Palo Alto Networks Certified Network Security Engineer (PCNSE)Plan and DesignMedium
A network architect is designing a redundant external service solution for DNS and NTP servers, which are critical for firewall operations. The design requires that if the primary external DNS or NTP server becomes unreachable, the firewall automatically switches to a secondary server without manual intervention. Which configuration element ensures this automatic failover for external services?
- AImplementing BGP routing with the external service providers.
- BUtilizing separate interfaces for primary and secondary servers.
- CConfiguring only a single primary DNS/NTP server.
- DSpecifying multiple DNS addresses and NTP servers in the firewall's configuration.
Show answer & explanationAnswer & explanation
Correct answer: D. Specifying multiple DNS addresses and NTP servers in the firewall's configuration.
Palo Alto Networks firewalls support specifying multiple DNS addresses and NTP servers. When configured, the firewall will automatically attempt to use a secondary server if the primary becomes unreachable, ensuring redundancy and automatic failover for these critical services.
Why the other options are wrong
- A. BGP is a routing protocol used for exchanging routing information between autonomous systems and is not directly used for configuring failover of external DNS/NTP services on the firewall itself.
- B. Using separate interfaces might provide network path redundancy but doesn't inherently configure the firewall to failover between primary/secondary external service providers without specifying multiple servers.
- C. Configuring only a single server eliminates redundancy and prevents automatic failover.
Redundant External Service Configuration
The practice of configuring Palo Alto Networks firewalls with multiple external service providers (e.g., DNS, NTP, Syslog, Authentication servers) to ensure high availability and automatic failover if a primary server becomes unreachable, maintaining continuous firewall operations.
- Ensures high availability of services
- Automatic failover to secondary servers
- Critical for continuous firewall operation
- Configured in system settings
Memory trick: Redundancy: Always have a backup plan for critical services.