PCNSA VPN and Tunnel Configuration Flashcards

In GlobalProtect, what is the difference between a 'pre-logon' and an 'on-demand' connect method?

Answer: Pre-logon connects before user login using machine certificates; on-demand requires the user to manually initiate the VPN

Pre-logon establishes a VPN tunnel before the user logs in using machine certificates, while on-demand requires the user to manually start the connection.

Which authentication method uses digital certificates to verify the identity of both VPN peers in a Palo Alto Networks IPsec deployment?

Answer: RSA Certificate-based authentication

Certificate-based authentication uses RSA or ECDSA certificates signed by a trusted CA to mutually authenticate both ends of an IPsec tunnel.

What is a 'split tunnel' configuration in GlobalProtect, and what is its primary trade-off?

Answer: Only traffic destined for corporate resources goes through the VPN; trade-off is that internet traffic bypasses firewall inspection

Split tunneling routes only corporate-bound traffic through the VPN while internet traffic exits directly, reducing VPN load but leaving non-corporate traffic uninspected.

What is 'Dead Peer Detection' (DPD) used for in Palo Alto Networks IPsec VPN tunnels?

Answer: Monitoring peer liveness and triggering tunnel re-establishment when a peer becomes unreachable

DPD periodically sends IKE hello messages to detect if the remote peer is still reachable and re-establishes the tunnel if it is not.

Which Palo Alto Networks feature allows a GlobalProtect gateway to enforce Host Information Profile (HIP) checks?

Answer: HIP-based policy enforcement

HIP-based policy enforcement uses endpoint posture data collected by the GlobalProtect agent to allow or restrict access based on device compliance.

In a Palo Alto Networks IPsec VPN, what is an 'IPsec Tunnel' object and what must it reference?

Answer: A logical configuration object for Phase 2; it must reference an IKE Gateway and a tunnel interface

The IPsec Tunnel object defines Phase 2 parameters and must reference an IKE Gateway (Phase 1 config) and a tunnel interface to carry the encrypted traffic.