Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksStrata FirewallEDU-210
Firewall: Configuration and Management
Configure and manage Palo Alto Networks Next-Generation FireWalls: interfaces, security and NAT policy, App-ID, URL filtering, and daily operations.
- Duration
- 5 days or 10 half-days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.78/53,009 Course reviews
What you will be ready to do
Configure, manage and operate Palo Alto Networks Next-Generation FireWalls with confidence.
- Deploy and license a FireWall and gain safe administrative access.
- Segment your network with interfaces, zones and security policy.
- Control applications and users with App-ID and User-ID.
- Stop known and unknown threats with Content-ID and WildFire.
Who it’s for
Is EDU-210 the right course?
Designed for
Security engineers, network engineers, and administrators who deploy or operate Palo Alto Networks Next-Generation FireWalls.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab Access for 3 month
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
For FireWalls running PAN-OS
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time on your personal FireWall instance, so you practise each configuration step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices; no prior Palo Alto Networks experience is required.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 3,009 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Anonymous
Verified via Reviews.io
The Firewall Configuration and Management (EDU-210) course was highly valuable and well structured. The material was relevant and practical, and the hands-on labs were particularly effective in reinforcing the concepts presented throughout the course.
One recommendation for improvement would be to extend lab access beyond the current two-week period. Due to the depth and complexity of the lab exercises, additional time would allow students to fully explore the scenarios and maximize the learning experience.
Overall, the course was excellent. The workbook was detailed and well organized, and the instructor demonstrated strong subject matter expertise while presenting the material in a clear and concise manner. I gained valuable knowledge and skills that I can directly apply to my daily work responsibilities.
Jerramy Burns at Lockheed Martin
Verified via Reviews.io
I feel the course hit all the key areas needed to get you going with the product from product knowledge regarding the various types of options to choose from, initial product stand up, how the systems engine works, zero trust, policies and profiles, monitoring all the way to ipsec configuration. These are the things a network engineer need to know when working in an agile environment.
The labs were great. They provided a "real world" experience. I could visual myself needing to know the details of the labs in a real world scenario or assignment.
Overrall great training course. I'm very pleased with the knowledge gained from it.
Anton Katanayev at Freedom
Verified via Reviews.io
Курс EDU-210 сам по себе очень объёмный и интенсивный. Материал курса отлично структурирован, содержит баланс теории и очень полезных практических лабораторных работ. Курс помог структурировать уже имеющиеся знания и дал чёткое понимание лучших практик (Best Practices) по настройке и управлению шлюзами Palo Alto Networks. Это отличная база для уверенной работы с оборудованием вендора на enterprise-уровне.
Anonymous
Verified via Reviews.io
One of the highlights for me was the hands-on lab sessions. I thoroughly enjoyed the labs, as they allowed me to practice on live systems and explore real-world scenarios. This practical experience was invaluable because it solidified the theoretical knowledge and gave us the opportunity to troubleshoot and configure in a controlled environment. The labs were well-designed, and the real-time scenarios helped in developing a deeper understanding of how Palo Alto firewalls function in various network environments.
Sean Swift at City of Bradford Metropolitan Council
Verified via Reviews.io
i have been using Palo Alto firewalls for just under 3 years and having this official training has now meant i need to look at our current deployments and change how our firewalls were deployed to utilise more of the features we have available but are not using. without this training i would not know how to use these features.
Graham Walmsley at London Fire Brigade
Verified via Reviews.io
Good>
Well put together with labs that actually work all week long (and dont breakdown or fail is ive experianced on other courses)
A few small errors in the lab books, but nothing bad.
Page 1 of 2
Course agenda
Explore the complete EDU-210 agenda.
The “Firewall: Configuration and Management” course covers the following content.
Select a module to see its topics and lab activities.
