNCTION-BASED TYPES NGFW: Next-Gen Firewall (L3-L7, App-ID, IPS, SSL inspection) for advanced threat prevention. WAF: Web Application Firewall (Layer 7 HTTP/HTTPS) protects web apps. UTM: Unified Threat Management combines firewall + IPS + AV + VPN for SMBs. Internal Segmentation Firewall: Micro-segmentation within data centers for east-west traffic. Real-world: Different firewalls used together in layers for defense-in-depth. 2) FIREWALL GENERATIONS Gen 1 – Packet Filtering L3/L4, stateless ACLs, basic IP/port rules. Era: 1980s-early 1990s. Security: Basic; only filters packets, no session awareness. Real-world: Used in simple routers or perimeter filters with minimal performance cost. Gen 2 – Stateful Inspection Tracks sessions and TCP handshakes. L3/L4, session-aware. Era: mid-1990s. Security: Medium; allows return traffic automatically, safer than Gen 1. Real-world: Most enterprise firewalls pre-2010 used this as core technology. Gen 3 – Application / Proxy Firewall L7 inspection, proxies HTTP, FTP, SMTP. Era: late 1990s-early 2000s. Security: High; inspects application data, blocks malicious commands. Real-world: Common in web-facing proxies or secure gateways. Gen 4 – NGFW L3-L7, Application Awareness (App-ID), User-ID, IPS, SSL, AV. Era: 2010+. Security: Very High; modern enterprise standard combining multiple security functions. Real-world: Industry standard today for enterprise perimeter and internal segmentation. Gen 5 – Threat-focused / AI-driven Sandboxing, zero-day protection, machine learning, cloud threat intelligence. Era: Current / cloud era. Security: Advanced Enterprise; focuses on APTs, ransomware, encrypted traffic inspection. Real-world: Used in high-security environments, SOCs, and cloud-native enterprises for next-level threat detection. ================================================================================================================ 3) REAL-WORLD DEPLOYMENT CATEGORIES Small / SMB: UTM appliance: All-in-one firewall + IPS + AV + VPN. Examples: FortiGate small models, Sophos XGS, pfSense appliance. Simplifies management for smaller networks with limited resources. Real-world: Ideal for offices with few users and limited IT staff. Enterprise Perimeter: Hardware NGFW (Gen 4/5). High throughput, HA, SSL inspection. Vendors: Palo Alto PA-Series, FortiGate high-end, Cisco Firepower, Check Point Quantum. Protects corporate network boundaries with advanced threat prevention. Real-world: Protects multiple WAN links, remote sites, and VPN endpoints at large scale. Data Center Internal (East-West): Virtual Firewall or high-speed hardware. Segmentation / micro-segmentation. Examples: VM-Series, CloudGuard, FortiGate VM. Controls internal traffic and prevents lateral movement by attackers. Real-world: Prevents compromise from spreading between virtual machines and application tiers. Cloud Environment: Cloud-native firewall + virtual NGFW. Examples: Azure Firewall, AWS Security Groups, Palo Alto VM-Series. Provides security for cloud workloads and integrates with cloud infrastructure. Real-world: Automatically protects workloads during scaling or migration in cloud environments. Telecom / ISP: Carrier-grade firewall: 100G+ throughput, millions of sessions, CGNAT. Vendors: Fortinet, Palo Alto, Cisco, Juniper. Ensures large-scale, high-speed network security for service providers. Real-world: Protects millions of subscribers and backbone links simultaneously. Home / Lab: Software firewall (pfSense, OPNsense). Simple, flexible, low-cost. Suitable for learning, testing, or home network protection. Real-world: Perfect for training, labs, or home network segmentation and monitoring. 4) QUICK COMPARISON TABLE Type | Physical | Virtual | Cloud | Host | Generation | Typical Vendor Hardware | Yes | No | No | No | Gen4/5 | Palo Alto, Fortinet, Cisco Software | No | Yes | Yes | Yes | Gen2/3 | pfSense, iptables, OPNsense Virtual | No | Yes | Yes | No | Gen4 | VM-Series, FortiGate VM, CloudGuard Cloud | No | Yes | Yes | No | Gen5 | AWS, Azure, GCP Host-based | No | No | No | Yes | Gen2 | Windows Firewall, Linux nftables 5) FINAL SUMMARY Gen 1-2: Stateless / Stateful → basic network protection. Gen 3: Proxy / App-level → deep inspection at application layer. Gen 4: NGFW → standard modern enterprise firewall with multi-layer threat prevention. Gen 5: AI + Cloud + Zero-day → advanced threat-focused security. Deployments: Hardware (high throughput), Virtual (DC/cloud), Cloud-native (elastic), Host-based (endpoint). Vendors: Palo Alto, Fortinet, Cisco, Check Point, Sophos, Juniper. Real-world: Firewalls are chosen based on network scale, required throughput, security needs, and deployment environment. Multi-layer and hybrid approaches (hardware + virtual + cloud) are common in enterprises. TRADITIONAL FIREWALL (FW) Definition A network security device that filters traffic based on rules. Works On: Layer 3 (IP) Layer 4 (Port/Protocol) Main Job: Allow or Block traffic based on: Source IP Destination IP Port number Protocol (TCP/UDP/ICMP) Example Rules: Allow LAN -> Internet HTTP (Port 80) Block Telnet (Port 23) Allow SSH from Admin PC only Capabilities: ✔ Packet filtering ✔ Stateful inspection ✔ NAT ✔ Basic routing Limitations: ✘ Cannot detect application layer attacks ✘ Cannot inspect encrypted traffic deeply ✘ Cannot detect exploit signatures NGFW (Next Generation Firewall) Definition: An advanced firewall that combines traditional firewall + IPS + application awareness + threat prevention. Works On: Layer 3 to Layer 7 (Application Layer) Includes: ✔ Stateful Firewall ✔ Built-in IPS ✔ Application Control (App-ID concept) ✔ User awareness (AD integration) ✔ SSL Inspection ✔ Anti-virus / Anti-malware ✔ Anti-bot protection ✔ URL Filtering ✔ Threat Intelligence Main Difference from Traditional FW: Understands applications (e.g., Facebook, YouTube, WhatsApp) Not just ports (80/443) Example: Can allow HTTPS but block Facebook inside HTTPS. Deployment: Single device replacing: Firewall + IPS + URL filter + AV gateway SANDBOXING and NGFW 1) SANDBOX – DEFINITION Definition: A sandbox is a controlled and isolated environment used to safely execute, observe, and analyze potentially malicious code or files without risking the host system or network. Purpose: Detect unknown or zero-day malware. Analyze behavior of suspicious files, scripts, or executables. Prevent malware from spreading in the network. Key Features: ✔ Isolation – Runs untrusted code in a separate environment. ✔ Observation – Monitors file behavior, network connections, registry changes. ✔ Reporting – Provides alerts or logs for security teams. ✔ Automated Analysis – Some NGFWs and security appliances have automated sandboxing for real-time threat detection. Real-World Example: A suspicious email attachment is sent to the sandbox. It executes in isolation. The firewall analyzes its behavior (file creation, network access). If malicious, the file is blocked before reaching the user. 2) NGFW (NEXT-GENERATION FIREWALL) – WHY IT IS CALLED NGFW Definition: NGFW is an advanced firewall that integrates traditional firewall capabilities with additional security functions like application awareness, user identity awareness, IPS, SSL inspection, and optional sandboxing. Key NGFW Features: ✔ Application Identification (App-ID) – Controls traffic based on application, not just port/protocol. ✔ User Identification (User-ID) – Applies policies based on user or group identity. ✔ Intrusion Prevention System (IPS) – Detects and blocks attacks. ✔ SSL/TLS Inspection – Decrypts and inspects encrypted traffic. ✔ Threat Intelligence – Uses cloud-based threat feeds. ✔ Optional Sandboxing – Analyzes unknown files in isolated environment before delivery. Clarification: NGFW is not called NGFW solely because of sandboxing. Sandboxing is one advanced featureavailable in many NGFWs, mainly for detecting zero-day or unknown threats. NGFW is defined by multi-layer inspection, application awareness, identity-based policies, and integrated threat prevention, with sandboxing being an additional capability in some models. Real-World Example: Palo Alto NGFW can block known malware using signature-based IPS and unknown malware using WildFire sandboxing. The combination of application control, IPS, and optional sandboxing makes it “Next-Generation” compared to traditional firewalls. 