Included
Video Recordings
Video recordings are included as a standard student benefit, so you can revisit demos and complex topics after the class.
Palo Alto NetworksStrata FirewallEDU-330
Firewall: Troubleshooting
Troubleshoot Palo Alto Networks Next-Generation FireWalls methodically: flow logic, packet captures, session and log analysis, decryption issues, GlobalProtect, and the CLI tools experienced engineers use in production.
- Duration
- 3 Days
- Delivery
- Live instructor-led
- Format
- Online or classroom
- Learner rating
- 4.72/51,127 Course reviews
What you will be ready to do
Get hands-on with the official Palo Alto Networks curriculum.
- Work through guided, hands-on labs on your own dedicated instance.
- Apply configuration best practices from real projects.
- Understand how the platform components work together.
- Troubleshoot common issues with a structured approach.
Who it’s for
Is EDU-330 the right course?
Designed for
Engineers who already operate Palo Alto Networks FireWalls (typically after EDU-210) and need structured troubleshooting skills for production issues.
Prerequisites
Ask for course advice Basic networking knowledge is recommended. No prior Palo Alto Networks experience is required unless stated for advanced courses.
Included
Lab Access for 3 month
You work in your own dedicated lab during the training week. FireWall courses include 3-month extended lab access after the class.
Course authority
Official curriculum
Official Palo Alto Networks curriculum
Course content
Verify the curriculum before you choose a class.
Learn by doing in a dedicated lab. Every module pairs theory with lab time, so you practise each step the way you would on the job. The pace suits engineers who are new to the platform as well as administrators who want to close gaps and adopt best practices across their deployment.
Best Practices & real Life Experience
Your instructor brings years of real-world Palo Alto Networks project experience into the classroom and shares field-proven best practices throughout the course.
Certification
This course supports the matching Palo Alto Networks certification path. Ask our training team which exam and preparation route fits your goals.
Scope
The course follows the official Palo Alto Networks curriculum for the version listed in the schedule.
FAQ
Questions about formats, time zones, payment options, or team training? Contact the training team at training@consigas.com.
Genuine learner feedback
Students Love Our Instructors
Based on 1,127 course reviews
Featured learner reviews Reviews collected via Reviews.io ↗
View the complete Consigas profile on Reviews.io (opens in a new tab).
Ben Jones at Enloe Medical Center
Verified via Reviews.io
This course is exactly what I needed. I learned skills and techniques during this course that I am certain will, help me to troubleshoot issues that are happening right now in our production environment, and will eliminate our need to open a TAC case in some instances.
Jie Song at Verizon
Verified via Reviews.io
After the training, I am more clear about the packet and session concept in Palo Alto firewalls. Also, I learned some new troubleshooting skills by using CLI commands. Such as debug level packet captures, debug logging, as well as how to check and analyze the log and pcap files, especially the part of troubleshooting the IPSec VPN issues is really impressive.
Koen van der Eynde at Cheops
Verified via Reviews.io
I thought the training was perfect. I learned a lot about how a Palo Alto firewall handles certain network traffic. Also learned good tips and tricks to solve network (traffic) problems faster and easier.
I also really liked the course because during the training you learn how to quickly troubleshoot problems and better understand what to configure or adjust in case of a possible network problem or an optimization of the security rules on a Palo Alto firewall.
Alice Huff at Optiver
Verified via Reviews.io
Appreciated the implementation of further digging tools and understanding session flows for troubleshooting when basic troubleshooting fails. Also appreciated the further dive into cli and logs available only from cli. Additionally thought it was really helpful that you can create filters for packet capture as a lot of end users do not know how to use a packet capture tool and provide appropriate pcaps.
Anonymous
Verified via Reviews.io
A good way in to understanding just what Palo Alto firewalls can do and the different ways of configuring them. I especially appreciated getting to know the CLI commands which I think will speed up my efficacy at work considerably.
The lab setup was generally very good, unfortunately there was one issue with the User-ID lab where a script was missing, but I think this will be corrected soon. The labs and infrastructure was however generally very well designed and it's great that they are available for 3 months after the course, that is an improvement on other training providers where they only stay online for a week or so.
Anonymous
Verified via Reviews.io
Overall this course is excellent for new users. I would highly suggest taking this course if you are new to Palo Alto Firewalls. The sooner the better, it will help you get a good understanding on how these firewalls operate and will help you stand up these firewalls in your network.
Page 1 of 2
Course agenda
Explore the complete EDU-330 agenda.
The “Firewall: Troubleshooting” course covers the following content.
Select a module to see its topics and lab activities.
