NGFW Engineer · Domain 1 of 3

NGFW Engineer Domain 1: PAN-OS Networking Configuration

One of the two largest domains at 40% of the score. It tests how you build the PAN-OS data plane: interface types, zones, high availability pairs, static and dynamic routing, GlobalProtect remote access, and IPSec, quantum-resistant and GRE tunnels.

Exam weight
40%
Official objectives
6
Estimated questions estimate
~24
Suggested study time estimate
25–30 hrs

About 15 min read Reviewed October 2026

Overview

Domain 1 covers the network layer of a Palo Alto Networks firewall. It has six official objectives. Interfaces span Layer 2, Layer 3, virtual wire, tunnel, Aggregate Ethernet and management ports. Zones group interfaces and anchor every Security and NAT rule. High availability covers active/passive and active/active pairs with link and path monitoring. Routing covers dynamic protocols, redistribution, route monitoring and the Advanced Routing Engine with logical routers. GlobalProtect covers portals, gateways, authentication and split tunneling. Tunnels cover IPSec site-to-site VPNs, quantum-resistant key exchange and GRE.

At 40%, this domain shares the top weight with device settings. Questions are scenario-based and assume PAN-OS 11.x or later behaviour, so you need to know which configuration object solves a stated design requirement and where a misconfiguration would break traffic. Hands-on time in the web interface is the fastest way to build that judgement.

How it's tested

Domain 1 questions usually describe a network design goal or a symptom, such as traffic not passing, a failover not happening or a VPN that never comes up. You then pick the interface type, zone setting, HA option, routing object or tunnel parameter that fits. Several options are valid PAN-OS features, so the precise requirement decides.

  • Choose the deployment mode

    A placement constraint is given, such as no IP changes on the segment, and you choose virtual wire, Layer 2, Layer 3 or tap.

  • Diagnose the broken path

    A VPN, route or failover does not behave as expected, and you identify the missing object such as a proxy ID, zone or monitored path.

  • Pick the routing control

    A redistribution, failover or route preference need is stated, and you choose the profile, monitor or administrative distance setting that delivers it.

Reasoning it through

A firewall must be inserted between a core switch and an internet router without readdressing either device, while still enforcing App-ID. Layer 3 would require new subnets and Layer 2 needs VLAN objects. A tap port only sees copied traffic and cannot block. A virtual wire binds two interfaces transparently, passes traffic with no IP addresses, and still applies Security policy, so virtual wire is correct.

Objectives 6

Official objectives from the Palo Alto Networks outline, in outline order.

