PCNSA VPN and Tunnel Configuration Flashcards

What is the purpose of 'Proxy IDs' (also called traffic selectors) in a Palo Alto Networks policy-based IPsec VPN?

Answer: To define which source and destination IP ranges are allowed through the IPsec tunnel during Phase 2 negotiation

Proxy IDs define the local and remote IP subnets that are negotiated in Phase 2 and determine which traffic is encrypted and sent through the tunnel.

Which command in the Palo Alto Networks CLI can be used to verify the status of an IPsec tunnel?

Answer: show vpn ipsec-sa

The 'show vpn ipsec-sa' command displays the current IPsec Security Associations, including their status, SPI values, and traffic statistics.

What happens to traffic in a Palo Alto Networks route-based VPN when the tunnel interface is placed in a security zone?

Answer: Traffic is subject to security policy enforcement between the source zone and the tunnel zone

Placing the tunnel interface in a security zone allows security policies to control and inspect traffic flowing into and out of the VPN tunnel.

In GlobalProtect large-scale deployments, what is the function of 'GlobalProtect Clientless VPN'?

Answer: Provides VPN access through a web browser without installing the GlobalProtect agent

GlobalProtect Clientless VPN delivers browser-based access to internal web applications without requiring the GlobalProtect agent to be installed.

Which encryption algorithm is considered more secure and is recommended for modern Palo Alto Networks IPsec VPN deployments?

Answer: AES-256-CBC

AES-256-CBC provides strong encryption using a 256-bit key and is the recommended cipher for IPsec tunnels in modern deployments.

What is the 'tunnel monitoring' feature in Palo Alto Networks used for in an IPsec VPN configuration?

Answer: Continuously verifying tunnel connectivity by sending test packets to a monitoring destination

Tunnel monitoring sends periodic probes to a specified destination IP to verify end-to-end connectivity and can trigger failover if the tunnel fails.