Palo Alto Networks PSE-SoftwareFirewall Exam Dumps

The CN-Series firewalls are specifically designed to secure containerized environments. They can secure traffic between Kubernetes pods, which are the smallest deployable units in a Kubernetes cluster, and are often composed of one or more containers. The primary focus of CN-Series firewalls is to ensure security within Kubernetes environments by managing traffic and enforcing security policies at the pod level.

Palo Alto Networks CN-Series Datasheet: CN-Series Datasheet

Palo Alto Networks CN-Series Documentation: CN-Series Documentation

In AWS, VM-Series firewalls support only active-passive high availability (HA) configuration. This means that one firewall is active and processing traffic, while the other remains passive and takes over in the event of a failure. This design consideration ensures continuous availability and reliability of firewall services in the AWS environment.

Palo Alto Networks VM-Series Deployment Guide for AWS: VM-Series Deployment Guide

Palo Alto Networks HA Configuration Guide: HA Configuration

Transit Gateway and Security VPC:

Using a transit gateway in conjunction with a Security VPC is a recommended design for outbound high availability (HA) in AWS. This configuration ensures that traffic can be routed efficiently and securely through the VM-Series firewalls deployed in the Security VPC.

Palo Alto Networks AWS Design Guide

Transit VPC and Security VPC:

Another recommended approach is to use a Transit VPC along with a Security VPC. The Transit VPC provides a centralized routing hub, while the Security VPC hosts the VM-Series firewalls to inspect and secure outbound traffic.

Palo Alto Networks AWS Transit VPC Guide

Visibility into application-level cluster traffic:

VM-Series firewalls and hardware firewalls that are external to the Kubernetes cluster lack the necessary visibility into the traffic and communications occurring at the application level within the cluster. This limitation impedes their ability to effectively protect containerized workloads.

Palo Alto Networks Kubernetes Security Guide

App-ID is a feature that provides application-based segmentation and helps prevent lateral threat movement within a network. By identifying and controlling applications traversing the network regardless of port, protocol, or encryption (SSL or SSH), App-ID allows granular security policies to be applied, thereby limiting the spread of threats within the network.

Palo Alto Networks App-ID Technology: App-ID

Palo Alto Networks Application and Threat Content: App-ID Overview