An administrator wants a new Palo Alto Networks NGFW to obtain automatic application updates daily, so it is configured to use a scheduler for the application database. Unfortunately, they required…

Question

Options

• ADownload and install application updates cannot be done automatically if the MGT port cannot reach the Internet.
• BConfigure a service route for Palo Alto Networks Services that uses a dataplane interface that can route traffic to the Internet, and create a Security policy rule
• CConfigure a Policy Based Forwarding policy rule for the update server IP address so that traffic sourced from the management interfaced destined for the
• DConfigure a Security policy rule to allow all traffic to and from the update servers.

• A
  5% (1)
• B
  79% (15)
• C
  5% (1)
• D
  11% (2)

Explanation

Option B is correct because Palo Alto Networks NGFWs support service routes, which redirect specific management-plane traffic (like update checks) through a designated dataplane interface instead of the default MGT interface. By pointing the "Palo Alto Networks Services" service route to a dataplane interface with Internet access, the firewall can reach Palo Alto's update servers - and the accompanying Security policy rule permits that traffic to pass through.

Why the others are wrong:

• A is false - service routes exist precisely to solve this problem; isolation of the MGT port is not a dead end.
• C is a trap: Policy Based Forwarding (PBF) acts on transit traffic passing through the dataplane, not on traffic sourced by the firewall itself (management plane); it cannot reroute update traffic originated by the system.
• D alone is insufficient - a Security policy rule only controls what traffic is allowed through; without a service route, update traffic still tries to exit through the isolated MGT interface and never reaches the Internet.

Memory tip: Think of service routes as "management traffic detours" - when the MGT road is closed, a service route tells the firewall which dataplane on-ramp to use instead. Any time a PAN question involves the MGT port being blocked + a management function needing Internet, the answer almost always involves a service route.

No community discussion yet for this question.