To minimize downtime when increasing throughput on a flexible-license VM-Series firewall running on ESXi, the following steps should be taken: Increase the vCPU within the deployment profile: This is the first step. By increasing the vCPU allocation in the licensing profile, you prepare the license system for the change. This does not require a VM reboot. Retrieve or fetch license keys on the VM-Series NGFW: After adjusting the licensing profile, the firewall needs to retrieve the updated license information to reflect the new vCPU allocation. This can be done via the web UI or CLI and usually does not require a reboot. Power-off the VM and increase the vCPUs within the hypervisor: Now that the license is prepared, the VM can be powered off, and the vCPUs can be increased within the ESXi hypervisor settings. Power-on the VM-Series NGFW: After increasing the vCPUs in the hypervisor, power on the VM. The firewall will now use the allocated resources and the updated license. Confirm the correct tier level and vCPU appear on the NGFW dashboard: Finally, verify in the firewall's web UI or CLI that the correct license tier and vCPU count are reflected. This order minimizes downtime because the licensing changes are handled before the VM is rebooted. Reference: While not explicitly documented in a single, numbered step list, the concepts are covered in the VM- Series deployment guides and licensing documentation: VM-Series Deployment Guides: These guides explain how to configure vCPUs and licensing. Flex Licensing Documentation: This explains how license allocation works with vCPUs. These resources confirm that adjusting the license profile before the VM reboot is crucial for minimizing downtime.

The CN-Series firewalls are specifically designed to secure containerized environments. They can secure

traffic between Kubernetes pods, which are the smallest deployable units in a Kubernetes cluster, and are

often composed of one or more containers. The primary focus of CN-Series firewalls is to ensure security

within Kubernetes environments by managing traffic and enforcing security policies at the pod level.

Reference:

Palo Alto Networks CN-Series Datasheet: CN-Series Datasheet

Palo Alto Networks CN-Series Documentation: CN-Series Documentation

The CN-Series firewalls are containerized firewalls designed to protect Kubernetes environments. They

offer several deployment methods to integrate with Kubernetes orchestration.

A . Terraform templates: Terraform is an Infrastructure-as-Code (IaC) tool that allows you to define and

provision infrastructure using declarative configuration files. 1 Palo Alto Networks provides Terraform

modules and examples to deploy CN-Series firewalls, enabling automated and repeatable deployments.

https://prathmeshh.hashnode.dev/day-62-terraform-and-docker

1. prathmeshh.hashnode.dev

https://prathmeshh.hashnode.dev/day-62-terraform-and-docker prathmeshh.hashnode.dev

B . Panorama plugin for Kubernetes: While Panorama is used to manage CN-Series firewalls centrally,

there isn't a direct "Panorama plugin for Kubernetes" for deploying the firewalls themselves.

Panorama is used for management after they're deployed using other methods.

C . YAML file: Kubernetes uses YAML files (manifests) to define the desired state of deployments,

including pods, services, and other resources. You can deploy CN-Series firewalls by creating YAML

files that define the necessary Kubernetes objects, such as Deployments, Services, and ConfigMaps. This

is a core method for Kubernetes deployments.

D . Helm charts: Helm is a package manager for Kubernetes. Helm charts package Kubernetes resources,

including YAML files, into reusable and shareable units. Palo Alto Networks provides Helm

charts for deploying CN-Series firewalls, simplifying the deployment process and managing updates. E .

Docker Swarm: Docker Swarm is a container orchestration tool, but CN-Series firewalls are specifically

designed for Kubernetes and are not deployed using Docker Swarm.

Reference:

The Palo Alto Networks documentation clearly outlines these deployment methods:

CN-Series Deployment Guide: This is the primary resource for deploying CN-Series firewalls. It provides

43/103

detailed instructions and examples for using Terraform, YAML files, and Helm charts. You can find this

on the Palo Alto Networks support portal by searching for "CN-Series Deployment Guide".

When using Terraform templates with a Cloud next-generation firewall (NGFW) for Amazon Web

Services (AWS), you must enable access to the Cloud NGFW for AWS console to manage and deploy

firewall resources effectively:

Access to the Cloud NGFW for AWS console: This access is crucial for the initial setup, configuration,

31/103

and ongoing management of the Cloud NGFW resources. Terraform templates automate the provisioning

and management of these resources, but initial access to the console is necessary to configure and retrieve

necessary information (such as API keys and configuration details) for the Terraform scripts.