Course Overview
- The Big Picture – Functionality Overview in a Real World Use Case
- Visibility – Application & User Identification, URL Categorization, SSL Decryption
- Control – Policies, QoS, Data Filtering, File Blocking, VPN & Remote Access
- Threat Prevention – Anti-Spyware/-Virus Scanning, Vulnerability & DoS Protection, 0-Day Protection and WildFire
Palo Alto Networks Portfolio and Architecture
- Palo Alto Networks Portfolio overview
- Next-generation firewall architecture
- Firewall offerings
Connect to the Management Network
- Initial system access
- Overview
- Web Interface Overview
- Configure management network settings
- Management, Service & Interface config
- Service Route
- Activate a firewall, and manage licenses and software
- License Activation
- Licenses
- Support
- Software updates
- dynamic updates
- IronSkillet
- Lab
- Connect to the firewall web interface
- Load a starting lab configuration
- Set DNS servers for the firewall
- Set NTP servers for the firewall
- Configure a login banner for the firewall
- Set Latitude and Longitude for the firewall
- Configure permitted IP addresses for firewall management
- Schedule dynamic updates
Manage Firewall Configurations
- Configuration management
- Configuration Interaction
- Auto-commit
- Configuration Actions
- Config Audit
- Commit operations
- Commit per administrator
- Commit Lock
- Factory Reset
- View firewall logs
- Lab
- Export a named configuration snapshot
- Save ongoing configuration changes before a commit
- Revert ongoing configuration changes
- Preview configuration changes
- Examine log files
- Create a log file filter
- Use the Filter Builder
Manage Firewall Administrator Accounts
- Firewall authentication and authorization
- Create a local firewall administrator account
- Create a non-local firewall administrator account
- Create a firewall administrator account for non-interactive login
- Lab
- Create a local firewall administrator account
- Configure an LDAP Server Profile & Authentication Profile
- Configure a RADIUS Server Profile & Authentication Profile
- Create non-local firewall administrator accounts for LDAP and RADIUS
- Configure an Authentication Sequence
Connect to Production Networks
- Block threats by using network segmentation
- Network interfaces and security zones
- Layer 3 interfaces
- Layer 3 sub-interfaces
- Virtual wire interfaces
- Tap interfaces
- Virtual routers
- Inter VR Routing
- Configuration
- Multiple Static Default Routes and path monitoring
- Troubleshoot Routing
- Interface Management profile
- Loopback interfaces
- Lab
- Create Layer 3 interfaces
- Create a virtual router
- Segment your production network using security zones
- Test connectivity from firewall to hosts in each security zone
- Create Interface Management Profiles
Block Threats Using Security and NAT Policies
- Security policy fundamental concepts
- Flow Logic
- Security Policy Match
- Rule types
- Security policy administration
- Rule elements
- Managing policy ruleset
- Rule hit counter and unused rules
- Test policy match & policy match troubleshooting
- Global Find
- Network address translation
- Source NAT configuration
- Source NAT Overview
- Source NAT Policy
- Source NAT Configuration
- Source NAT Types
- Bidirectional Source NAT
- DIPP NAT Oversubscription
- Destination NAT configuration
- Destination NAT Policy
- Destination NAT Configuration
- Destination NAT Port translation
- Lab
- Configure a Security policy rule to allow access from Users_Net to Extranet
- Test access from client to Extranet servers
- View the Traffic log
- Examine policy Rule Hit Count
- Reset rule hit counts
- Customize policy tables
- Manage the Policy Ruleset
- Enable intrazone and interzone logging
- Configure source NAT
- Configure destination NAT
Block Packet- and Protocol-Based Attacks
- Denial of Service Attack Types
- DoS vs DDoS
- SYN Flood and SYN Cookies
- Application-based DoS Attack
- Amplification Attack
- Zone Protection
- Flood Protection
- Configuration
- RED vs SYN Cookie
- Flood Protection impact
- Protection Lab Demo
- Reconnaissance Protection
- Port scan vs Host Sweep
- Packet Based Attack Protection
- Protocol Protection
- DoS Protection Policy
- Overview
- Configuration
- Aggregate vs Classified
