Software next-generation firewall (NGFW) credits can be used to provision migrating NGFWs from

hardware to VMs. Software NGFW credits are a flexible licensing model that allows customers to

purchase and consume software NGFWs as needed, without having to specify the platform or

deployment model upfront. Customers can use software NGFW credits to migrate their existing

hardware NGFWs to VM-Series firewalls on any supported cloud or virtualization platform, or to

deploy new VM-Series firewalls as their needs grow. Software NGFW credits cannot be used to

provision remote browser isolation, virtual Panorama appliances, or enablement of DNS security, as

those are separate solutions that require different licenses or subscriptions. Reference: Palo Alto

Networks Certified Software Firewall Engineer (PCSFE), [Software NGFW Credits Datasheet],

[Software NGFW Credits FAQ]

Using the management interface as the HA1 backup link helps avoid split brain in active-passive high

availability (HA) pair deployment. High availability (HA) is a feature that provides redundancy and

failover protection for firewalls in case of hardware or software failure. Active-passive HA is a mode

of HA that consists of two firewalls in a pair, where one firewall is active and handles all traffic, while

the other firewall is passive and acts as a backup. Split brain is a condition that occurs when both

firewalls in an HA pair assume the active role and start processing traffic independently, resulting in

traffic duplication, policy inconsistency, or session disruption. Split brain can be caused by network

failures, device failures, or configuration errors that prevent the firewalls from communicating their

HA status and synchronizing their configurations and sessions. Using the management interface as

the HA1 backup link helps avoid split brain in active-passive HA pair deployment. The HA1 interface

is used for exchanging HA state information and configuration synchronization between the firewalls.

Using the management interface as the HA1 backup link provides redundancy and failover protection

for the HA1 interface, ensuring that the firewalls can maintain their HA communication and avoid

split brain. Using a standard traffic interface as the HA2 backup, enabling preemption on both

firewalls in the HA pair, or using a standard traffic interface as the HA3 link do not help avoid split

brain in active-passive HA pair deployment, but they are related features that can enhance

performance and reliability. Reference: Palo Alto Networks Certified Software Firewall Engineer

(PCSFE), [High Availability Overview], [Configure HA Backup Links], [Configure Heartbeat Backup]

To deploy a VM-Series firewall on NSX, you need to enable communication between Panorama and

the NSX Manager. This allows Panorama to receive information about the virtual machines and

services in the NSX environment. You also need to register the VM-Series firewall as a service on the

NSX Manager. This allows NSX to redirect traffic to the VM-Series firewall for inspection3.

Reference: VM-Series Deployment Guide for VMware NSX

CN-Series firewalls are licensed by data-plane vCPU. Data-plane vCPU is the number of virtual CPUs

assigned to the data plane of the CN-Series firewall instance. The data plane is the part of the CN-

Series firewall that processes network traffic and applies security policies. CN-Series firewalls are

licensed by data-plane vCPU, which determines the performance and capacity of the CN-Series

firewall instance, such as throughput, sessions, policies, rules, and features. CN-Series firewalls are

not licensed by service-plane vCPU, management-plane vCPU, or control-plane vCPU, as those are

not factors that affect the licensing cost or consumption of CN-Series firewalls. Reference: [Palo Alto

Networks Certified Software Firewall Engineer (PCSFE)], [CN-Series Licensing], [CN-Series System

Requirements], [CN-Series Architecture]

A design consideration for a prospect who wants to deploy VM-Series firewalls in an Amazon Web

Services (AWS) environment is that only active-passive high availability (HA) is supported. High

availability (HA) is a feature that provides redundancy and failover protection for firewalls in case of

hardware or software failure. Active-passive HA is a mode of HA that consists of two firewalls in a

pair, where one firewall is active and handles all traffic, while the other firewall is passive and acts as

a backup. Active-passive HA is the only mode of HA that is supported for VM-Series firewalls in an

AWS environment, due to the limitations of AWS networking and routing. Active-active HA, which is

another mode of HA that consists of two firewalls in a pair that both handle traffic and synchronize

sessions, is not supported for VM-Series firewalls in an AWS environment. A design consideration for

a prospect who wants to deploy VM-Series firewalls in an AWS environment is not that special AWS

plugins are needed for load balancing, resources are shared within the cluster, or high availability

(HA) clusters are limited to fewer than 8 virtual appliances, as those are not valid or relevant factors

for firewall deployment in an AWS environment. Reference: Palo Alto Networks Certified Software

Firewall Engineer (PCSFE), [High Availability Overview], [High Availability on AWS]

CN-Series firewall is the Palo Alto Networks firewall that provides network security when deploying a

microservices-based application. A microservices-based application is an application that consists of

multiple independent and loosely coupled services that communicate with each other through APIs.