Tools and Resources
- Troubleshooting Enablement
- Basic Troubleshooting Methodologies
- Options for Information and Support
- Status Monitoring Tools
- Maintenance Mode
- Lab – Tech Support Files
- Validate the basic functionality of your lab environment
- Use the web interface to get a Tech Support File
- Decompress the Tech Support File
- Explore the Tech Support File
- Lab – Use the CLI to Export a Tech Support File Lab
- Use the CLI to generate a Tech Support File
- Use the CLI to export a Tech Support File
- Validate the exported Tech Support File
CLI Primer
- Scope and Structure of the CLI
- Operational vs Configuration Mode
- Network discovery use case
- Configuration Mode
- Data Displayed Through less
- Syntax and feedback for invalid commands
- Displaying and navigating command output
- Using the CLI as a troubleshooting tool
- Lab – CLI Fundamentals
- Import, Load, and Commit a Configuration File
- Confirm the Current Device Configuration
- Explore Options for Changing Other Device Settings
- Change the Current Device Setting
- Lab – Use the CLI to Modify Policy Objects
- Review the Existing Policy Configuration
- Examine a Configuration and Discover Options for How to Modify It
- Modify Object Parameters
- Review Changes and Commit the Configuration
- Test URL Filtering Profile Changes
Flow Logic
- Session Flow and App-ID
- Flow Logic Overview
- TCP Sessions and States
- Flow Logic Details
- Key terms
- Data flows per processing stage
- Lab – Tracing Packet Flow
- Open an existing packet-diagnostics file
- Trace the first packet through the firewall
- Trace the second packet
- Trace the content inspection of a packet
- Identify firewall-generated packets
- Identify dropped packets and the session end
Packet Captures
- Packet Capture Concepts
- Configuring Packet Captures
- Using the web interface
- Using the CLI
- Lab
- Test baseline functionality
- Configure a packet filter
- Test session marking
- Configure capture stages
- Turn on packet capture and capture packets
- Analyze the pcaps
- Add a Security policy configuration to drop traffic
- Reconfigure the filter
- Capture and analyze the pcaps
Packet-Diagnostics Logs
- Debug-level Diagnostic Log Features
- Usage Best Practices
- Interpreting flow-basic output
- Hardware assistance and offloading
- Lab
- Start-up and verify external connectivity to the FTP server
- Verify the problem with the internal client
- Examine firewall Traffic logs and Threat logs
- Configure the packet filter
- Check global counters
- Configure and run packet capture and flow basic
- Interpret the flow-basic log and pcaps
- Implement a solution and verify it
- Check logs and enable logging for increased visibility
Transit Traffic
- Troubleshoot Transit Traffic
- Re-create the issue
- Discover the network – check interface IPs, routing, ARP
- Traffic logs
- Session table
- Set filter and check global counter
- Debug flow basic and packet captures
- Lab – App-ID and Torrents
- Apply a baseline configuration to the firewall
- Torrent sites
- Traffic log: Application data
- Enable traffic
- Test policy rule “deny”
- Policy rule to block torrents
- Add a File Blocking Profile
- Lab – Blocking Tor
- Lab challenge and checklist
- Solution: Security policy to block Tor App-ID
- Solution: Use application filters
- Solution: Block risky URL categories
- Solution: Deny unknown applications
- Solution: Block untrusted and expired certificates with a Decryption Profile
- Solution: Turn on SSL decryption
- Solution: Implement an External Dynamic List (EDL)
Host-inbound Traffic
- Host-Inbound Traffic
- Management Services
- Lab – Host-Inbound Traffic NTP Example
- Apply a baseline configuration to the firewall
- Review the System log
- Use CLI commands to get more information
- Use tcpdump to capture packets
- Diagnose the problem
- Questions for discussion
IPSEC VPN Troubleshooting
- VPN Concept
- VPN Troubleshooting
- Lab – VPN Traffic Case A
- Review the network topology and verify the problem
- Check routing and security policy rules
- Change strategy: Try a top-down approach instead
- Check the health of the VPN tunnel
- Initiate VPN connection from the remote network
- Troubleshoot as the responder
- Check proxy ID settings and correct the problem
- Lab – VPN Traffic Case B
- Verify a problem with SFTP access to a web server
- Review the Traffic logs and System logs
- Check the high-level health indicators for the tunnel
- Troubleshoot as the responder
- Fix the problem and verify functionality
System Services
- Identifying performance issues
- Baseline service performance
- Performance Troubleshooting use cases
- System Services Daemons
- Gathering more data
- Lab
- Check running services
- Review the logs for a specific service
- Change the debug log level for a service
- Restart a service
- Restart a service and monitor a data-plane session
- Investigate the event
Certificate Management and SSL Decryption Troubleshooting
- Verify that SSL decryption is applied via certificate chain
- Accessing site via its IP vs FQDN
- Intermediate CA missing
- SSL Labs
- Session end reason
- Show session flag | count yes
- Show counter global filter category proxy
- Exclude URLs / certificates without pinching holes into the FireWall
- Client authentication and SSL Decryption Exclusion
- External factors that complicate SSL decryption
- Lab
- Apply a baseline configuration to the firewall
- Verify the functionality of SSL decryption
- Create a tag and a dynamic address group
- Create a Decryption policy rule
- Create custom Vulnerability signatures
- Configure a Log Forwarding profile
- Configure a Vulnerability Protection profile to generate alerts
- Add the Log Forwarding profile to a Security policy rule
- Test the configuration and confirm results
User-ID
- User-ID Mapping Flow
- User-ID Troubleshooting
- Recreate the issue, no users showing log
- System log, verify and fix user mapping issue
- show user ip-user-mapping all
- Event log
- Verify ldap connectivity
- Show user user-ids match-user xxx
- Verify group mapping in security policy incl. ldap browser
- Verify group users matches IP user
- Lab
- Apply a baseline configuration to the firewall
- Diagnose and fix the problem
- Review reference information
- Solution: Enable User-ID on the correct zone
- Solution: Fix the LDAP Server Profile
- Solution: Fix the Authentication Profile Server type
- Solution: Add the correct IP for server monitoring
GlobalProtect
- Connection Sequence
- GlobalProtect Troubleshooting
- system log – check and fix group mapping
- Verify certificate
- Check internal host detection
- Review support file
- Lab
- Apply a baseline configuration
- Download the GlobalProtect agent
- Connect to the external gateway
- Disconnect the connected user
- Advanced scenario: Pre-logon and certificates
Escalation and RMAs
- Case management
- Hardware failure and return merchandise authorizations (RMAs)
- Escalation and support events
Your next step
Choose the EDU-330 class that fits your schedule.
Compare dates and prices first. If you are still confirming timing, you can reserve this course for free or ask the training team for advice.