- Resource Protection
- Protection Lab Demo
- Zone Protection vs DoS Protection Policy
- Block threats using packet buffer protection
- Lab
- Configure a Zone Protection Profile to detect and control SYN floods
- Configure a Zone Protection Profile to detect and control reconnaissance scans
- Configure a Zone Protection Profile to detect and control specific IP header options
- Configure a Zone Protection Profile to perform spoofed IP address checking
- Configure a DoS Protection Profile to protect firewall and node resource consumption
- Configure a DoS Protection Profile to detect and control SYN floods
Block Threats from Known Bad Sources
- Block access to or from known-bad IP addresses
- Overview
- Dynamic Address Group
- EDL Overview
- EDL configuration example
- External Dynamic List Monitoring
- Block access to or from known-bad domains
- Security profiles overview
- DNS Sinkhole
- Block access to or from known-bad URLs
- Overview
- URL categories in Security Policy Deny Rule
- Custom URL category
- Other URL filtering features
- Response Pages
- Customize Response pages
- URL Filtering Profile
- URL Log including Recategorization request
- Lab
- Block access to malicious IP addresses using Address objects
- Block access to malicious IP addresses using Address Groups
- Block access to malicious IP addresses using geographic regions
- Block access to malicious IP addresses using an External Dynamic List (EDL)
- Block access to malicious domains using an EDL
- Block access to malicious URLs using the Security policy
- Block access to a malicious URL using a URL Filtering Profile
Block Threats by Identifying Applications
- App-ID reduces the attack surface
- What is an App vs URL Filtering
- Evasive Applications
- App-ID concepts and operation
- Application Identification of a TCP Flow
- App-ID Flow
- Application Dependencies
- Control Applications on SSL-Secure Ports
- Application Default Port
- App-ID and UDP
- Differentiating Between Known and Unknown Applications
- Application Block Page
- Configure App-ID objects
- Application Groups
- Application tagging for SaaS
- Application Filters
- Nested Application Groups and Filters
- Lab
- Create an FTP Service object and an FTP port-based Security policy rule
- Test the port-based Security policy
- Generate application traffic
- Configure an application group
- Configure a Security policy to allow update traffic
- Test the Allow-PANW-Apps Security policy rule
- Examine the tasks list to see shadowed message
- Modify the Security policy to function properly
- Test the modified Security policy rule
Maintain Application-Based Policies
- Migrate to an App-ID-based Security policy
- Moving to Application-Based Policies
- Migration Strategy
- Expedition
- Policy Optimizer
- Maintain an App-ID Security policy
- Maintain App-ID
- Applications and Threats Content Updates
- Review New and Updated Application Details
- Lab
- Create a custom Service object for HTTP
- Add the new service to the Security policy
- Test Access to the web server on port 8080
- Revert the web server to port 80
- Create an FTP application-based Security policy rule
- Test the application-based Security policy
- Remove the FTP rules
- Scheduling App-ID updates
Block Threats Using Custom Applications
- Unknown applications
- Perform packet captures
- Identify unique bit patterns
- Create a custom application with a signature
- Configure an Application Override policy
- Lab
- Gather custom application information
- Configure a packet capture
- Capture application traffic
- Analyze the packet capture
- Create a custom application with a signature
- Add the custom application to the Security policy
- Test the custom application signature
Block Threats by Identifying Users
- User-ID overview
- User mapping methods
- Overview
- AD Integration – UID Agent on FW
- Concept
- User-ID Configuration
- Group Mapping Configuration
- Troubleshooting
- Terminal Services Agent
- User-ID redistributing
- Windows-based agent configuration
- Configure group mapping
- User-ID redistribution
- Concept
- Configuration
- User-ID and Security policy
- Users and Groups for a Security Policy
- Dynamic User Groups
- Lab
- Examine current configuration
- Enable User-ID technology on the Acquisition zone.
