An engineer is configuring a firewall with three interfaces: - MGT connects to a switch with internet access. - Ethernet1/1 connects to an edge router. - Ethernet1/2 connects to a virtualization…

Question

Options

• ASet DNS and Palo Alto Networks Services to use the MGT source interface.
• BSet DNS and Palo Alto Networks Services to use the ethernet1/1 source interface.
• CSet DNS and Palo Alto Networks Services to use the ethernet1/2 source interface.
• DSet DDNS and Palo Alto Networks Services to use the MGT source interface.

• A
  9% (6)
• B
  84% (59)
• C
  4% (3)
• D
  3% (2)

Explanation

The engineer wants dynamic updates (signature/content updates) to use a dataplane interface rather than the management (MGT) interface. In Setup > Services > Service Route Configuration, you can override the default (MGT) source interface per service type. Since Ethernet1/1 connects to the edge router (internet access), setting both DNS and Palo Alto Networks Services to use ethernet1/1 (Option B) directs update traffic out through the dataplane to the internet. Option A routes traffic through MGT, not a dataplane interface. Option C uses ethernet1/2, which connects to the internal virtualization network and has no path to the internet or Palo Alto update servers. Option D references DDNS rather than DNS, which is the wrong service type for this use case.

No community discussion yet for this question.