Glossary

A

Active/Active HA

An HA mode where both firewalls in a pair actively pass traffic simultaneously rather than one sitting idle in standby, at the cost of extra config complexity around session/NAT synchronization. See: High Availability

Active/Passive HA

The more common HA mode: one firewall actively passes traffic while its peer stays in standby, ready to take over via a failover if the active unit fails. See: High Availability

Admin Role Profile

A custom, Role Based admin profile scoped to exactly the web UI/CLI/XML API areas a job function needs; unlike Dynamic roles it does not auto-inherit access to new features after an upgrade. See: Admin Accounts & RBAC

Advanced DNS Security

Adds cloud-based domain-detection engines that inspect DNS responses in real time, catching hijacked or misconfigured domains beyond the base DNS Security service's sinkholing. See: DNS Security

Advanced Threat Prevention (ATP)

Adds an inline, cloud-based deep-learning detection engine on top of Threat Prevention, aimed specifically at evasive and unknown command-and-control traffic that static signatures miss. See: Threat Prevention

Advanced URL Filtering

Layers a cloud-based ML web-security engine on top of PAN-DB category filtering, inspecting pages in real time to catch freshly-created phishing/exploit sites a crawled database hasn't seen yet. See: URL Filtering

Advanced WildFire

Adds Intelligent Run-time Memory Analysis — a cloud engine inspecting in-memory behavior — to catch sandbox-evasive malware that detects and hides from standard WildFire detonation. See: WildFire

Aggregate Ethernet (AE)

Bundles multiple physical interfaces together for higher throughput and link redundancy, appearing to policy as a single logical interface. See: Network Interfaces Deep Dive

App-ID

Palo Alto's patented traffic-classification engine that identifies the actual application in a session — via signatures, decryption, protocol decoders, and heuristics — regardless of port or evasion technique. See: App-ID

Authentication Policy

A distinct policy layer evaluated before Security Policy that can force an interactive challenge (e.g. Captive Portal, MFA) before a session is allowed to match a security rule. See: Authentication Services

Authentication Profile

A named object defining how a set of users authenticate against one backend (LDAP, RADIUS, SAML, Kerberos, TACACS+, or local database); Authentication Sequences chain several profiles together for fallback. See: Authentication Services

C

Candidate Configuration

The working draft of firewall config that admins edit; it has zero effect on live traffic until explicitly pushed to the running configuration via Commit. See: Connecting & Managing a Firewall

Captive Portal

An interactive web-based authentication challenge the firewall presents to map an unknown IP address to a user identity, used both as a User-ID source and an Authentication Policy enforcement mechanism.See: Authentication Services

Certificate Management

Centralized handling of the keys/certificates and trust chains that secure decryption, GlobalProtect, Authentication Portal, and admin/API access across their full lifecycle. See: Certificate Management

CN-Series

Palo Alto's containerized firewall built to run inside Kubernetes clusters, enforcing the same App-ID/User-ID/Content-ID policy model at the pod-to-pod traffic layer. See: CN-Series Overview

Cloud Identity Engine (CIE)

A cloud-hosted identity service that syncs directory data (Azure AD, Okta, on-prem AD) and normalizes it for consumption by NGFW/Prisma Access, reducing reliance on on-box User-ID agents. See: Cloud Identity Engine

Commit

The action that pushes the candidate configuration into the running configuration, actually affecting traffic; can be scoped (partial commit) by admin or config location, and preceded by Validate/Preview. See: Connecting & Managing a Firewall

Content-ID

The stream-based content-inspection engine that applies IPS, antivirus, anti-spyware, URL categorization, file/data filtering, and DNS analysis to already-classified traffic in real time. See: Content-ID

Credential Phishing Prevention

A URL Filtering feature that detects corporate credential submissions to web forms and restricts which URL categories are allowed to receive them. See: Credential Phishing Prevention

D

Decrypt Mirror

A dedicated interface mode that feeds a copy of decrypted plaintext traffic to an external DLP/forensics tool for out-of-band inspection. See: Network Interfaces Deep Dive

Decryption (SSL/TLS & SSH)

Turns ciphertext back into plaintext for inspection then re-encrypts it, via SSL Forward Proxy (outbound MITM), SSL Inbound Inspection (using the server's own private key), or SSH Proxy. See: SSL/TLS & SSH Decryption

