Palo Alto Networks Certified Network Security Administrator (PCNSA)Initial Configuration and ManagementMedium
A network security administrator needs to configure a Palo Alto Networks firewall to allow SNMP polling from a network monitoring station. Which of the following objects must be configured on the firewall to allow this monitoring traffic while adhering to security best practices?
- AA Management Interface Profile configured to permit SNMP from the monitoring station's IP.
- BA Zone Protection Profile applied to the zone containing the monitoring station.
- CA Service Route redirecting SNMP traffic to the monitoring station.
- DA Security Policy allowing SNMP from the monitoring station to the firewall's data plane IP.
Show answer & explanationAnswer & explanation
Correct answer: A. A Management Interface Profile configured to permit SNMP from the monitoring station's IP.
SNMP polling is traffic directed *to* the firewall's management plane. To control this access securely, a Management Interface Profile needs to be configured on the interface receiving the SNMP requests, specifying SNMP as an allowed service and restricting source IPs to the monitoring station.
Why the other options are wrong
- B. A Zone Protection Profile applies to traffic entering a zone and protects against flood attacks, not for explicitly allowing specific management protocols like SNMP from a source IP.
- C. A Service Route defines which interface the firewall uses for its *outgoing* management-plane traffic, not for *incoming* SNMP polling.
- D. Security Policies control traffic *through* the firewall, not *to* its management plane. Additionally, SNMP polling is typically directed to the management interface, not a data plane IP unless in-band management is explicitly configured.
SNMP Management Access
To allow SNMP polling to a Palo Alto Networks firewall, a Management Interface Profile must be configured on the relevant interface, permitting SNMP and specifying the source IP addresses of authorized monitoring stations.
- SNMP is a management service.
- Controlled by Management Interface Profile.
- Restricts access by service and source IP.
- Essential for secure monitoring.
Memory trick: Management Profile Makes Monitoring Possible.