3) SUMMARY Sandbox: Isolated environment for safe execution and analysis of suspicious code. NGFW: Advanced firewall with multi-layer threat prevention, App-ID, IPS, SSL inspection, identity awareness. NGFW ≠ called NGFW just because of sandbox; sandboxing is an optional enhancement. Together, NGFW + sandboxing provides defense against known and unknown threats, including zero-day attacks. ================================================================================================================ IDS (Intrusion Detection System) Definition: A system that monitors network traffic and generates alerts when suspicious activity is detected. Working Mode: Passive (Out-of-band) Main Job: Detect attacks and send alerts/logs Does NOT block traffic. Detects: Port scanning SQL injection Malware communication Brute force attempts Exploit signatures Placement: Connected via SPAN / Mirror port Traffic Flow: Internet -> Firewall -> Switch   |   +--> IDS (monitoring only) IDS TRAFFIC MONITORING METHODS (SPAN vs TAP) ✅ IDS can use: SPAN / Mirror Port Network TAP (including Optical TAP) Both are Passive monitoring methods. SPAN / MIRROR PORT Definition: Switch copies traffic from one port/VLAN to another port. Traffic Flow: Internet -> Firewall -> Switch   |   +--> IDS (mirror port) How It Works: Switch duplicates packets Sends copy to IDS port IDS analyzes traffic Advantages: ✔ Easy to configure ✔ No extra hardware needed ✔ Low cost Limitations: ✘ May drop packets under high load ✘ Switch CPU dependent ✘ Can be manipulated if attacker compromises switch ✘ Not 100% accurate in high throughput NETWORK TAP (Traffic Access Point) Definition: A hardware device inserted physically into a network link to copy traffic. Types: Copper TAP Optical TAP (Fiber) Active TAP Passive TAP Traffic Flow (Copper Example): Internet ---- TAP ---- Firewall   |   +--> IDS Traffic Flow (Optical Fiber Example): Device A Optical TAP Device B   TX TX   | |   | +--> IDS RX (B->A copy)   +---------> IDS RX (A->B copy) How Optical TAP Works: Splits light signal Copies TX from Side A Copies TX from Side B Sends both to IDS RX-A and RX-B IDS receives full-duplex visibility IMPORTANT: IDS only RECEIVES. It cannot transmit or block. It is pure sniffing. TAP vs SPAN COMPARISON Feature SPAN Port Network TAP Packet Loss Risk Possible Very Low Accuracy Medium High Hardware Required No Yes Detectable by attacker Yes No (passive) Impact on switch CPU Yes No High-speed reliability Limited Excellent Security integrity Lower Higher WHY OPTICAL TAP IS PREFERRED ✔ 100% packet visibility ✔ No dropped packets ✔ Cannot be hacked (no IP address) ✔ No configuration needed ✔ Works even if switch crashes ✔ Ideal for SOC / Forensics VERY IMPORTANT DIFFERENCE IDS + TAP: Passive Detect only No blocking Safe for production links IPS: Inline Can block If fails, may impact traffic REAL ENTERPRISE DESIGN Internet -> Edge Firewall -> Core Switch -> Internal Network Fiber link between Firewall and Core: Insert Optical TAP Firewall TAP Core   |   +--> IDS / Packet Capture / SIEM FINAL ANSWER YES ✅ Transparent Optical TAP is commonly used with IDS. It: Sniffs TX from both A and B sides Sends copy to IDS Does NOT modify traffic Does NOT block traffic Is completely passive This is the most reliable and professional way to deploy IDS. Advantages: ✔ Deep packet inspection ✔ Detailed logging ✔ Good for SOC monitoring Limitations: ✘ Does NOT stop attacks ✘ Only alerts admin PALO ALTO – VIRTUAL WIRE vs TAP MODE 1) VIRTUAL WIRE (V-WIRE) MODE Definition: Virtual Wire (V-Wire) mode allows the firewall to be inserted transparently between two network devices (like a switch and router) without requiring IP addressing on the firewall interfaces. How It Works: Two interfaces are bound together as a pair. Firewall inspects and controls traffic passing between them. No Layer 3 routing is required. Acts like a transparent bridge but with full security inspection. Key Characteristics: ✔ Transparent deployment (no IP re-addressing needed). ✔ Full security policy enforcement (App-ID, IPS, URL filtering, etc.). ✔ Can block, allow, or inspect traffic. ✔ Supports NAT in some scenarios. ✔ Inline deployment (traffic passes through firewall). Use Case: Adding a firewall to an existing network without redesigning IP addressing. Data center inline inspection. Gradual migration from legacy firewall. Topology: Switch - PA Firewall V-Wire - Router IMPORTANT: Traffic flows THROUGH the firewall. Firewall can block, modify, or inspect traffic. 2) TAP MODE Definition: TAP mode is a passive monitoring mode where the firewall receives a copy of traffic (via SPAN/mirror port or network TAP device) but does not sit inline. How It Works: Connected to a switch mirror (SPAN) port. Firewall receives traffic copy. Does not forward or block traffic. Used only for visibility and analysis. Key Characteristics: ✔ No impact on live traffic. ✔ No inline deployment. ✔ Cannot block or modify traffic. ✔ Used for monitoring, logging, threat visibility. ✔ Ideal for network auditing or detection-only environments. Use Case: Monitoring traffic before full deployment. IDS-style passive visibility. Security audits. Topology: Switch ---- Router     -- PA Firewall in TAP mode IMPORTANT: Traffic does NOT pass through the firewall. Firewall only observes traffic. 3) SIDE-BY-SIDE COMPARISON Feature | Virtual Wire (V-Wire) | TAP Mode Inline? | YES | NO Can Block Traffic? | YES | NO Requires IP Address? | NO (on V-wire ports) | NO Used for Monitoring? | YES | YES Used for Enforcement? | YES | NO Deployment Impact? | Minimal changes | No changes 4) WHEN TO USE WHICH Use V-Wire when: ✔ You want inline security without Layer 3 redesign. ✔ You need to block or control traffic. ✔ You want full NGFW protection. Use TAP when: ✔ You only need visibility. ✔ You want zero risk to production traffic. ✔ You are testing or auditing before enforcement. 5) SIMPLE EXPLANATION Virtual Wire = Inline transparent firewall (can block). TAP Mode = Passive monitoring only (cannot block). SPAN / MIRROR PORT CONFIGURATION GUIDE Used For: IDS / Packet Capture / Traffic Monitoring Works As: Copies traffic from source port/VLAN to destination monitoring port PALO ALTO (PAN-OS) Vendor: Palo Alto Networks Feature Name: Port Mirroring NOTE: Palo Alto firewall is Layer 3 device. Port mirroring works only between its own interfaces. It is NOT like switch SPAN. Usually done via Virtual Wire or Aggregate interface monitoring. METHOD 1: Using Packet Capture (CLI) > debug dataplane packet-diag set capture stage receive file rx.pcap > debug dataplane packet-diag set capture on > debug dataplane packet-diag set filter match source 10.10.10.5 > debug dataplane packet-diag set capture off Download pcap from: Monitor > Logs > Packet Capture (This is temporary capture, not permanent SPAN) METHOD 2: Interface Mirroring (GUI) Network Interfaces Select interface (ethernet1/1 for example) Enable "Interface Management Profile" Use packet capture options For permanent monitoring: Best practice is to mirror traffic from connected SWITCH, not from Palo Alto directly. In real deployments: Switch SPAN -> IDS Firewall remains inline device. CISCO SWITCH (SPAN CONFIG) Feature Name: SPAN (Switched Port Analyzer) BASIC PORT MIRROR Example: Mirror traffic from Gi0/1 to Gi0/24 Switch(config)monitor session 1 source interface gigabitEthernet 0/1 Switch(config)monitor session 1 destination interface gigabitEthernet 0/24 Gi0/1 = Source (traffic to monitor) Gi0/24 = Destination (IDS connected here) MIRROR BOTH DIRECTIONS Switch(config)monitor session 1 source interface gi0/1 both Options: rx -> ingress only tx -> egress only both -> both directions VLAN MIRROR Switch(config)monitor session 1 source vlan 10 Switch(config)monitor session 1 destination interface gi0/24 VIEW CONFIG Switchshow monitor session 1 CISCO ROUTER (LIMITED SUPPORT) Some routers use: IP Traffic Export (NetFlow) Embedded Packet Capture (EPC) Example: Routermonitor capture point ip cef CAP gi0/0 both Routermonitor capture buffer BUF size 1024 Routermonitor capture point associate CAP BUF Routermonitor capture start Routermonitor capture stop HUAWEI SWITCH (PORT MIRRORING) Feature Name: Port Mirroring LOCAL PORT MIRROR Example: Mirror traffic from GE0/0/1 to GE0/0/24 Huawei observe-port 1 interface GigabitEthernet0/0/24 Huawei interface GigabitEthernet0/0/1 Huawei-GigabitEthernet0/0/1 port-mirroring to observe-port 1 both Source = GE0/0/1 Dest = GE0/0/24 VLAN MIRROR Huawei vlan 10 Huawei-vlan10 port-mirroring to observe-port 1 VIEW CONFIG Huawei display port-mirroring SPAN vs TAP DESIGN RECOMMENDATION Small / Medium Network: Use Switch SPAN Large Enterprise / Data Center: Use Optical TAP Why? SPAN: May drop packets Switch CPU dependent TAP: Hardware level copy 100% packet visibility No packet loss IMPORTANT NOTES IDS must be connected to destination mirror port Destination mirror port must NOT be used for normal traffic Do NOT assign IP address to mirror port Mirror port does not forward traffic High traffic = Risk of dropped packets (SPAN) REALISTIC ENTERPRISE DESIGN Internet   | Edge Router   | Firewall (Palo Alto)   | Core Switch   |   +--> SPAN Port ----> IDS OR Firewall = Optical TAP = Core   |   +----> IDS TAP DEPLOYMENT CONFIGURATION GUIDE QUESTION: Do we need configuration on main link interfaces when using TAP? SHORT ANSWER: NO ❌ In 99% of cases, NO configuration change is required. WHY NO CONFIG IS REQUIRED A Network TAP is: ✔ Layer 1 device (Physical layer) ✔ Transparent ✔ No MAC address ✔ No IP address ✔ No configuration ✔ Does not modify packets It simply: Splits electrical signal (Copper TAP) Splits light signal (Optical TAP) Sends copy to monitoring port TRAFFIC FLOW WITH TAP Before TAP: Firewall Core Switch After TAP: Firewall ---- TAP ---- Core Switch   |   +----> IDS IMPORTANT: Firewall and Core Switch still think they are directly connected. No IP change. No VLAN change. No routing change. No speed/duplex change (normally). WHAT MUST MATCH ON MAIN LINK Even with TAP inserted, the following must still match: ✔ Speed (1G / 10G / 40G) ✔ Duplex (Full) ✔ Fiber type (Single-mode / Multi-mode) ✔ Wavelength (1310nm / 1550nm) ✔ Connector type (LC / SC) But this is physical compatibility, NOT configuration change. CONFIGURATION NEEDED WHERE? Only on IDS interface. IDS port must be: ✔ No IP address ✔ No gateway ✔ Promiscuous mode enabled ✔ Receive-only mode (recommended) ✔ Disable TX if supported Example (Linux IDS): ip link set eth1 promisc on ip addr flush dev eth1 ethtool -K eth1 gro off lro off SPECIAL CASE: ACTIVE TAP Active TAP: Has power supply Regenerates signal Used in high-speed fiber (10G+) Still: No configuration on firewall or switch required. VERY IMPORTANT DESIGN NOTE If main link is 10G: IDS must support: 10G monitoring interface OR Aggregated TAP output (if both directions combined) Otherwise: Packets may drop at IDS side. WHEN CONFIG MAY BE REQUIRED Rare Cases: If link was auto-negotiation and TAP forces fixed speed   -> You may need to hardcode speed on both sides. Example (Cisco): Switch(config)interface gi0/1 Switch(config-if)speed 1000 Switch(config-if)duplex full If using VLAN trunk: No change required. TAP copies tagged frames as-is. FINAL ANSWER Normal TAP Deployment: ✔ Insert TAP physically ✔ Connect monitor port to IDS ✔ No configuration on firewall ✔ No configuration on switch ✔ No routing/NAT/VLAN changes TAP is invisible to network. It is pure physical-layer traffic copying. COPPER NETWORK TAP COMPLETE TECHNICAL GUIDE Applies To: 10/100/1000Base-T Ethernet (RJ45 Copper) Purpose: Passively copy traffic between two devices without modifying it. 1) BASIC CONCEPT A Copper TAP is a Layer-1 device inserted between two Ethernet devices. Normal Link: Device A <----> Device B With TAP: Device A <----> TAP <----> Device B | +----> IDS / Analyzer It copies TX from A and TX from B and sends copies to monitoring port(s). 2) ETHERNET PINOUT BASICS RJ45 has 8 pins. 10/100Base-T uses only 4 pins: Pin 1 -> TX+ Pin 2 -> TX- Pin 3 -> RX+ Pin 6 -> RX- 1000Base-T (Gigabit) uses ALL 8 pins (4 twisted pairs, bidirectional). 3) 10/100 COPPER TAP WORKING For 10/100 Mbps, TX and RX are separate pairs. Device A TX (Pins 1,2) ---> Device B RX (Pins 3,6) Device B TX (Pins 1,2) ---> Device A RX (Pins 3,6) A Passive Copper TAP directly connects : A <-> B pairs and electrically bridges the TX lines to send a copy to Monitor port. Simplified Internal Wiring (10/100): A TX+ ----+------> B RX+   |   +----> Monitor RX+ A TX- ----+------> B RX-   |   +----> Monitor RX- Same for other direction. Monitor port is RECEIVE-ONLY. No TX connected back to production link. 4) GIGABIT (1000Base-T) COPPER TAP Gigabit Ethernet uses all 4 pairs simultaneously for transmit and receive with echo cancellation and complex PHY signaling. Simple passive wire-tap does NOT work reliably for 1G. Two types exist: Regeneration TAP (Active TAP) Advanced impedance-matched passive TAP (rare). 5) ACTIVE COPPER TAP (GIGABIT) Inside Active TAP: PHY chip receives signal from Device A, regenerates it, forwards to Device B, and simultaneously copies traffic to Monitor ports. It behaves like : Device A <-> TAP (PHY level) <-> Device B but without MAC learning, switching logic, or IP. Still Layer 1 visibility device. Advantages: Works reliably at 1G, No packet loss, Signal regeneration, Supports long cable runs. 6) MONITOR PORT DESIGN A) Dual Monitor Ports: Port1 -> A to B traffic, Port2 -> B to A traffic. IDS must support dual interfaces or aggregation. B) Aggregated Monitor Port: Both directions combined into single port.  Monitor port speed must handle combined throughput or packets may drop. 7) ELECTRICAL BEHAVIOR Passive TAP (10/100): High impedance bridge, does not load circuit, minimal attenuation. Active TAP (1G): Has power supply, re-clocks and regenerates signal, maintains integrity. 8) FAIL-SAFE BEHAVIOR Good TAP devices provide bypass mode: if power fails, link between A and B stays UP. Low-end active TAP may drop link if power fails. Always check vendor specs. 9) AUTONEGOTIATION BEHAVIOR Passive 10/100 TAP: Autoneg works normally. Gigabit Active TAP: TAP negotiates separately with Device A and Device B. Best practice: hardcode speed/duplex on critical links. 10) SECURITY PROPERTIES Copper TAP has no IP address, cannot be remotely hacked, invisible in ARP, no MAC address (passive type). It cannot inject traffic, modify packets, or block traffic. 