A microservices-based application requires network security that can protect the inter-service

communication from cyberattacks and enforce granular security policies based on application or

workload characteristics. CN-Series firewall is a containerized firewall that integrates with

Kubernetes and provides visibility and control over container traffic. CN-Series firewall can provide

network security when deploying a microservices-based application by inspecting and enforcing

security policies on traffic between containers within a pod, across pods, or across namespaces in a

Kubernetes cluster. PA-Series, VM-Series, and HA-Series are not Palo Alto Networks firewalls that

provide network security when deploying a microservices-based application, but they are related

solutions that can be deployed on different platforms or environments. Reference: Palo Alto

Networks Certified Software Firewall Engineer (PCSFE), [CN-Series Datasheet], [CN-Series Concepts],

[What is a Microservices Architecture?]

Dynamic address group is the component that allows the flexibility to add network resources but

does not require making changes to existing policies and rules. Dynamic address group is an object

that represents a group of IP addresses based on criteria such as tags, regions, interfaces, or user-

defined attributes. Dynamic address group allows Security policies to adapt dynamically to changes

in the network topology or workload characteristics without requiring manual updates. Content-ID,

External dynamic list, and App-ID are not components that allow the flexibility to add network

resources but do not require making changes to existing policies and rules, but they are related

features that can enhance security and visibility. Reference: Palo Alto Networks Certified Software

Firewall Engineer (PCSFE), [Dynamic Address Groups Overview], [Content-ID Overview], [External

Dynamic Lists Overview], [App-ID Overview]

Geneve is the protocol used for communicating between VM-Series firewalls and a gateway load

balancer in Amazon Web Services (AWS). A gateway load balancer is a type of network load balancer

that distributes traffic across multiple virtual appliances, such as VM-Series firewalls, in AWS. Geneve

is a tunneling protocol that encapsulates the original packet with an additional header that contains

metadata about the source and destination endpoints, as well as other information. Geneve allows

the gateway load balancer to preserve the original packet attributes and forward it to the

appropriate VM-Series firewall for inspection and processing. VRLAN, GRE, and VMLAN are not

protocols used for communicating between VM-Series firewalls and a gateway load balancer in AWS,

but they are related concepts that can be used for other purposes. Reference: Palo Alto Networks

Certified Software Firewall Engineer (PCSFE), [Deploy the VM-Series Firewall with AWS Gateway Load

Balancer], [Geneve Protocol Specification]

The partition can be accomplished without editing the IP addresses or the default gateways of any of

the guest VMs by creating a new virtual switch and using the VM-Series firewall to separate virtual

switches using virtual wire mode. Then move the guests that require more security into the new

virtual switch. A virtual switch is a software-based switch that connects virtual machines (VMs) in a

VMware ESXi environment. A virtual wire is a deployment mode of the VM-Series firewall that allows

it to act as a bump in the wire between two network segments, without requiring an IP address or

routing configuration. By creating a new virtual switch and using the VM-Series firewall to separate

virtual switches using virtual wire mode, the customer can isolate the group of VMs that require

more security from the rest of the network, and apply security policies to the traffic passing through

the firewall. The partition cannot be accomplished without editing the IP addresses or the default

gateways of any of the guest VMs by editing the IP address of all of the affected VMs, creating a Layer

3 interface in the same subnet as the VMs and then configuring proxy Address Resolution Protocol

(ARP), or sending the VLAN out of the virtual environment into a hardware Palo Alto Networks

firewall in Layer 3 mode. Use the same IP address as the old default gateway, then delete it, as those

methods would require changing the network configuration of the guest VMs or introducing

additional complexity and latency. Reference: Palo Alto Networks Certified Software Firewall

Engineer (PCSFE), [Deploying Virtual Switches], [Virtual Wire Deployment], [Deploying Virtual Wire

on VMware ESXi]

App-ID is the component that can provide application-based segmentation and prevent lateral threat

movement. Application-based segmentation is a method of dividing the network into smaller

segments or zones based on application or workload characteristics, such as function, dependency,

owner, or security posture. Lateral threat movement is a technique used by attackers to move across

the network from one compromised host to another, looking for sensitive data or assets. App-ID is a

feature that identifies and classifies applications and protocols based on their content and

characteristics, regardless of port, encryption, or evasion techniques. App-ID can provide application-

based segmentation and prevent lateral threat movement by applying granular security policies

based on application information to each segment or connection, blocking unauthorized access or

data exfiltration. DNS Security, NAT, and URL Filtering are not components that can provide

application-based segmentation and prevent lateral threat movement, but they are related features

that can enhance security and visibility. Reference: Palo Alto Networks Certified Software Firewall

Engineer (PCSFE), [App-ID Overview], [Microsegmentation with Palo Alto Networks], [Lateral

Movement]