PCNSA VPN and Tunnel Configuration Flashcards

Which Palo Alto Networks VPN technology is used to provide secure remote access for end users connecting from laptops or mobile devices?

Answer: GlobalProtect

GlobalProtect provides secure remote access VPN for end users by establishing encrypted tunnels from their devices to the corporate network.

What is the role of the GlobalProtect Portal in a Palo Alto Networks remote access deployment?

Answer: Authenticates users and distributes agent configuration to connecting clients

The GlobalProtect Portal authenticates users, delivers the GlobalProtect agent, and distributes configuration profiles to connecting endpoints.

Which IKE phase is responsible for establishing a secure, authenticated channel used to negotiate IPsec security associations?

Answer: IKE Phase 1

IKE Phase 1 establishes a secure and authenticated control channel (ISAKMP SA) that is then used in Phase 2 to negotiate IPsec SAs.

In a Palo Alto Networks IPsec VPN configuration, what is an 'IKE Gateway'?

Answer: A configuration object defining the peer VPN device and IKE parameters for Phase 1

An IKE Gateway object on PAN-OS defines the remote peer address, authentication method, and IKE version for Phase 1 negotiation.

Which interface type must be created on a Palo Alto Networks firewall to carry IPsec tunnel traffic?

Answer: Tunnel interface

A Tunnel interface is a logical, virtual interface that serves as the endpoint for IPsec tunnels, carrying encrypted traffic between sites.

What does 'IKEv2' improve over 'IKEv1' in Palo Alto Networks IPsec VPN deployments?

Answer: IKEv2 reduces the number of exchanges needed and adds built-in NAT traversal and EAP support

IKEv2 uses fewer message exchanges to establish tunnels, natively supports NAT traversal, and adds EAP authentication compared to IKEv1.