Palo Alto Networks Certified Network Security Engineer (PCNSE)Deploy and ConfigureMedium
A network security engineer is deploying a new Palo Alto Networks firewall and needs to integrate it into an existing network that uses OSPF for dynamic routing. The firewall must advertise its connected networks to the OSPF domain and learn routes from other OSPF routers. Which configuration step is essential to enable OSPF routing on the firewall?
- AConfigure a Static Route for each connected network.
- BEnable Redistribution of connected routes into OSPF.
- CCreate a Policy-Based Forwarding rule for OSPF traffic.
- DAssign the interface to a Virtual Router and enable OSPF.
Show answer & explanationAnswer & explanation
Correct answer: D. Assign the interface to a Virtual Router and enable OSPF.
To enable OSPF routing, interfaces participating in OSPF must be assigned to a Virtual Router, and then OSPF itself must be enabled and configured within that Virtual Router. This allows the firewall to exchange OSPF routing information with neighbors.
Why the other options are wrong
- A. Static routes are manually configured and do not participate in dynamic routing protocols like OSPF.
- B. Redistribution is used to share routes learned from one routing source (e.g., connected, static, or another protocol) into OSPF, but OSPF itself must first be running within a Virtual Router.
- C. Policy-Based Forwarding (PBF) is for overriding the routing table based on policy, not for enabling a dynamic routing protocol like OSPF.
Palo Alto Networks Virtual Router
A Virtual Router on a Palo Alto Networks firewall is a logical routing instance that maintains its own routing table and participates in dynamic routing protocols like OSPF or BGP.
- Interfaces are assigned to a Virtual Router to participate in routing.
- Can run multiple routing protocols simultaneously.
- Default 'VR-Default' is always present.
Memory trick: Virtual Router Routes Traffic, OSPF Learns Paths.