Palo Alto Networks NGFWs use SSL/TLS profiles to secure which two types of connections? (Choose two.)

An SSL/TLS Service Profile on a Palo Alto Networks NGFW is used to configure the server certificate and protocol settings for services where the firewall acts as an SSL/TLS server. This profile is essential for securing management and access services by authenticating the firewall to the connecting client and encrypting the session. The two most prominent services that utilize SSL/TLS Service Profiles are the GlobalProtect Portal, which provides client configurations, and the GlobalProtect Gateway, which terminates the secure VPN tunnels from clients. Both require a configured profile to establish a trusted and encrypted connection.

A. NAT tables: These are networking constructs for translating IP addresses and ports; they are not services or connections secured by SSL/TLS profiles.

B. User Authentication: This is a broad process. While services that perform user authentication (like Captive Portal) use these profiles, GlobalProtect Portal and Gateway are specific, configurable services that directly apply them.

1. Palo Alto Networks PAN-OS® Administrator's Guide 10.2: In the section on security profiles

it states

"An SSL/TLS service profile specifies a server certificate and the SSL/TLS protocol versions that a firewall interface will support when it functions as an SSL/TLS server to secure services such as the GlobalProtect portal

GlobalProtect gateways

Captive Portal

and Prisma Access."

Reference: Palo Alto Networks. (2023). PAN-OS® Administrator's Guide Version 10.2. Objects > Security Profiles > SSL/TLS Service Profile.

2. Palo Alto Networks TechDocs - Configure an SSL/TLS Service Profile: This official documentation page explicitly lists the services that use these profiles. The primary examples provided are for securing firewall management interfaces and remote access solutions.

Reference: Palo Alto Networks TechDocs. (n.d.). Configure an SSL/TLS Service Profile. Retrieved from docs.paloaltonetworks.com. The document states

"You can attach an SSL/TLS service profile to any firewall service that requires a server certificate..." and provides examples including "GlobalProtect portal" and "GlobalProtect gateways".

3. Palo Alto Networks TechDocs - Set Up the GlobalProtect Infrastructure: The configuration steps for both the portal and the gateway explicitly require the administrator to select a pre-configured SSL/TLS Service Profile to assign a server certificate for the service.

Reference: Palo Alto Networks TechDocs. (n.d.). Set Up the GlobalProtect Infrastructure in the Web Interface. Retrieved from docs.paloaltonetworks.com. See steps under "Configure the GlobalProtect Portal" and "Configure a GlobalProtect Gateway

" which both include selecting an SSL/TLS Service Profile.