1.1 Configure interfaceLayer 2, Layer 3, virtual wire, tunnel, Aggregate Ethernet and management interfaces.
What it means
Sub-objectives 1.1.1 to 1.1.6 cover each interface type. Layer 3 interfaces carry IP addresses and route. Layer 2 interfaces switch within a VLAN object. A virtual wire binds two ports with no addressing. Tunnel interfaces are logical endpoints for VPNs. Aggregate Ethernet bundles physical links, and the management port handles out-of-band administration.
What to understand
Know what each mode requires. Layer 3 needs an IP, a virtual or logical router and a zone. Virtual wire needs a virtual wire object, a pair of interfaces and virtual wire zones, and can allow selected VLAN tags. Aggregate groups use members of the same speed and media and can run LACP. Interface management profiles permit ping, SSH or HTTPS on data ports, while the dedicated MGT port stays out of band.
How it shows up
Expect a constraint such as no readdressing, link redundancy or remote management through a data port, and choose the interface type or profile.
Common confusion
Assuming management access on a data interface works without an interface management profile attached.
1.2 Configure zonesSecurity zones as the basis of policy, by zone type.
What it means
Zones group interfaces with the same trust level, and Security, NAT, decryption and policy-based forwarding rules match on them. The zone type must match the interface type: Layer 3, Layer 2, virtual wire, tap or tunnel, with external zones used between virtual systems.
What to understand
An interface can belong to exactly one zone. Traffic within one zone is allowed by the default intrazone rule, while traffic between zones is denied by the default interzone rule. Zone protection profiles defend against floods, reconnaissance and packet-based attacks at the zone edge. User-ID is enabled per zone, so user mapping only happens where the setting is on.
How it shows up
Scenarios ask why traffic is dropped between interfaces or which zone setting enables a protection or identity feature.
Common confusion
Thinking two interfaces in the same zone need an explicit allow rule; intrazone traffic is allowed by default.
1.3 Configure high availability (HA)Active/active and active/passive pairs with link and path monitoring.
What it means
Sub-objectives cover active/active (1.3.1), active/passive (1.3.2) and link and path monitoring (1.3.3). HA pairs two identical firewalls running the same PAN-OS and content versions, synchronising configuration over HA1 and sessions over HA2, so a failure does not drop established flows.
What to understand
Active/passive is the common choice: one peer forwards while the other waits, and device priority with preemption decides which returns as active. Active/active has both peers forwarding, adds the HA3 link for packet forwarding, and uses session owner, session setup and floating IP or ARP load-sharing settings to cope with asymmetric paths. Link monitoring watches physical interfaces in link groups; path monitoring pings destination IPs. Each group fails when any or all members fail, depending on the setting.
How it shows up
Questions test which link carries what, when preemption matters, and which monitoring type detects an upstream router failure.
Common confusion
Using link monitoring to detect a failed next hop beyond a healthy switch; that needs path monitoring.
1.4 Configure routingDynamic routing, redistribution, route monitoring and the Advanced Routing Engine.
What it means
Sub-objectives cover dynamic routing protocols (1.4.1), redistribution and policies (1.4.2), route monitoring (1.4.3) and the Advanced Routing Engine (1.4.4). The firewall supports static routes, OSPFv2, OSPFv3, BGP, RIP and multicast, controlled by route preference, filters and redistribution profiles.
What to understand
Know default administrative distances: static 10, eBGP 20, OSPF internal 30, OSPF external 110, RIP 120 and iBGP 200. Redistribution profiles or route maps control what moves between protocols. Static route path monitoring removes a route when its monitored destinations stop answering, letting a backup route take over. The Advanced Routing Engine replaces virtual routers with logical routers and reusable routing profiles, filters and route maps; enabling it requires a commit and reboot.
How it shows up
Expect questions on route preference, failover of a static default route, and where a setting lives with the Advanced Routing Engine enabled.
Common confusion
Looking for virtual router settings after the Advanced Routing Engine is enabled; configuration moves to logical routers and routing profiles.
1.5 Configure GlobalProtectPortals, gateways, authentication and split tunneling.
What it means
Sub-objectives cover portals (1.5.1), gateways (1.5.2), authentication (1.5.3) and split tunneling (1.5.4). The portal authenticates users and hands the GlobalProtect app its configuration and gateway list. Gateways terminate tunnels, assign client IPs from a pool and enforce policy, including Host Information Profile checks.
What to understand
Portal and gateway can share one firewall interface or sit on separate firewalls. Both need an SSL/TLS service profile with a certificate clients trust. Authentication can use profiles for LDAP, RADIUS, SAML or Kerberos, client certificates through a certificate profile, and authentication override cookies to avoid repeated prompts. Split tunneling decides which traffic enters the tunnel by access route, domain or application, with include and exclude lists. Some features, such as HIP checks and mobile app support, need a GlobalProtect subscription.
How it shows up
Scenarios ask which component supplies the app configuration, which setting keeps video streaming off the tunnel, or why clients see certificate errors.
Common confusion
Confusing the portal, which distributes configuration, with the gateway, which terminates tunnels and enforces policy.
1.6 Configure tunnelsIPSec, quantum-resistant cryptography and GRE.
What it means
Sub-objectives cover IPSec (1.6.1), quantum-resistant cryptography (1.6.2) and Generic Routing Encapsulation (1.6.3). An IPSec site-to-site VPN combines an IKE gateway, IKE and IPSec crypto profiles, a tunnel interface in a zone and routing that sends traffic into the tunnel.
What to understand
IKE phase 1 settings must match the peer: version, authentication method, Diffie-Hellman group, encryption and lifetime. Proxy IDs are needed when the peer uses policy-based VPNs with crypto access lists. Tunnel monitoring detects a dead tunnel and can trigger failover. For quantum resistance, IKEv2 can add post-quantum pre-shared keys (RFC 8784) and, in newer releases, hybrid key exchange with ML-KEM (RFC 9370). GRE tunnels carry routing protocols and multicast but provide no encryption on their own.
How it shows up
Expect a VPN that fails to negotiate or carries only some subnets, or a requirement for protection against harvest-now, decrypt-later attacks.
Common confusion
Expecting GRE alone to encrypt traffic; it encapsulates only, so confidentiality needs IPSec.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Virtual wire

    Two interfaces bound together with no IP or MAC addresses, enforcing policy inline.

    Remember
    No routing or switching; traffic passes between the pair.
    Tested as
    Insertion scenarios with no readdressing.
    Trap
    Choosing Layer 2 when the requirement is zero network changes.

  • Interface management profile

    Allows services such as ping, SSH and HTTPS on a data-plane interface.

    Remember
    Without it, data interfaces refuse management traffic.
    Tested as
    Remote management and GlobalProtect troubleshooting.
    Trap
    Assuming the MGT port settings apply to data ports.

  • Intrazone and interzone defaults

    Same-zone traffic is allowed; cross-zone traffic is denied unless a rule allows it.

    Remember
    Default rules can be overridden for logging.
    Tested as
    Why traffic flows or drops.
    Trap
    Writing redundant intrazone allow rules.

