topic Re: which answer is right? in General Topics

which answer is right?

Radmin_85 — Thu, 31 May 2018 17:51:35 GMT

A company needs to preconfigure firewalls to be sent to remote sites with the least amount
of reconfiguration. Once deployed, each firewall must establish secure tunnels back to multiple regional data centers to include the future regional data centers.Which VPN configuration would adapt to changes when deployed to the future site?

A. Preconfigured GlobalProtect satellite
B. Preconfigured GlobalProtect client
C. Preconfigured IPsec tunnels

D.Preconfigured PPTP Tunnels

I would like to find the correct answer for this question

Re: which answer is right?

BPry — Thu, 31 May 2018 18:01:13 GMT

@Radmin_85,

Are you trying to get answers for your ACE test 😜

The answer that Palo would be looking for is A. If the GlobalProtect Satellite configuration is done correctly it's vastly easier than having to preconfigure IPsec Tunnels.

Re: which answer is right?

Radmin_85 — Thu, 31 May 2018 18:17:09 GMT

Why not D ?

Re: which answer is right?

BPry — Fri, 01 Jun 2018 14:33:10 GMT

@Radmin_85,

Because this is a Palo Alto exam and they are looking for the Palo Alto answer 😉

Honestly though you need to know more information to properly form a tunnel when you aren't using the Satelite configuration. Once you have that configured this is honestly the best answer for doing something like this; Palo has made it super easy to deploy remote firewalls without much preconfiguration at all.

Re: which answer is right? A

MelvinSical — Thu, 14 May 2020 17:27:51 GMT

Preconfigured GlobalProtect satellite

When a GlobalProtect satellite connects and successfully authenticates to the GlobalProtect portal, the portal delivers a satellite configuration, which specifies what gateways the satellite can connect to. If all your satellites will use the same gateway and certificate configurations, you can create a single satellite configuration to deliver to all satellites upon successful authentication. However, if you require different satellite configurations—for example if you want one group of satellites to connect to one gateway and another group of satellites to connect to a different gateway—you can create a separate satellite configuration for each. The portal will then use the enrollment username/group name or the serial number of the satellite to determine which satellite configuration to deploy. As with security rule evaluation, the portal looks for a match starting from the top of the list. When it finds a match, it delivers the corresponding configuration to the satellite.