AvailabilitySign inBook a DemoJoin Waitlist
Back to Learning
Palo Alto · PCNSE

NGFW Zones, NAT & App-ID

The NAT rule is right and the session still dies. Test the policy match against the real evaluation order, live, right below.

Interactive simSecurityNATNGFW

Symptom

Security zones, source/destination NAT, App-ID security policies and SSL decryption on PAN-OS.

Your mission

Inspect, recover, then verify

Format

PAN-OS CLI

Start interactive labSee the investigation plan ↓Need a hint? Reveal the root cause ↓
PAN-OS: The NAT Rule the Security Policy Never Matched

Investigate before you configure.

Use the CLI evidence to isolate the fault, make the smallest safe correction, then verify the network state changed.

Observe the symptom and link state.

Diagnose by comparing the protocol evidence.

Verify the expected device state and confirm the original symptom is resolved.

Console access: PA-VM

This workspace stacks for portrait phones. Rotate to landscape for the full split-screen console.

Need a hint?

Reveal the root cause when you're ready.

Try the investigation first, then use this as your escape hatch, not a dead end.

Locked

Sign up with your email to open NGFW Zones, NAT & App-ID, free. You get the root cause and the full step-by-step fix.

No spam. The fix lands in your inbox too. Signing up includes 4 guided labs free, tracked against your email. After that, the Learning Pass unlocks every remaining lab.

Lab debrief

Turn the session into a repeatable troubleshooting pattern.

Use this reference after your attempt: first explain the symptom, then verify the evidence, then confirm the repair.

The problem

An internal host tries to reach a public web server through a configured NAT rule, but the session never completes, and the firewall's logs don't make it obvious why.

What you'll practice

  • Design and configure security zones on PAN-OS
  • Configure source NAT and destination NAT rules
  • Write App-ID-based security policies instead of port-based rules
  • Enable SSL decryption and inspect the resulting traffic
  • Read and interpret PAN-OS traffic and threat logs

The topology

A PAN-OS firewall sits between an internal host and an external router, with distinct trust/untrust zones, the minimum real topology needed to configure zones, NAT and App-ID policy the way PCNSE expects.

Commands to run yourself

The real diagnostic commands for this lab, copy-paste ready. Run these in the same order to reproduce the investigation on your own session.

Read the traffic log
show log traffic direction equal backward
Test the NAT policy match
test nat-policy-match from untrust to dmz source 203.0.113.25 destination 198.51.100.10 protocol 6 destination-port 443
Test the security policy match
test security-policy-match from untrust to dmz source 203.0.113.25 destination 198.51.100.10 protocol 6 destination-port 443

Topology diagram

Fact-checked references

The commands and behaviour in this lab were checked against these primary references.

Frequently asked

Do I need my own PAN-OS license or image?

No. The firewall image and a working license are already in place. You focus on configuration, not procurement.

Does this help with the PCNSE exam?

Zones, NAT and App-ID policy are core PCNSE topics. This lab gives you hands-on repetition on exactly that scope.

Ready to run this lab yourself?

No setup, no image sourcing. Book a session or ask for a live demo.

View availabilityBook a demo