  • HA links

    HA1 syncs configuration and state, HA2 syncs sessions, HA3 forwards packets in active/active.

    Remember
    HA3 exists only in active/active.
    Tested as
    Link-function questions.
    Trap
    Swapping HA1 and HA2 roles.

  • Preemption

    Lets the higher-priority peer (lower number) reclaim the active role after recovery.

    Remember
    Must be enabled on both peers to take effect.
    Tested as
    Failback behaviour.
    Trap
    Expecting failback without enabling preemption.

  • Path monitoring

    Pings destination IPs to detect upstream failure.

    Remember
    Detects problems link monitoring cannot see.
    Tested as
    HA and static route failover.
    Trap
    Relying only on link state.

  • Administrative distance

    Route preference between sources; lower wins.

    Remember
    Static 10, eBGP 20, OSPF internal 30, iBGP 200.
    Tested as
    Route selection questions.
    Trap
    Mixing up eBGP and iBGP values.

  • Advanced Routing Engine

    Routing engine using logical routers, routing profiles and route maps.

    Remember
    Enabled globally; needs commit and reboot.
    Tested as
    Newer PAN-OS routing questions.
    Trap
    Expecting virtual routers to stay in use alongside it.

  • GlobalProtect portal vs gateway

    Portal distributes app settings and gateway lists; gateway terminates tunnels.

    Remember
    Gateways assign IP pools and check HIP.
    Tested as
    Remote access design.
    Trap
    Configuring split tunneling on the portal.

  • Split tunneling

    Gateway setting that sends only selected traffic through the tunnel.

    Remember
    Include and exclude by route, domain or application.
    Tested as
    Bandwidth and SaaS scenarios.
    Trap
    Assuming full tunnel is the only option.

  • Proxy IDs

    Local and remote subnet pairs for IKE phase 2 negotiation.

    Remember
    Required with policy-based peers.
    Tested as
    VPN interoperability failures.
    Trap
    Leaving them empty against a peer with crypto access lists.

  • Post-quantum pre-shared key

    Extra key mixed into IKEv2 to resist future quantum attacks.

    Remember
    Requires IKEv2, not IKEv1.
    Tested as
    Quantum-resistant cryptography objective.
    Trap
    Selecting a larger DH group as the quantum answer.

  • GRE tunnel

    Encapsulation for routing protocols and multicast between sites.

    Remember
    Unencrypted unless carried over IPSec.
    Tested as
    Third-party and cloud connectivity.
    Trap
    Treating GRE as a secure VPN.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Interface deployment modes

ConceptMeaningKey differenceCommon trap
Layer 3 Routed interface with an IP address Supports routing, NAT and VPN termination Choosing it when readdressing is not allowed
Layer 2 Switching between interfaces in a VLAN No routing between L2 segments without a VLAN interface Forgetting the VLAN object
Virtual wire Transparent pair with no addressing Simplest inline insertion Expecting it to route
Tap Receives mirrored traffic Visibility only, cannot block Choosing it for prevention

HA modes and monitoring

ConceptMeaningKey differenceCommon trap
Active/passive One peer forwards, one waits Simpler, no HA3 Assuming both peers pass traffic
Active/active Both peers forward Needs HA3 and session owner settings Choosing it for simplicity
Link monitoring Watches interface state Local failure only Using it for upstream failures
Path monitoring Pings remote destinations Detects failures beyond the link Forgetting it needs reachable IPs

Tunnel types

ConceptMeaningKey differenceCommon trap
IPSec site-to-site Encrypted tunnel between peers IKE gateway plus crypto profiles Missing proxy IDs with policy-based peers
GlobalProtect Remote user VPN Portal and gateway with the app Treating it as site-to-site
GRE Plain encapsulation No encryption Assuming confidentiality

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Tap for blocking

    What candidates pick
    A tap interface to stop malicious traffic.
    Why it looks right
    Tap gives full visibility without network changes.
    Why it's wrong
    Tap ports only see a copy of traffic and cannot drop anything; inline blocking needs virtual wire, Layer 2 or Layer 3.

    Clue to watch for The requirement says prevent or block.

  2. HA3 in active/passive

    What candidates pick
    Configuring HA3 for an active/passive pair.
    Why it looks right
    More HA links sound more resilient.
    Why it's wrong
    HA3 forwards packets between peers only in active/active; active/passive uses HA1 and HA2.

    Clue to watch for The pair is described as active/passive.

  3. iBGP beats OSPF

    What candidates pick
    Expecting an iBGP route to win over OSPF internal.
    Why it looks right
    BGP is often treated as the preferred protocol.
    Why it's wrong
    Default iBGP distance is 200, far worse than OSPF internal at 30.

    Clue to watch for Two protocols learn the same prefix.

