PAN-OS Network Operator
Learn PAN-OS on bounded PA-440 training benches, with a separate PA-1410 two-VSYS bench for virtual-system isolation, progressing from CLI and interfaces through security policy, identity, VPNs and managed operations.
Choose your first lab
Meet the CLI · First Contact
- Labs ready
- 556
- In progress
- 0
- Checklist steps
- 0/3860
556 labs ready
Course foundation
PAN-OS operations foundations
Work through CLI, architecture, interfaces, routing, policy, NAT, services, application control, identity/VPN, managed operations, virtual-system isolation and bounded APIs. Six integrated operator assessments follow the preserved standalone assessments.
- Training appliances
- PA-440 · provisioned PA-1410 for multi-VSYS
- Release family
- PAN-OS 12.1
- Available in beta
- 556 activities
- Course outline
- 21 available chapters · six integrated assessments
How to study with the official manuals
Use the EDU-210 outline to follow the conceptual progression, and the PAN-OS CLI Quick Start and release-specific documentation to practise configuration. Compare candidate and running state, validate, commit, and verify every change. When progressing toward NGFW Engineer, review its current datasheet and digital learning path, then include Panorama training and the specialist deployment topics.
Curriculum
Open a stage to inspect its lessons and labs.
Stage 1
Meet the CLI
Learn the PAN-OS operating workflow through 18 lessons, checkpoints, and practical exams.
Stage 2
Firewall Portfolio & Architecture
Understand where a next-generation firewall fits and how PAN-OS separates management and traffic processing.
Stage 3
Device Administration & Authentication
Extend CLI configuration habits into secure firewall administration.
Stage 4
Interfaces, Zones & Deployment
Thirty activities build local Layer 3 boundaries and verify Layer 2, virtual-wire, and tap deployments.
Stage 5
Routing & Services
Connect the firewall to routed networks and verify the path before applying traffic policy.
Stage 6
Security Policy & Objects
Express permitted traffic with reusable objects and ordered security rules.
Stage 7
NAT & Published Services
Translate addresses and verify how NAT, routing, and security policy interact.
Stage 8
Threat Prevention & URL Filtering
Apply inspection profiles to permitted traffic and interpret their decisions.
Stage 9
User-ID & Identity Policy
Connect user identity to network access decisions.
Stage 10
Certificates & TLS Decryption
Establish certificate trust and inspect encrypted traffic under an explicit policy.
Stage 11
Logging, Monitoring & Maintenance
Use operational evidence to maintain and troubleshoot a firewall.
Stage 12
VPN & GlobalProtect
Connect remote sites and users with authenticated tunnels.
Stage 13
High Availability
Preserve firewall service during device and path failures.
Stage 14
Panorama & Deployment Options
Extend standalone administration to centrally managed deployments.
Stage 15
Automation & Operations Capstone
Apply reviewed changes and demonstrate an integrated firewall deployment.
Stage 16
Branch Network Services
Deliver DHCP and DNS with native service configuration and verified exchanges.
Stage 17
Application Control and Inspection
Identify requests, enforce application services and distinguish security from URL inspection.
Stage 18
Advanced Routing
Route tagged and aggregate paths, learn IPv4 routes, constrain redistribution and isolate logical-router VRFs.
Stage 19
Identity, Trust and VPN
Authenticate identities, diagnose certificate trust and prove site-to-site and remote-access traffic.
Stage 20
Resilience and Managed Operations
Operate a bounded active/passive pair, inspect local logs, and apply scoped management and API changes.
Stage 21
Cumulative Operator Assessment
Apply prior skills independently across six separately provisioned benches. These profiles do not imply one combined network.
Course details and blueprint
What you will be able to do
- Choose firewall deployment roles and distinguish management, configuration, and traffic evidence.
- Navigate operational and configuration modes with native help.
- Inspect candidate and running configuration, then validate and commit changes.
- Configure management settings and recover candidate changes from a saved snapshot.
- Attach Layer 3 addressing, a classic virtual router and zone; verify same-ingress local ARP and ICMP.
Path notes
- Designed for
- Network learners and operators beginning standalone Palo Alto Networks firewall administration.
- Recommended knowledge
- Basic IPv4 addressing and an interest in firewall operations
- Availability
- All 556 published activities are free in beta across 21 available chapters. Most practical benches model a PA-440 in the PAN-OS 12.1 release family; multi-VSYS activities use a separately provisioned PA-1410 two-VSYS bench with seven physical ports modeled from the larger chassis. Deployment and integration design exercises execute no external hardware or cloud service. Six fresh integrated assessments combine supported skills on explicitly bounded benches. Each practical activity supplies its own bounded configuration and supported traffic. Identity and TLS use authored events and modeled certificates; no real cryptography or external identity service executes. Management/API transactions run locally, with no Panorama or external API connection. General proprietary App-ID remains outside this release. Source-qualified command syntax and the 12.1 simulator label do not claim verified hardware transcripts, full certification coverage or exact appliance-output parity.
Blueprint and sources
PA-440 / PAN-OS 12.1 operator foundation · Reviewed 2026-09-07