Panorama Management and Logging Flashcards

In Panorama, what is the difference between Pre-Rules and Post-Rules in a Device Group?

Answer: Pre-Rules are evaluated before local firewall rules; Post-Rules are evaluated after

Pre-Rules are processed before local firewall rules on the managed device, while Post-Rules are processed after local firewall rules, giving administrators control over policy override behavior.

What happens when you push a configuration from Panorama to a managed firewall?

Answer: Panorama-managed policies and templates are committed and activated on the firewall

A Panorama push commits the centrally managed configurations (policies, objects, templates) to the managed firewall, making them active.

Which feature in Panorama allows administrators to group multiple templates to simplify large-scale deployments?

Answer: Template Stacks

Template Stacks allow multiple templates to be layered together, with higher-priority templates overriding lower ones, simplifying configuration management for large environments.

In Panorama, what does a Collector Group define?

Answer: A set of Log Collectors that work together to store and manage logs

A Collector Group is a logical grouping of Log Collectors that share log storage responsibilities and are managed as a unit for log retention and forwarding.

What is the maximum number of firewalls a single Panorama M-600 appliance can manage?

Answer: 5,000

A single Panorama M-600 appliance can manage up to 5,000 devices, making it suitable for large enterprise and service provider deployments.

Which Panorama feature enables automatic provisioning of new firewalls without manual configuration?

Answer: Zero Touch Provisioning (ZTP)

Zero Touch Provisioning allows new Palo Alto firewalls to be automatically registered, assigned to Device Groups and Template Stacks, and configured via Panorama without manual intervention.