Destination NAT

Translates a packet's destination address (typically a public IP) to an internal server address, used for inbound port-forwarding — one-to-one or one-to-many. See: NAT

Device Telemetry

Opt-in data the firewall uploads to Palo Alto (product usage, threat data, device health) that feeds threat intelligence and ML models like Advanced WildFire and Advanced Threat Prevention. See: Device Telemetry

DIPP (Dynamic IP and Port)

A source NAT mode that lets one public IP serve many internal hosts by translating and multiplexing on port numbers; oversubscribing it too aggressively can exhaust the port pool under heavy load. See: NAT

DNS Security

A cloud service that generates DNS-threat signatures via predictive analytics/ML and sinkholes malicious lookups, closing off DNS-based C2 and exfiltration channels. See: DNS Security

DoS Protection Profile/Rule

Targets specific high-value systems (e.g. internet-facing servers) with flood and session-exhaustion defenses, layered on top of broader Zone Protection. See: Zone Protection & DoS Protection

Dynamic Role

A built-in admin role (Superuser, Device administrator, Virtual system administrator, and read-only variants) that PAN-OS updates automatically as new features ship, unlike custom Role Based profiles. See: Admin Accounts & RBAC

Dynamic User Group (DUG)

A group whose membership is driven by tag matching rather than static directory group assignment, letting policy react automatically as users are tagged (e.g. by a SOC playbook). See: User-ID Redistribution & Dynamic User Groups

G

GlobalProtect

Palo Alto's remote-access VPN client/gateway solution, also used as a User-ID source and as an LSVPN hub-and-spoke option for branch/large-scale VPN deployments. See: GlobalProtect

Gateway Load Balancer (GWLB)

An AWS/Azure construct that transparently steers traffic through a scale-out pool of VM-Series firewalls sitting in a shared security VPC/VNet "hub," using GENEVE encapsulation. See: AWS Gateway Load Balancer

H

High Availability (HA)

Pairs two firewalls (active/passive or active/active) to eliminate a single point of failure; note that decrypted SSL sessions do not sync between HA peers, so a failover restarts those sessions fresh. See: High Availability

I

Intelligent Run-time Memory Analysis (IRMA)

The Advanced WildFire cloud engine that inspects a sample's in-memory behavior specifically to catch malware that detects and evades traditional sandboxing. See: WildFire

M

Multi-Factor Authentication (MFA)

Requires a second verification factor (push, OTP, hardware token) beyond a password before granting access, enforceable at the firewall via Authentication Policy and MFA vendor integrations. See: Multi-Factor Authentication

N

NAT (Network Address Translation)

Translates private, non-routable addresses to routable ones (or vice versa); evaluated as a separate policy layer from Security Policy, so rules must reference the correct pre-/post-NAT address. See: NAT

NAT64

Translates between IPv4 and IPv6 address families, used as an interop/migration mechanism when parts of the network are still IPv4-only. See: NAT

NPTv6

IPv6-to-IPv6 prefix translation, used to renumber or hide internal IPv6 prefixes similarly to how NAT hides IPv4 addressing. See: NAT

P

PAN-DB

Palo Alto's cloud URL categorization database that URL Filtering profiles enforce policy against; a local cache reduces lookup latency with cloud fallback for uncached URLs. See: URL Filtering

Panorama

Palo Alto's centralized management platform for pushing shared policy/config, aggregating logs, and managing software/content updates across a fleet of firewalls. See: Panorama

Perfect Forward Secrecy (PFS)

A property of DHE/ECDHE key exchange where each session gets a unique ephemeral key, so a compromised long-term key can't be used to retroactively decrypt captured traffic; supported by PAN-OS decryption. See: SSL/TLS & SSH Decryption

Platform Security (IMA)

Runtime integrity and posture reporting for PAN-OS itself, giving assurance that a device's software/boot state hasn't been tampered with. See: Platform Security (IMA)

Policy Optimizer

A PAN-OS tool that highlights port-based rules with real traffic history so they can be safely migrated to App-ID-based rules, and flags unused apps/rules for rulebase cleanup. See: Security Policy & Zone-Based Architecture