  4. Portal splits the tunnel

    What candidates pick
    Setting split tunnel routes in the portal configuration.
    Why it looks right
    The portal pushes settings to the app.
    Why it's wrong
    Split tunneling is defined in the gateway's client settings, which control what enters the tunnel.

    Clue to watch for A request to keep certain traffic local.

  5. Larger DH group is quantum-safe

    What candidates pick
    Raising the Diffie-Hellman group to resist quantum attacks.
    Why it looks right
    Bigger keys sound stronger.
    Why it's wrong
    Classical DH and ECDH remain vulnerable to quantum attacks; the answer is post-quantum PSKs or ML-KEM hybrid exchange over IKEv2.

    Clue to watch for Wording about harvest-now, decrypt-later threats.

  6. Proxy IDs optional

    What candidates pick
    Leaving proxy IDs blank with a third-party policy-based peer.
    Why it looks right
    PAN-OS to PAN-OS tunnels work without them.
    Why it's wrong
    Policy-based peers negotiate phase 2 per subnet pair, so mismatched or missing proxy IDs stop the tunnel.

    Clue to watch for The peer is a non-Palo Alto Networks device and phase 2 fails.

Answer framework

Use these steps to work through any Domain 1 networking scenario before reading the options in detail.

  1. Locate the layer of the problem first: interface mode, zone, HA, routing, GlobalProtect remote access or a site-to-site tunnel.
  2. For placement questions, list the constraints, such as no readdressing or need to route, and match the interface type.
  3. For high availability, decide whether the failure is local or upstream, then pick link or path monitoring and check whether preemption is needed.
  4. For routing, compare administrative distances and check whether the Advanced Routing Engine changes where the setting lives.
  5. For tunnels, confirm the tunnel interface, zone and route exist, then compare IKE versions, crypto profiles, proxy IDs and any quantum-resistant requirement.

Practice question

An active/passive firewall pair connects to the internet through a switch and an upstream ISP router. When the ISP router failed, the firewall links stayed up and no failover occurred. Which configuration change would trigger failover in this situation?

Want more like this? The NGFW Engineer practice test has questions for every domain.

Checklist

0 of 15

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Build a lab before you read deeply. A VM-Series trial image on a home hypervisor, or a lab offered with EDU-210 Firewall Essentials, lets you create every interface type, zone and router this domain names. Configure a Layer 3 internet edge first, then add a virtual wire pair and an Aggregate Ethernet group so you see what each mode asks for.

Next, work through routing. Set up OSPF and BGP between two firewalls or a free router image, redistribute a static route, and compare route tables while changing administrative distances. Then enable the Advanced Routing Engine on a test box to learn where logical routers, routing profiles and route maps appear after the reboot.

Spend a full session on VPNs. Build an IPSec tunnel to another firewall, break it deliberately with mismatched crypto settings and proxy IDs, and read the system log messages. Add post-quantum pre-shared keys on an IKEv2 gateway. Finish with a GlobalProtect portal and gateway using a lab certificate, and test split tunneling.

For HA, read the PAN-OS administrator guide sections on HA links, preemption and monitoring, then drill scenario questions until link versus path monitoring is automatic.

FAQ

How much of the NGFW Engineer exam is PAN-OS Networking Configuration?

PAN-OS Networking Configuration is 40% of the exam score according to the November 2025 datasheet, tied with PAN-OS Device Setting Configuration as the largest domain.

Which interface types do I need to know?

Layer 2, Layer 3, virtual wire, tunnel, Aggregate Ethernet and management, as listed in objective 1.1. Tap mode is worth knowing as a distractor even though it is not named.

Is the Advanced Routing Engine tested?

Yes. Objective 1.4.4 names it directly. Know that it uses logical routers and routing profiles, and that enabling it requires a commit and a reboot.

Do I need active/active HA in depth?

You need to know when to use it, that it adds an HA3 link, and how session owner and floating IP settings handle asymmetric traffic. Active/passive remains the default design.

What does quantum-resistant cryptography mean on this exam?

Protecting IPSec key exchange against future quantum attacks, using post-quantum pre-shared keys or hybrid ML-KEM key exchange over IKEv2 on supported PAN-OS releases.

Is GlobalProtect configuration on the NGFW Engineer exam?

Yes. Objective 1.5 covers portals, gateways, authentication and split tunneling. Expect scenarios about which component does what and how to keep selected traffic off the tunnel.

Does this domain test NAT and Security policy rules?

Policy rule writing is not a named objective in the November 2025 datasheet, but zones drive every rule, so expect policy context in networking scenarios.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 1 knowledge

You have covered interfaces, zones, HA, routing, GlobalProtect and tunnels. Check whether you can pick the right PAN-OS networking object under timed conditions.

Take the NGFW Engineer practice test Check your NGFW Engineer readiness

Keep going