11) REAL PHYSICAL CONNECTION EXAMPLE Before: Firewall Core Switch After Installing Copper TAP: Firewall ---- TAP ---- Core Switch | +----> IDS eth1 (Promiscuous Mode) IDS Linux Example: ip link set eth1 promisc on ip addr flush dev eth1 12) LIMITATIONS 10/100 Passive TAP: Cheap, Simple, Not for Gigabit. Gigabit Active TAP: Reliable, Professional, Requires power, More expensive. FINAL SUMMARY Copper TAP works by electrical splitting of TX pairs in 10/100 and by signal regeneration + duplication using PHY chip in 1G. It operates purely at Layer 1, is transparent to the network, and provides full visibility without affecting traffic. ================================================================================================================ IPS (Intrusion Prevention System) Definition: A system that detects and automatically blocks malicious traffic. Working Mode: Inline (In path of traffic) Main Job: Detect + Block attacks Can: Drop malicious packets Reset TCP connection Block attacker IP Prevent exploit execution Placement: Internet -> Firewall -> IPS -> LAN Advantages: ✔ Real-time prevention ✔ Stops zero-day (if signature/behavior known) ✔ Protects servers actively Limitations: ✘ May introduce latency ✘ False positives can block valid traffic WHY SOME STILL USE SEPARATE IDS/IPS Very large enterprise networks Data center east-west traffic monitoring Compliance requirements High throughput requirement Dedicated SOC visibility Performance separation SIMPLE COMPARISON TABLE Feature FW IDS IPS NGFW Block by IP/Port Yes No No Yes Detect attacks No Yes Yes Yes Automatically block No No Yes Yes Deep packet inspection No Yes Yes Yes Application awareness No No No Yes Inline deployment Yes No Yes Yes Passive monitoring No Yes No No INLINE vs PASSIVE Inline: Device is directly in traffic path. If device fails, traffic may stop. Used in IPS and NGFW. Passive: Device receives mirrored traffic. If device fails, traffic continues. Used in IDS. TRAFFIC FLOW EXAMPLES Traditional Setup: Internet -> Firewall -> IPS -> Core Switch -> LAN Modern Setup: Internet -> NGFW -> Core Switch -> LAN FINAL CONCLUSION Traditional Firewall = Only access control IDS = Detect only IPS = Detect + Block NGFW = Firewall + IPS + Application control + Threat protection Today: Most NGFW already include IPS engine. Separate IDS/IPS used in large or high-security environments. FIREWALL ZONES, DMZ and NETWORK SEGMENTATION GUIDE Firewalls use zones to control traffic between different network segments. Zones help enforce security policies and isolate networks. ================================================================================================================ 1) FIREWALL ZONES – DEFINITION Definition: A zone is a logical grouping of interfaces on a firewall. Traffic between zones is controlled using security policies. Zones simplify management and enhance security by segmenting networks based on trust levels. Key Concept: Trust Level: Determines which zones can communicate with each other. Policies: Define allowed traffic (protocols, ports, applications) between zones. Interfaces: Physical or virtual interfaces are assigned to zones. 2) COMMON FIREWALL ZONES A) TRUST / INTERNAL ZONE Represents internal corporate network (LAN, users, servers). High trust level. Policies: Usually can access Internet, DMZ, and internal resources. B) UNTRUST / EXTERNAL ZONE Represents untrusted networks (Internet, public networks). Low trust level. Policies: Strictly controlled, usually limited access to DMZ. C) DMZ (Demilitarized Zone) Semi-trusted network between internal and external networks. Hosts publicly accessible servers (web, email, DNS). Purpose: Expose services to the Internet without exposing internal network. Traffic Control: Internal users can access DMZ; external users only limited access. D) VPN / REMOTE ACCESS ZONE Represents remote users connecting via VPN. Trust level varies depending on authentication. Policies: Can access internal resources securely. E) GUEST / PUBLIC ZONE For guest Wi-Fi or public access. Segregated from internal network. Policies: Internet access only, no access to internal LAN. F) MANAGEMENT / ADMIN ZONE For firewall management interfaces or monitoring systems. Access restricted to administrators only. G) SERVERS / APPLICATION ZONES Internal segmentation within corporate LAN. Example: HR servers, finance servers, database servers in separate zones. Purpose: Limit lateral movement in case of compromise. 3) DMZ – DETAILED EXPLANATION Definition: A DMZ (Demilitarized Zone) is a network segment placed between internal and external networks to host services accessible from untrusted networks while protecting the internal network. Key Points: Provides an additional security layer to isolate internal resources. Services typically hosted: Web servers, email servers, FTP servers, VPN gateways. Firewalls control traffic between external network, DMZ, and internal LAN. Prevents attackers from directly reaching internal network even if DMZ is compromised. Topology Example: Internet -> Firewall -> DMZ -> Internal LAN 4) TRAFFIC FLOW and POLICIES Internal -> External: Typically allowed outbound, inspected, and logged. External -> Internal: Denied by default; only specific services allowed via NAT or firewall rules. External -> DMZ: Allowed for public services (HTTP, HTTPS, SMTP). DMZ -> Internal: Restricted; often only specific ports or protocols allowed. VPN -> Internal: Allowed based on authentication and policy. Guest -> Internal: Denied; internet only. 5) BENEFITS OF ZONING and DMZ ✔ Simplifies security policy management. ✔ Reduces attack surface by isolating networks. ✔ Protects critical internal resources from external threats. ✔ Enables safe hosting of public-facing services. ✔ Supports regulatory compliance and segmentation requirements. 6) REAL-WORLD EXAMPLES Enterprise:   - Internal LAN zone for employees   - DMZ zone for public web/email servers   - Management zone for IT admins   - Guest Wi-Fi zone segregated from LAN ISP / Telco:   - Core network zone, access zone, public services zone (DNS, DHCP) Cloud:   - VPC public subnet as DMZ, private subnet as internal LAN 7) SUMMARY Zones: Logical groupings of firewall interfaces to enforce trust and security policies. DMZ: Semi-trusted network between internal and external networks for public services. Traffic policies control communication between zones. Proper zoning and DMZ deployment enhances defense-in-depth and minimizes lateral movement risks. ================================================================================================================ PAN-OS (Firmware) COMPLETE GUIDE Palo Alto OS Name: PAN-OS (Palo Alto Networks Operating System) Runs on: Hardware Firewalls + VM-Series Manages: Security, Routing, NAT, VPN, App-ID, Content-ID, Threat Prevention PAN-OS VERSION FORMAT Example: 10.2.6-h3 10 -> Major Version 2 -> Minor Release 6 -> Maintenance Release h3 -> Hotfix number Version Types: Major Release -> 9.0, 10.0, 11.0 Minor Release -> 10.1, 10.2 Maintenance -> 10.2.3 Hotfix -> 10.2.3-h2 Recommended Practice: Always use "Preferred" or "Recommended" version from Palo Alto support portal. Avoid installing base .0 versions in production. CHECK CURRENT VERSION show system info show system info | match sw-version show system software status CHECK AVAILABLE UPDATES request system software check Shows available PAN-OS versions from update server. DOWNLOAD PAN-OS VERSION request system software download version 10.2.6 Download only (does not install) INSTALL PAN-OS VERSION request system software install version 10.2.6 After installation reboot required REBOOT DEVICE request restart system COMPLETE UPGRADE PROCESS STEP 1 show system info STEP 2 request system software check STEP 3 request system software download version STEP 4 request system software install version STEP 5 request restart system STEP 6 verify show system info IMPORTANT: Follow upgrade path (example: 9.1 -> 10.0 -> 10.1 -> 10.2) Do NOT skip major upgrade paths. DOWNGRADE PAN-OS request system software install version request restart system Must have previous version already downloaded. CONTENT / DYNAMIC UPDATES Threat Signatures Antivirus Applications (App-ID) WildFire URL Filtering Check updates request content upgrade check Download latest content request content upgrade download latest Install latest content request content upgrade install latest Automatic updates recommended in production LICENSE CHECK show license info Without valid license: No threat updates No URL filtering Limited features FACTORY RESET METHODS Method 1: Maintenance Mode (CLI) debug system maintenance-mode Device reboots Follow on-screen prompts Select: Factory Reset Method 2: Maintenance Mode (Physical) Power off firewall Power on During boot press "m" repeatedly Enter maintenance mode Select Factory Reset Method 3: CLI Factory Reset (Running System) request system private-data-reset Removes: Config Logs User data Keeps PAN-OS installed RESET CONFIG ONLY load config default-config.xml commit OR delete config saved commit VM-SERIES RESET Power off VM Delete disk snapshot Re-deploy OVA image HA UPGRADE BEST PRACTICE In Active/Passive HA: Suspend Passive Upgrade Passive first Reboot Passive Failover Upgrade new Passive Reboot Verify HA sync show high-availability state IMPORTANT UPGRADE NOTES Always backup config before upgrade: scp export configuration from running-config.xml to user@server:/path Check disk space show system disk-space Check compatibility (plugins, GP, SD-WAN) Upgrade content first before major PAN-OS upgrade TROUBLESHOOT UPGRADE show jobs all show system log debug software restart process management-server PALO ALTO USEFUL STABLE LINKS OFFICIAL WEBSITE https://www.paloaltonetworks.com Main vendor website Products, datasheets, solutions, announcements TECHNICAL DOCUMENTATION https://docs.paloaltonetworks.com Official PAN-OS documentation Admin guides, CLI reference, architecture, upgrade guides Version selector inside (URL stays stable) SUPPORT PORTAL https://support.paloaltonetworks.com Software downloads Preferred PAN-OS versions Licenses Support cases CUSTOMER SUPPORT PORTAL https://customer.paloaltonetworks.com Device management Asset registration License activation LIVE COMMUNITY https://live.paloaltonetworks.com Community discussions Troubleshooting examples KB articles Config help SECURITY ADVISORIES https://security.paloaltonetworks.com Vulnerability advisories PAN-OS CVEs Hotfix announcements THREAT VAULT https://threatvault.paloaltonetworks.com App-ID database Threat signatures CVE lookup Malware info COMPATIBILITY MATRIX https://docs.paloaltonetworks.com/compatibility-matrix Upgrade paths VM compatibility Plugin compatibility PAN-OS supported versions END OF LIFE (EOL) https://www.paloaltonetworks.com/services/support/end-of-life-announcements Hardware EOL Software EOL Model lifecycle BEACON TRAINING https://beacon.paloaltonetworks.com Official training PCNSA PCNSE Hands-on labs ENGINEER BOOKMARK PRIORITY https://docs.paloaltonetworks.com https://support.paloaltonetworks.com https://live.paloaltonetworks.com https://security.paloaltonetworks.com https://docs.paloaltonetworks.com/compatibility-matrix QUICK USAGE GUIDE Check recommended PAN-OS version Login -> Support Portal -> Software Updates -> Preferred Release Check upgrade path Open Compatibility Matrix Check CVE or vulnerability Open Security Advisories or Threat Vault Troubleshooting example configs Search in Live Community ================================================================================================================ Basic Concepts ZONES Zones are logical security boundaries. Interfaces are grouped inside zones and traffic is controlled between zones. No traffic flows between zones unless a security policy explicitly allows it. Implicit deny at the bottom blocks unmatched traffic. INTERFACES Interfaces are physical or virtual ports for traffic ingress/egress.  Each Layer3 interface requires an IP, must be attached to a Virtual Router, and assigned to a Zone. Without these, traffic will not flow. VIRTUAL ROUTER (VR) Virtual Routers handle routing decisions. Supports static routes and dynamic routing protocols like OSPF/BGP.  Interfaces must be attached to a VR to forward packets correctly. SECURITY POLICIES Security policies define traffic permission. Rules evaluate source/destination zones, IPs, applications, services, and action (allow/deny).  Rules are processed top-down, first match wins. APP-ID App-ID identifies applications regardless of port or protocol. Enables policies based on applications like YouTube or Facebook even over HTTPS. Traditional firewalls cannot do this. CONTENT-ID Content-ID provides threat prevention including antivirus, anti-spyware, vulnerability protection, URL filtering, and file blocking.  Makes Palo Alto a Next-Generation Firewall (NGFW) rather than simple packet filter. NAT (NETWORK ADDRESS TRANSLATION) NAT translates IP addresses across zones. Source NAT is common to allow private LAN IPs to access the internet. Example: 10.10.10.5 → 192.168.8.200. NAT is processed before security policies in some cases. MANAGEMENT PLANE VS DATA PLANE Management plane handles GUI, CLI, logging, configuration, and reporting. Data plane handles real-time traffic, security policy enforcement, NAT, and App-ID inspection. Separation increases performance and stability. COMMIT CONCEPT Changes are stored in candidate config. Nothing applies until 'commit' is issued. This prevents accidental misconfiguration and allows review before making changes active. IMPLICIT DENY RULE At the bottom of the security rulebase, traffic not matching any rule is dropped. All traffic must be explicitly allowed via a security rule. Default deny ensures security by default. TRAFFIC FLOW Packet processing order: interface/zone identification 2) routing lookup NAT check 4) security policy evaluation 5) App-ID detection Content-ID inspection 7) Forward or drop. Understanding flow is critical for troubleshooting and design. DC, ISP and Enterprise Models DATA CENTER MODELS High throughput, low latency, modular or fixed appliances PA-7000 Series Chassis-based DC firewall, 100G+ interfaces, millions of sessions, used in hyperscale and Tier-1 DCs PA-5200 Series Fixed appliance, 25G-100G ports, mid-high DC performance, enterprise DC core ISP / SERVICE PROVIDER MODELS High session capacity, CGNAT, multi-tenant support PA-5450 Large enterprise edge / ISP, 100G interfaces, advanced DDoS protection, large NAT tables PA-3400 Series Regional ISP POPs, medium SPs, compact high-performance box ENTERPRISE BRANCH and CAMPUS MODELS Small to large office / campus deployments, threat prevention, SD-WAN PA-400 Series Branch office, small form factor, lower throughput, SD-WAN support PA-800 Series Mid-size enterprise, 1G-10G ports, campus edge, threat prevention and URL filtering PA-3200 Series Large enterprise, high throughput, multiple 10G interfaces, supports large user base VIRTUAL and CLOUD MODELS Runs on VMware, Hyper-V, KVM, AWS, Azure, Google Cloud VM-Series Virtual firewall, cloud and lab deployments, same features as hardware models KEY FEATURES ACROSS MODELS App-ID Application-based traffic identification and control User-ID Integrates with Active Directory, policies by users Content-ID Threat prevention, antivirus, URL filtering SSL Decryption Inspect encrypted HTTPS traffic WildFire Cloud-based malware analysis sandbox GlobalProtect Remote access and site-to-site VPN High Availability Active/Passive or Active/Active clustering for redundancy MODEL SELECTION LOGIC Small branch (100 users) -> PA-440 Enterprise HQ (2000 users) -> PA-3220 Large DC core -> PA-7050 ISP Edge -> PA-5450 Choose based on throughput, concurrent sessions, new sessions/sec, SSL load, number of users, required port speed Operational Modes and Placement OPERATIONAL MODES Layer3 Mode (Routed Mode) Each interface acts as a routed interface with an IP address. Traffic is forwarded between zones using routing table in Virtual Router. Most common mode in Enterprise LAN/WAN and DC deployments. Layer2 Mode (Switch Mode) Interfaces act like switch ports. VLANs are created, interfaces assigned to VLANs. Inter-VLAN traffic requires Layer3 interface to route. Common in campus or branch deployments where firewall sits as a switch between VLANs. Virtual Wire (VWire Mode) Transparent mode. Interfaces are bridged together without IP. Traffic passes inline; firewall inspects packets without routing. Used in inline deployment between two network segments (like IDS/IPS placement). Tap Mode Passive monitoring interface. Receives mirrored traffic. Used for traffic analysis, monitoring, or IDS without affecting network flow. Tunnel Mode Logical interfaces for VPNs (IPSec, GRE, or