Reference: Getting Started with Cloud NGFW for AWS

VM-Series firewalls provide advanced application-level security for web-server instances on AWS. These

virtual firewalls leverage Palo Alto Networks’ next-generation firewall capabilities to offer features like

application identification, threat prevention, and URL filtering, ensuring comprehensive security for web

applications hosted on AWS.

Reference:

Palo Alto Networks VM-Series on AWS: VM-Series on AWS AWS Security Best Practices: AWS

Security Best Practices

When implementing active-active high availability (HA), a floating IP address must be configured to allow the HA pair to share a single IP address that may be used as the network's gateway IP address. This floating IP address ensures that either of the active-active firewalls can assume control of the traffic without interruption in case of a failover. Reference: Palo Alto Networks High Availability Guide: Active-Active HA Configuration Palo Alto Networks HA Configuration: HA Configuration

Service Cluster Mode:

In NSX-T, the Service Cluster mode allows the VM-Series firewalls to be deployed as part of a service

cluster, where they can provide security services to workloads.

Reference: The deployment guide for VM-Series firewalls in NSX-T outlines how to set up and configure

Service Cluster mode.

Palo Alto Networks NSX-T Integration Guide Host-based Mode:

Host-based mode involves deploying the VM-Series firewalls directly on the host machines within the

18/103

NSX-T environment. This allows for direct integration and security enforcement on the host level.

Reference: NSX-T documentation from Palo Alto Networks describes host-based deployment options

for VM-Series firewalls.

Palo Alto Networks NSX-T Integration Guide

The question asks about the primary purpose of the pan-os-python SDK.

D . To provide a Python interface to interact with PAN-OS firewalls and Panorama: This is the correct

answer. The pan-os-python SDK (Software Development Kit) is designed to allow Python scripts and

applications to interact programmatically with Palo Alto Networks firewalls (running PAN-OS) and

Panorama. It provides functions and classes that simplify tasks like configuration management,

monitoring, and automation.

Why other options are incorrect:

A . To create a Python-based firewall that is compatible with the latest PAN-OS: The pan-os-python SDK

is not about creating a firewall itself. It's a tool for interacting with existing PAN-OS firewalls.

B . To replace the PAN-OS web interface with a Python-based interface: While you can build custom

tools and interfaces using the SDK, its primary purpose is not to replace the web interface. The web

40/103

interface remains the standard management interface.

C . To automate the deployment of PAN-OS firewalls by using Python: While the SDK can be used as

part of an automated deployment process (e.g., in conjunction with tools like Terraform or Ansible), its

core purpose is broader: to provide a general Python interface for interacting with PAN-OS and

Panorama, not just for deployment.

Palo Alto Networks Reference:

The primary reference is the official pan-os-python SDK documentation, which can be found on GitHub

(usually in the Palo Alto Networks GitHub organization) and is referenced on the Palo Alto Networks

Developer portal. Searching for "pan-os-python" on the Palo Alto Networks website or on GitHub will

locate the official repository.

The documentation will clearly state that the SDK's purpose is to:

Provide a Pythonic way to interact with PAN-OS devices.

Abstract the underlying XML API calls, making it easier to write scripts.

Support various operations, including configuration, monitoring, and operational commands. The

documentation will contain examples demonstrating how to use the SDK to perform various tasks,

reinforcing its role as a Python interface for PAN-OS and Panorama.

App-ID is a feature that provides application-based segmentation and helps prevent lateral threat

movement within a network. By identifying and controlling applications traversing the network

regardless of port, protocol, or encryption (SSL or SSH), App-ID allows granular security policies to be

applied, thereby limiting the spread of threats within the network.

Reference:

Palo Alto Networks App-ID Technology: App-ID

Palo Alto Networks Application and Threat Content: App-ID Overview

In Kubernetes, configuration files are typically written in YAML (.yaml) format. YAML (Yet Another

Markup Language) is preferred due to its readability and ease of use for defining complex data structures

like those required for Kubernetes deployments. Kubernetes uses these YAML files to define resources

such as pods, services, and deployments.

Reference:

Kubernetes Documentation on YAML: Kubernetes YAML Kubernetes Getting Started Guide: YAML

Basics