PSE-Strata Exam Results

In a Palo Alto Networks Next-Generation Firewall (NGFW), supporting asymmetric routing with redundancy requires specific features to handle traffic that may not follow the same path in both directions.

Active / active high availability (HA): This feature allows two firewalls to operate in tandem, sharing the traffic load. Active/active HA mode is designed to handle asymmetric routing scenarios where traffic might ingress through one firewall and egress through another, ensuring continuity and redundancy.

non-SYN first packet: This feature is crucial for dealing with non-standard traffic patterns where the initial packet may not always be a SYN packet (typical in TCP connections). It allows the firewall to handle and correctly process such packets, which is essential in asymmetric routing scenarios.

WildFire, a cloud-based malware analysis service provided by Palo Alto Networks, supports the analysis of various file types to detect malicious content. Specifically, it supports:

B. 7-Zip: WildFire can analyze compressed files in the 7-Zip format, which is commonly used to distribute malware in compressed archives.

C. Flash: Analysis of Flash files helps in detecting malware that can be embedded in Flash content, which has historically been a common vector for exploits.

D. RPM: WildFire supports the analysis of RPM packages, which are used in various Linux distributions and can be used to distribute malicious software.

The following platform components can identify and protect against malicious email links:

WildFire hybrid cloud solution (A): This solution integrates on-premises and cloud-based threat intelligence to detect and prevent malware, including malicious email links.

WildFire public cloud (B): This component leverages the power of the cloud to provide real-time updates and protection against the latest threats, including those found in email links.

WF-500 (C): This appliance is designed to analyze files and links to detect malware and prevent it from spreading within the network.

These components work together to provide comprehensive protection against email-based threats, ensuring that organizations can identify and block malicious links before they cause harm.

To support asymmetric routing with redundancy in a legacy environment using Palo Alto Networks firewalls, the following two features must be enabled:

Policy-based forwarding (PBF): This feature allows you to direct traffic to a specific interface or next-hop IP address, bypassing the normal routing table. PBF is crucial for managing asymmetric routing scenarios where inbound and outbound traffic might take different paths.

HA active/active: High Availability (HA) active/active configuration enables two firewalls to simultaneously manage traffic, providing redundancy and failover capabilities. This setup is essential for maintaining network availability and performance in environments with asymmetric routing, as it ensures that both firewalls can actively handle traffic.

References:

Palo Alto Networks High Availability (HA) Guide

Palo Alto Networks Policy-Based Forwarding Documentation