GlobalProtect). Terminate encrypted traffic into the firewall. Often used for remote access, site-to-site, or cloud connectivity. ================================================================================================================ DEPLOYMENT IN DATA CENTER Layer3 Mode -> Core firewall routing between server VLANs, LAN to WAN, high throughput Virtual Wire -> Inline IPS/IDS for traffic inspection between DC core and internet edge Tap Mode -> Traffic monitoring, packet capture for DPI Tunnel Interfaces -> Site-to-site VPN between DCs or cloud DEPLOYMENT IN ISP Layer3 Mode -> ISP edge firewall routing between customer networks and internet Multi-Vsys -> Supports multiple tenants/customers with isolated VRFs Virtual Wire -> Inline DDoS mitigation or DPI/IDS for traffic inspection Tap Mode -> Passive traffic monitoring for SLA, analytics 10G/40G/100G interfaces -> High-speed backbone links, aggregation DEPLOYMENT IN ENTERPRISE Layer3 Mode -> Campus LAN to WAN, DMZ routing Layer2 Mode -> Internal campus VLANs, switch-like deployment Virtual Wire -> Inline threat prevention, IDS/IPS for critical subnets Tap Mode -> Security monitoring and compliance, DPI analysis Tunnel Interfaces -> GlobalProtect VPN for remote users IDS / DPI / IPS PLACEMENT IDS (Intrusion Detection System) -> Typically Tap Mode or VWire in monitoring only. Detects threats, no inline blocking. IPS (Intrusion Prevention System) -> VWire or Layer3 inline. Detects and blocks malicious traffic. DPI (Deep Packet Inspection) -> Core feature in all modes. Inspects application payloads (App-ID, Content-ID) for threats, malware, policy enforcement. SUMMARY Layer3 Mode -> Routed interfaces, most common, DC / ISP / Enterprise WAN-LAN routing Layer2 Mode -> Switch ports, VLAN aggregation in campus/branch Virtual Wire -> Transparent inline firewall, IDS/IPS, DC or enterprise inline protection Tap Mode -> Passive monitoring, IDS, DPI without blocking Tunnel Mode -> VPN termination, remote access, site-to-site High-speed interfaces (10G/40G/100G) are used depending on throughput and placement ================================================================================================================ Palo Alto Interfaces and Connectivity INTERFACE TYPES Layer3 (L3) Interfaces These are routed interfaces. Assign IP addresses, attach to a Virtual Router, and assign a security zone. Used for LAN, WAN, or DMZ connections. Layer2 (L2) Interfaces These act like switch ports. You can create VLANs and assign multiple L2 interfaces to a VLAN. Traffic between VLANs requires Layer3 interfaces for routing. Virtual Wire (VWire) Transparent mode interface. No IP assignment, passes traffic between two connected networks, typically used for inline deployments. Tap Mode Interfaces Passive interfaces used for traffic monitoring or visibility only. Do not forward traffic. Tunnel Interfaces Used for VPNs (IPSec, GRE, or GlobalProtect). Logical interfaces for site-to-site or remote access tunnels. INTERFACE NUMBERING Physical interfaces on most Palo Alto VM / Hardware: ethernet1/1, ethernet1/2, ethernet1/3, … ethernet1/8 (small appliances) Large appliances can have ethernet1/1 to ethernet1/48 or more depending on model. Chassis-based PA-7000 series have modular interfaces with slots and sub-interfaces. Typical numbering usage in labs: ethernet1/1 -> LAN / TRUST zone ethernet1/2 -> WAN / UNTRUST zone ethernet1/3 -> DMZ or server farm ethernet1/4 -> optional management, backup, or HA link Subinterfaces: ethernet1/1.10, ethernet1/1.20 for VLAN tagging TOPOLOGY AND CONNECTIVITY --- Simple LAN-WAN Topology LAN hosts -> ethernet1/1 (TRUST) -> Palo Alto -> ethernet1/2 (UNTRUST) -> Internet / ISP Default route points from ethernet1/2 to ISP gateway Security policies allow TRUST -> UNTRUST traffic, block UNTRUST -> TRUST unless explicitly allowed Enterprise Branch Topology LAN subnet -> ethernet1/1 -> Palo Alto -> WAN/Internet -> ISP Optional DMZ subnet -> ethernet1/3 -> Palo Alto -> PUBLIC servers Optional VPN tunnel -> tunnel.1 interface -> connect remote users or site-to-site Data Center Topology Multiple VLANs / L3 subnets connected via Layer3 interfaces ethernet1/1 -> App VLAN 10 ethernet1/2 -> DB VLAN 20 ethernet1/3 -> WAN / Internet / ISP Security policies control inter-VLAN traffic and outbound connectivity High availability: Active/Passive or Active/Active between two firewalls ISP / Service Provider Edge ethernet1/1 -> LAN / customer side ethernet1/2 -> WAN / ISP backbone Multi-Vsys support for multi-tenant customers Carrier-grade NAT (CGNAT) applied for multiple customers CONNECTIVITY CONCEPTS Each interface belongs to a zone: TRUST, UNTRUST, DMZ Layer3 interfaces must have IP and Virtual Router for routing L2 interfaces connect to VLANs; traffic requires L3 to route between VLANs Virtual Wire interfaces used inline without IP Tunnel interfaces terminate VPN connections Subinterfaces allow multiple VLANs on a single physical port Default route configured on Virtual Router for outbound traffic HA links (control / data) connect firewalls for redundancy QUICK LAB REFERENCE ethernet1/1 -> LAN / TRUST ethernet1/2 -> WAN / UNTRUST ethernet1/3 -> DMZ / Server farm ethernet1/4 -> HA / Backup link ethernet1/1.10 -> VLAN10 (Apps) ethernet1/1.20 -> VLAN20 (Database) tunnel.1 -> Site-to-site VPN All Layer3 interfaces must be assigned to a Virtual Router Security policies govern traffic between zones High-Speed Interfaces and Models 10G INTERFACES Used in medium to large enterprise, DC aggregation, and campus core Typical modules: SFP+ (10G) Models supporting 10G: PA-3220 -> Up to 8x 10G SFP+ ports PA-3250 -> 12x 10G SFP+ ports PA-5280 -> 16x 10G SFP+ ports PA-5200 Series -> 10G or higher options depending on model Usage: LAN/WAN uplinks, DMZ connectivity, high-speed server connectivity 40G INTERFACES Used in data center core, high-throughput aggregation, ISP POPs Typical modules: QSFP+ (40G) Models supporting 40G: PA-5220 -> 40G QSFP+ ports for DC connectivity PA-5260 -> Multiple 40G ports PA-7050 -> Modular chassis supports 40G line cards Usage: Core DC links, ISP peering, aggregation between firewalls or switches 100G INTERFACES Used in hyperscale data centers, ISP backbones, and ultra-high-throughput scenarios Typical modules: QSFP28 (100G) Models supporting 100G: PA-7080 -> Chassis-based firewall, supports 100G line cards PA-7000 Series -> Modular, multiple 100G ports per line card Usage: Core DC edge, ISP edge/firewall, large-scale internet peering INTERFACE TYPES and FORM FACTORS SFP+ -> 10G copper/fiber modules QSFP+ -> 40G fiber modules QSFP28 -> 100G fiber modules Form factor depends on appliance: PA-3200/PA-5200 Series -> Fixed 10G/40G ports PA-7000 Series -> Modular chassis, mix of 10G, 40G, 100G via line cards VM-Series -> Virtual, not limited by physical ports (can simulate high-speed interfaces for lab traffic) USAGE TIPS 10G for large campus or enterprise WAN/LAN uplinks 40G for data center aggregation or ISP POP links 100G for hyperscale DC core and ISP backbones Always match speed with switch uplink and firewall capabilities High-speed interfaces require proper licensing on PA models (check PAN-OS license for throughput) | Speed | Typical Modules | Models Supporting | Usage | ----- | --- | --------- | ----- | 10G | SFP+ | PA-3220, PA-3250, PA-5280, PA-5200 Series | Enterprise LAN/WAN, DMZ | 40G | QSFP+ | PA-5220, PA-5260, PA-7050 | DC core links, ISP aggregation | 100G | QSFP28 | PA-7080, PA-7000 Series | Hyperscale DC, ISP backbone ================================================================================================================ Palo Alto CLI Command Syntax GENERAL STRUCTURE Basic structure of a security policy rule: set rulebase security rules from to source destination application service action Explanation of parts: set rulebase security rules -> CLI command to create or modify a security rule -> Name of the rule (e.g., SSH-ALLOW) from -> Security zone where traffic originates (e.g., TRUST) to -> Security zone where traffic is going (e.g., UNTRUST) source -> Source IP or "any" for all IPs destination -> Destination IP or "any" application -> Application name (App-ID), e.g., ssh, web-browsing, youtube service -> Layer 4 service (port), usually "application-default" to use default port action -> Allow or deny traffic Example: set rulebase security rules SSH-ALLOW from TRUST to UNTRUST source any destination any application ssh service application-default action allow This allows SSH traffic from any host in TRUST zone to UNTRUST zone using App-ID 'ssh' on default port NAT RULE SYNTAX Structure for NAT rules: set rulebase nat rules source-zone destination-zone source-translation interface-address | static-ip Explanation of parts: -> Name of NAT rule (e.g., SNAT-LAN-TO-WAN) source-zone -> Zone where the traffic originates destination-zone -> Zone where traffic is going source-translation -> Type of NAT: dynamic-ip-and-port (source NAT) or static-ip (DNAT) interface-address -> Use firewall interface IP for translation static-ip -> Specific IP to translate to for DNAT Example: Source NAT set rulebase nat rules SNAT-LAN-TO-WAN source-zone TRUST destination-zone UNTRUST source-translation dynamic-ip-and-port interface-address ethernet1/2 Translates LAN hosts to WAN interface IP when going to UNTRUST Example: Destination NAT set rulebase nat rules DNAT-WEB-SERVER source-zone UNTRUST destination-zone UNTRUST destination-translation static-ip 192.168.10.10 interface-address ethernet1/1 Exposes internal web server to external traffic VPN / GLOBALPROTECT Allow SSL VPN traffic using security policy set rulebase security rules GP-ALLOW from UNTRUST to TRUST source any destination any application ssl service application-default action allow Explanation: application ssl -> identifies SSL traffic (used by GlobalProtect) action allow -> permits traffic into TRUST zone LOGGING SYNTAX Enable logging on security rules set rulebase security rules log-start yes log-end yes log-start yes -> logs the start of the session log-end yes -> logs the end of the session Example: set rulebase security rules SSH-ALLOW log-start yes log-end yes Logs all allowed SSH traffic COMMIT Apply all staged configuration changes commit All changes are first stored in candidate config 'commit' makes them active on firewall ================================================================================================================ PA CLI Commands Basic commands 1) PALO ALTO – FIND COMMANDS BY KEYWORD In Palo Alto (PAN-OS CLI), you can search configuration using: > find command keyword Example: > find command keyword interface > find command keyword security-policy > find command keyword route > find command keyword nat This shows matching CLI commands containing that keyword. To search inside CONFIGURATION: > show config running | match Example: > show config running | match trust > show config running | match 192.168.1.1 > show config running | match ssl To search candidate config: > show config candidate | match To search operational output: > show system info | match Example: > show system info | match hostname To filter logs: > show log traffic | match Example: > show log traffic | match 10.1.1.5 Management IP Configs configure set deviceconfig system type static set deviceconfig system ip-address 192.168.1.200 set deviceconfig system netmask 255.255.255.0 set deviceconfig system default-gateway 192.168.1.1 commit exit show interface all show interface management show system info configure physical interfaces configure Enter configuration mode to start making changes set network interface ethernet ethernet1/1 layer3 Change ethernet1/1 to Layer 3 mode set network interface ethernet ethernet1/1 layer3 ip 10.10.10.1/24 Assign LAN gateway IP address set network interface ethernet ethernet1/1 virtual-router default Attach interface to default virtual router set zone TRUST network layer3 ethernet1/1 Add interface to TRUST security zone set network interface ethernet ethernet1/2 layer3 Change ethernet1/2 to Layer 3 mode set network interface ethernet ethernet1/2 layer3 ip 192.168.8.200/24 Assign WAN / upstream IP address set network interface ethernet ethernet1/2 virtual-router default Attach WAN interface to default virtual router set zone UNTRUST network layer3 ethernet1/2 Place interface into UNTRUST security zone set network virtual-router default routing-table ip static-route DEFAULT route 0.0.0.0/0 nexthop ip-address 192.168.8.1 Create default route pointing to upstream gateway set rulebase security rules ALLOW-ALL from TRUST to UNTRUST source any destination any application any service any action allow Allow traffic from LAN to WAN commitApply and activate configuration ================================================================================================================ Palo Alto CLI Configuration Examples PROTOCOLS Control traffic based on Layer 4 protocols like SSH, Telnet, FTP, SMTP, DNS, NTP, RDP, ICMP configure set rulebase security rules SSH-ALLOW from TRUST to UNTRUST source any destination any application ssh service application-default action allow Allow SSH traffic set rulebase security rules TELNET-DENY from TRUST to UNTRUST source any destination any application telnet service application-default action deny Block Telnet set rulebase security rules FTP-ALLOW from TRUST to UNTRUST source any destination any application ftp service application-default action allow Allow FTP traffic set rulebase security rules SMTP-ALLOW from TRUST to UNTRUST source any destination any application smtp service application-default action allow Allow Email SMTP set rulebase security rules DNS-ALLOW from TRUST to UNTRUST source any destination any application dns service application-default action allow Allow DNS set rulebase security rules NTP-ALLOW from TRUST to UNTRUST source any destination any application ntp service application-default action allow Allow NTP for time sync set rulebase security rules RDP-ALLOW from TRUST to UNTRUST source any destination any application rdp service application-default action allow Allow Remote Desktop set rulebase security rules PING-ALLOW from TRUST to UNTRUST source any destination any application ping service application-default action allow Allow ICMP Ping commit WEB APPLICATIONS Control traffic based on applications using App-ID (not just ports) configure set rulebase security rules WEB-ALLOW from TRUST to UNTRUST source any destination any application web-browsing service application-default action allow Allow HTTP/HTTPS set rulebase security rules BLOCK-FACEBOOK from TRUST to UNTRUST source any destination any application facebook service application-default action deny Block Facebook set rulebase security rules BLOCK-YOUTUBE from TRUST to UNTRUST source any destination any application youtube service application-default action deny Block YouTube set rulebase security rules BLOCK-WHATSAPP from TRUST to UNTRUST source any destination any application whatsapp service application-default action deny Block WhatsApp set rulebase security rules BLOCK-ZOOM from TRUST to UNTRUST source any destination any application zoom service application-default action deny Block Zoom set rulebase security rules BLOCK-SKYPE from TRUST to UNTRUST source any destination any application skype service application-default action deny Block Skype set rulebase security rules BLOCK-BITTORRENT from TRUST to UNTRUST source any destination any application bittorrent service application-default action deny Block P2P torrents commit NAT EXAMPLES Configure source NAT for internet access and destination NAT for internal servers configure set rulebase nat rules SNAT-LAN-TO-WAN source-zone TRUST destination-zone UNTRUST source-translation dynamic-ip-and-port interface-address ethernet1/2 Source NAT for LAN to WAN set rulebase nat