- Generate traffic
- Modify Security policy to meet requirements
Block Threats by Identifying Devices
- Device-ID concepts
- Configuration tasks
- View and manage devices and policies
- Monitoring devices
Block Unknown Threats
- WildFire concepts
- Configure and manage WildFire
- WildFire reporting
- Lab
- Create a WildFire Analysis Profile
- Apply WildFire Profile to security rules
- Test the WildFire Analysis Profile
- Examine WildFire analysis details
Block Threats in Encrypted Traffic
- Overview of SSL session setup
- SSL Outbound – Forward Proxy
- Certificate Generation
- Decryption Policy
- Decryption Exclusion
- SSL Inbound – Inspection
- Decryption considerations
- SSH decryption
- Master key management
- Other decryption methods and features
- Lab
- Test the firewall without decryption
- Create a self-signed certificates for trusted connections
- Create a self-signed certificates for untrusted connections
- Create and test a Decryption policy rule for outbound traffic
- Test outbound Decryption policy rule
- Export the firewall certificate and import to Firefox
- Test outbound Decryption policy again
- Review firewall logs
- Exclude URL categories from decryption using a No-Decrypt rule
- Test the No-Decrypt rule
Prevent Use of Stolen Credentials
- Credential Theft use case and solution overview
- Firewall authentication and authorization
- Creating user accounts
- Admin LDAP authentication
- FireWall Admin authentication against Azure AD
- Preventing use of stolen credentials using multi-factor authentication
- Credential-Based Attacks
- Authentication Policy
- Preventing credential theft
- Concept
- Configuration Options
- Configure Domain Credential Filtering
- Lab
- Test the firewall behavior without credential detection
- Provide the firewall with User-ID information
- Test the firewall behavior with credential detection
Block Threats Using Security Profiles
- Inspect allowed traffic
- Concept
- Security Profile Best Practices
- Block threats detected by signatures
- AntiVirus
- AntiSpyware
- Vulnerability Protection
- Control URL access
- Web Access Policy Best Practices
- Block unauthorized file transfers
- File Blocking
- Detect unknown threats
- Wildfire Profile Best Practices
- Block sensitive data transfers
- Concept
- Data Filtering
- Security policy modifications
- BPA (Demo Support Portal)
- Security Best Practices Worksheet (Demo)
- Lab
- Generate traffic without profiles and examine logs
- Create Security Profiles
- Create a Security Group
- Apply the Security Group to existing Security policy rules
- Generate traffic with profiles and examine logs
- Create tags
- Enable policy rulebase settings and observe behavior
View Threat and Traffic Information
- View threat and traffic information
- Dashboard, ACC
- Detailed Logs and Log Settings
- Session Browser
- Reporting
- Threat Investigation introduction
- Forward threat and traffic information to external services
- Telemetry (Demo)
- Log Forwarding including scheduled log exports
- Lab
- View threat information using the Dashboard
- View application information using the Dashboard
- View threat information using the ACC
- View application information using the ACC
- View threat information using the Threat log
- View application information using the Traffic log
- View threat information using App Scope reports
- View threat information using predefined reports
- View application information using predefined reports
- View threat and application information using custom reports
Add-on: Security Best PracticesOptional
- We provide students with the option for the instructor to cover these additional topics on Security Best Practices which are not part of the official course. They provide an overall view on how to put all of the threat prevention techniques discussed during the course together.
- Network Security Framework
- Heatmap and Best Practice Assessment
- BPA
- CIS Control
- Security Best Practice Worksheet
- Migration Strategy
- Migration Tool
- Designing a Web Access Policy
Add-on: IPSEC Site-to-Site VPNOptional
- Palo Alto Networks removed IPSEC Site to Site VPNs from the official course to focus the training more on cybersecurity then connectivity. However, we recognise that this might be an essential topic for many customers and therefore give students the option for the instructor to cover this topic as part of the course.
- IPsec Site to Site VPN
- VPN Configuration
- VPN Troubleshooting
Add-on: GlobalProtect Remote Access VPNOptional
- Palo Alto Networks removed GlobalProtect Remote Access VPN from the official course to focus the training more on cybersecurity then connectivity. However, we recognise that this might be an essential topic for many customers and therefore give students the option for the instructor to cover this topic as part of the course.
- Overview
- Connection Sequence
- Configuration
- Host Checks
Add-on: High AvailabilityOptional
- Palo Alto Networks removed High Availability from the official course to focus the training more on cybersecurity. However, we recognise that this might be an essential topic for many customers and therefore give students the option for the instructor to cover this topic as part of the course.
- Active/Passive and Active/Active HA overview
- Active / Passive HA configuration
Your next step
Choose the EDU-210 class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.