:

The default port used by the Terminal Services agent to communicate with a Palo Alto Networks

firewall is 5007. The Terminal Services agent (TS agent) integrates with Microsoft Terminal Services to

associate user information with sessions, enabling User-ID to accurately map user identities to

security policies. Reference: Palo Alto Networks Terminal Services Agent Documentation.

The security policy rule shown in the image is configured to permit traffic from a source zone LAN-

User-Zone to a destination zone Server-Zone. The applications allowed include tftp, ssl, and web-

browsing, and the action is allow. According to Iron Skillet day one configurations, which provide best

practice security profiles for immediate deployment, the relevant security profile group used to

secure internal traffic like this is the Internal profile group.

Iron Skillet provides predefined configuration templates including security profile groups like

Internal, External, and others to quickly secure traffic according to typical deployment scenarios.

Reference:

Palo Alto Networks - Iron Skillet Documentation: https://github.com/PaloAltoNetworks/iron-skillet

:

To fulfill the customer's requirement for log redundancy on logs forwarded from firewalls in a

Panorama HA setup, the following configuration options are necessary:

B . Log redundancy must be enabled per Collector Group: This ensures that logs are redundantly

stored across multiple log collectors within the same collector group.

C . A Collector Group must contain at least two Log Collectors: For log redundancy to work, there

must be at least two log collectors in the collector group so that if one log collector fails, the other

can continue to collect logs.

These configurations ensure that log data is replicated across multiple log collectors, providing

redundancy and resilience in the event of a failure.

Reference:

Palo Alto Networks - Configure Log Forwarding and Redundancy:

https://docs.paloaltonetworks.com/panorama/10-0/panorama-admin/manage-logcollection/configure-log-forwarding-and-redundancy

Palo Alto Networks - Panorama High Availability: https://docs.paloaltonetworks.com/panorama/100/panorama-admin/set-up-panorama/set-up-high-availability

For any cutover event, especially when dealing with network security infrastructure like Palo Alto

Networks firewalls, it is critical to ensure that:

Change Management Requirements (B): This involves verifying that all planned changes have been

approved, documented, and communicated to all relevant stakeholders. The change management

process ensures that any modifications are controlled, predictable, and include a rollback plan in case

of issues. Reference: Palo Alto Networks Best Practices for Change Management Documentation.

Roles and Responsibilities (C): Clearly defined roles and responsibilities ensure that everyone

involved knows their specific tasks during the cutover. This reduces confusion, ensures accountability,

and helps in the smooth execution of the cutover plan. It includes defining who is responsible for

specific tasks, who needs to be notified, and who has the authority to make decisions. Reference:

Palo Alto Networks Operational Best Practices Documentation.

:

Expedition, the migration tool provided by Palo Alto Networks, is installed on an Ubuntu server. The

installation process involves running a script that automatically downloads and installs all necessary

dependencies.

A . On an Ubuntu server, by running an installation script that will automatically download all

dependencies

This method simplifies the installation process by automating the download and configuration of all

required components, ensuring that the installation is straightforward and minimizes the potential

for errors related to missing dependencies.

Reference:

Palo Alto Networks - Expedition Installation Guide: https://live.paloaltonetworks.com/t5/expeditionmigration-tool/ct-p/migration_tool

Palo Alto Networks - Expedition User Guide: https://live.paloaltonetworks.com/t5/expeditiondocumentation/ct-p/migration_tool_docs

:

For a customer who wishes to actively use multiple pathways to the same destination, the

recommended routing configuration is:

B . ECMP (Equal-Cost Multi-Path)

ECMP allows the use of multiple paths to the same destination with equal cost metrics, enabling load

balancing and redundancy. It is suitable for scenarios where multiple pathways are desired for traffic

distribution and fault tolerance.

Reference:

Palo Alto Networks - ECMP Overview: https://docs.paloaltonetworks.com/pan-os/10-0/pan-osnetworking-admin/ecmp

Palo Alto Networks - Configuring ECMP: https://knowledgebase.paloaltonetworks.com