rules DNAT-WEB-SERVER source-zone UNTRUST destination-zone UNTRUST destination-translation static-ip 192.168.10.10 interface-address ethernet1/1 DNAT for internal web server commit VPN / GLOBALPROTECT Allow SSL VPN traffic for remote users configure set rulebase security rules GP-ALLOW from UNTRUST to TRUST source any destination any application ssl service application-default action allow Allow GlobalProtect VPN SSL traffic commit LOGGING EXAMPLES Enable logging to monitor traffic and troubleshoot configure set rulebase security rules SSH-ALLOW log-start yes log-end yes Log SSH allow rule set rulebase security rules WEB-ALLOW log-start yes log-end yes Log web allow rule set rulebase security rules BLOCK-FACEBOOK log-start yes log-end yes Log Facebook block rule commit EXPLANATION Protocols: Use App-ID for Layer 4 control; can allow/deny common protocols like SSH, FTP, Telnet, SMTP, DNS, NTP, RDP, ICMP Web applications: App-ID identifies apps like YouTube, Facebook, Zoom even over HTTPS; allows granular control NAT: Source NAT translates LAN IPs to WAN IP for internet; Destination NAT exposes internal servers to external users VPN: GlobalProtect rules allow SSL VPN users to reach internal network securely Logging: Always enable logging on key rules for monitoring, troubleshooting, and auditing Commit: All configuration changes are staged first; 'commit' makes them active on firewall ================================================================================================================ Basic Commands Ping > ping host > ping host 192.168.8.180 > ping source host hostname set deviceconfig system hostname Show Commands SYSTEM INFORMATION show system info displays system information (model, serial, PAN-OS version, uptime) show system statistics displays CPU and memory usage show system disk-space shows disk usage details show clock displays current system date and time show jobs all shows all running and completed jobs show system software status shows software update status INTERFACES show interface all displays all interfaces and status show interface ethernet1/1 shows specific interface details show interface management shows management interface info show arp all displays ARP table show mac all shows MAC address table (Layer2 mode) ROUTING show routing route displays routing table show routing protocol bgp summary shows BGP neighbor summary show routing protocol ospf neighbor shows OSPF neighbors show routing protocol rip shows RIP status show routing fib shows forwarding table (FIB) SESSION TABLE show session all displays all active sessions show session id displays specific session details show session info shows session statistics show session summary displays session count summary SECURITY POLICIES show running security-policy shows active security rules show running nat-policy shows NAT rules show rule-hit-count vsys vsys1 shows how many times rules were matched show running pbf-policy shows policy-based forwarding rules VPN / TUNNEL show vpn ike-sa shows IKE phase1 security associations show vpn ipsec-sa shows IPsec phase2 SAs show interface tunnel.1 shows tunnel interface details show global-protect-gateway current-user displays connected GP users USER-ID show user ip-user-mapping all shows IP-to-user mappings show user group list shows user groups show user server-monitor state shows AD/LDAP server status LOGS show log system shows system logs show log traffic shows traffic logs show log threat shows threat logs show log url shows URL filtering logs show log config shows configuration logs HIGH AVAILABILITY (HA) show high-availability state shows HA status show high-availability interface shows HA interfaces show high-availability all shows full HA details LICENSE and CONTENT show license info shows installed licenses show system info | match serial displays serial number show system info | match cp shows content version ZONES and VIRTUAL ROUTERS show zone all displays all configured zones show virtual-router all shows virtual routers show vlan all shows VLAN configuration show vwire all shows virtual wire configuration CLEAR COMMANDS SESSIONS clear session all clears all sessions (careful in production) clear session id clears specific session clear session source clears sessions from source IP clear session destination clears sessions to destination IP ARP / MAC clear arp all clears ARP table clear mac all clears MAC table (Layer2 mode) ROUTING clear routing route clears specific route clear routing fib clears forwarding table cache clear routing protocol bgp peer soft reset BGP session VPN clear vpn ike-sa clears all IKE phase1 SAs clear vpn ipsec-sa clears all IPsec phase2 SAs clear vpn flow clears VPN flow sessions USER-ID clear user-cache all clears user mappings clear user-cache ip clears specific IP-user mapping LOGS clear log traffic clears traffic logs (rarely used) clear log threat clears threat logs DEBUG COMMANDS FLOW DEBUG debug dataplane packet-diag set filter match source debug dataplane packet-diag set filter match destination debug dataplane packet-diag set capture stage receive file rx.pcap debug dataplane packet-diag set capture stage transmit file tx.pcap debug dataplane packet-diag set capture on debug dataplane packet-diag set capture off APPLICATION DEBUG debug application ssl debug SSL sessions debug software restart process sslmgr restart SSL manager ROUTING DEBUG debug routing protocol bgp on enables BGP debug debug routing protocol ospf on enables OSPF debug debug routing protocol bgp off disables debug GLOBAL DEBUG debug software restart process management-server debug software restart process flow debug dataplane restart restarts dataplane (impact traffic) TEST COMMANDS CONNECTIVITY TEST ping source host traceroute source host POLICY TEST test security-policy-match from TRUST to UNTRUST source destination protocol 6 destination-port 443 test nat-policy-match from TRUST to UNTRUST source destination USER-ID TEST test user-id refresh group-mapping all test user-id authentication authentication-profile username password DNS / URL TEST test dns-proxy host test url ROUTING TEST test routing fib-lookup virtual-router default ip COMMIT and CONFIG MODE ENTER CONFIG MODE configure enters configuration mode set network interface ethernet1/1 layer3 ip 192.168.1.1/24 set zone TRUST network layer3 ethernet1/1 set network virtual-router default interface ethernet1/1 set network virtual-router default routing-table ip static-route default-route destination 0.0.0.0/0 nexthop ip-address SECURITY POLICY set rulebase security rules Allow-Internet from TRUST to UNTRUST source any destination any application any service application-default action allow NAT POLICY set rulebase nat rules SNAT from TRUST to UNTRUST source any destination any service any source-translation dynamic-ip-and-port interface-address interface ethernet1/2 COMMIT commit commits configuration commit force forces commit commit partial partial commit exit exits config mode FULL TROUBLESHOOTING FLOW STEP 1 -> CHECK INTERFACE show interface all show interface ethernet1/1 STEP 2 -> CHECK IP and ROUTING show routing route test routing fib-lookup virtual-router default ip STEP 3 -> CHECK SESSION show session all filter source clear session source (if needed) STEP 4 -> CHECK POLICY MATCH test security-policy-match from to source destination protocol 6 destination-port 443 show rule-hit-count vsys vsys1 STEP 5 -> CHECK NAT test nat-policy-match from TRUST to UNTRUST source destination STEP 6 -> CHECK LOGS show log traffic show log threat show log system STEP 7 -> CHECK VPN (IF USED) show vpn ike-sa show vpn ipsec-sa STEP 8 -> PACKET CAPTURE (ADVANCED) debug dataplane packet-diag set filter match source debug dataplane packet-diag set capture on STEP 9 -> CHECK HA (IF CLUSTERED) show high-availability state STEP 10 -> VERIFY LICENSE / CONTENT show license info show system info | match app-version