Prisma AIRS

Palo Alto's AI Runtime Security product family, covering discovery, deployment, and defense of AI/LLM-based applications and agents rather than traditional network apps. See: Prisma AIRS Overview

R

Role-Based Access Control (RBAC)

Scopes what an admin account can see/do via either built-in Dynamic roles or custom Role Based profiles, optionally combined with access domains on multi-vsys systems. See: Admin Accounts & RBAC

Running Configuration

The configuration actually enforcing traffic right now, updated only when a Commit is performed against the candidate configuration. See: Connecting & Managing a Firewall

S

SCIM Provisioning

System for Cross-domain Identity Management — an automated protocol for syncing user/group lifecycle events (create, update, deprovision) from an IdP into Palo Alto's identity services. See: SCIM Provisioning

Security Policy

The ordered rulebase (zone/IP/app/user/service match criteria, first-match-wins, top-to-bottom) that decides whether to allow or block a session. See: Security Policy & Zone-Based Architecture

Single-Pass Architecture (SP3)

Palo Alto's dataplane design that classifies traffic once and applies every relevant security function to that single pass, instead of chaining separate re-scanning engines like legacy UTM appliances. See: Single-Pass Architecture

Source NAT

Translates a packet's source address, typically for outbound traffic; can be static, dynamic-IP, or dynamic-IP-and-port (DIPP). See: NAT

SSH Proxy

Decrypts SSH sessions to police tunneling inside SSH without requiring any certificates, then re-encrypts before forwarding. See: SSL/TLS & SSH Decryption

SSL Forward Proxy

For outbound traffic, the firewall man-in-the-middles the TLS session, presenting a certificate signed by an internal forward-trust CA that client endpoints must trust. See: SSL/TLS & SSH Decryption

SSL Inbound Inspection

For traffic to your own servers, the firewall holds the server's actual private key so it can decrypt without re-signing or breaking client trust. See: SSL/TLS & SSH Decryption

Strata Logging Service

Palo Alto's cloud-based log storage/retention service, decoupling long-term log retention from any single Panorama or firewall's local disk. See: Strata Logging Service

T

Tap Mode

A passive interface mode fed by a SPAN/mirror port for zero-impact monitoring/visibility; it informs but does not enforce policy. See: Network Interfaces Deep Dive

Threat Prevention

Combines antivirus, anti-spyware/C2 detection, vulnerability protection (IPS), and DNS-query analysis on already App-ID/Content-ID-classified traffic. See: Threat Prevention

U

URL Filtering

Enforces category-based access control per PAN-DB URL category, plus credential-phishing detection and header/SafeSearch controls; no longer sold standalone from Advanced URL Filtering. See: URL Filtering

User-ID

Maps network activity to an actual user identity (via AD/LDAP, Terminal Server agents, Captive Portal, GlobalProtect) so policy and logs are attributable to people, not just IPs. See: User-ID

User-ID Redistribution

Shares IP-to-user mappings between firewalls/Panorama so a mapping learned at one enforcement point is usable at another without re-authenticating the user. See: User-ID Redistribution & Dynamic User Groups

V

Virtual Wire

An interface mode that binds two physical interfaces transparently with no IP/routing changes needed, giving the easiest drop-in insertion for a POC or migration. See: Network Interfaces Deep Dive

Virtual System (vsys)

A logically separate firewall instance on shared physical hardware, each with its own policy/objects/admins; a Virtual system administrator role can't touch shared network objects like interfaces or virtual routers. See: Virtual Systems

VM-Series

Palo Alto's virtualized firewall form factor for AWS/Azure/GCP/on-prem hypervisors, licensed and sized independently of physical appliances. See: VM-Series Requirements & Licensing

W

WildFire

Palo Alto's cloud-based malware sandbox that detonates unknown files in a virtual environment to observe real behavior, rather than relying only on static signatures. See: WildFire

Z

Zone

A named trust boundary (e.g. Trust, DMZ, Untrust) built on top of interfaces, letting Security Policy be written per trust-level rather than per interface/subnet. See: Security Policy & Zone-Based Architecture

Zone Protection Profile

Applies per-zone defenses against flood, reconnaissance, packet-based, and non-IP-protocol attacks — included at no extra license cost. See: Zone Protection & DoS Protection