Hi, I’m
Moses.

I completed the NDG Palo Alto Networks Firewall Essentials lab series, from initial configuration through the capstone. My work covered:

1. Initial firewall setup. Configured management access, DNS, NTP, general settings, and permitted management IP addresses.
2. Configuration management. Saved and exported configuration snapshots, previewed and reverted changes, and filtered system and configuration logs.
3. Administrator access. Created local administrator accounts and configured LDAP, RADIUS, authentication profiles, and authentication sequences.
4. Interfaces, routing, and zones. Configured Layer 3 interfaces, a virtual router, security zones, and interface management profiles; tested connectivity between lab segments.
5. Security policies. Configured rules between user, extranet, and internet zones; reviewed traffic logs, rule hit counts, and default-rule logging.
6. Network address translation. Configured source and destination NAT, generated test traffic, and reviewed the corresponding firewall logs.
7. Application control. Built application groups and App-ID security policies, identified shadowed rules, and adjusted rule order.
8. Threat prevention. Created security profiles and profile groups, applied them to policy rules, and compared traffic and logs before and after applying the profiles.
9. URL filtering. Practiced category-based blocking through security policies and URL filtering profiles, then reviewed the results.
10. WildFire analysis. Configured an analysis profile, applied it to security rules, and examined analysis results using the lab’s test file.
11. User-ID policies. Enabled User-ID and configured user- and group-based access using the identity mappings supplied in the lab.
12. Encrypted traffic inspection. Created lab certificates, configured outbound SSL decryption and no-decrypt exceptions, and reviewed firewall logs.
13. Logs and reporting. Reviewed application and threat activity through the dashboard, ACC, Traffic and Threat logs, App Scope, and predefined and custom reports.
14. Capstone. Combined interfaces, routing, security zones, NAT, security policies, and security profiles in a complete firewall configuration.

I completed World Wide Technology’s Palo Alto NGFW Foundations lab modules, covering initial configuration, policy creation, security profiles, and Policy Optimizer.

• Initial configuration. Reviewed the existing firewall setup, licensing, dashboard, and dynamic updates; created a limited-access administrator account and configured zones and interface management profiles.
• Reusable policy objects. Created address and service objects and groups to organize firewall rules.
• Service and application policies. Configured and tested service-based rules and application-based security policies.
• URL and zone protection. Applied URL filtering and DoS zone protection to the lab environment.
• Quality of service. Configured and tested a QoS policy to limit YouTube traffic.
• Security profiles. Created antivirus, anti-spyware, vulnerability protection, file-blocking, and WildFire analysis profiles; grouped and applied them to security rules.
• Policy Optimizer. Reviewed rule usage, unused rules, and observed applications, then used application information to refine security policies.
• Traffic review. Generated lab traffic, tested policy behavior, and examined log entries to review the configuration.

I built a personal Palo Alto lab in PNETLab to configure network topologies, firewall redundancy, site-to-site VPNs, and remote access.

View full-size topology (opens in a new tab) ↗

Across these projects, I worked on:

Topology, routing & firewall setup

• Imported virtual appliance images and built topologies with firewalls, network segments, and endpoint devices.
• Configured interfaces, IP addressing, and routing between VLANs, and tested device-to-device connectivity with ping.
• Configured initial firewall management and time settings.

Segmentation, security policies & NAT

• Created security zones to separate lab networks and control traffic between segments.
• Configured allow and deny security policies, tested traffic restrictions, and monitored firewall traffic logs.
• Practiced NAT rules for lab traffic and VPN scenarios.

High availability

• Configured two Palo Alto firewalls as an HA pair for redundancy.
• Set up HA1 control communication and HA2 session synchronization between the peers using private lab addressing.

IPsec VPN

• Configured site-to-site IPsec VPNs and practiced the associated routing, security-policy, and NAT settings.

GlobalProtect remote access

• Generated self-signed lab certificates and created an SSL/TLS service profile.
• Created local VPN users and an authentication profile.
• Created a dedicated security zone and tunnel interface for GlobalProtect traffic.
• Configured the GlobalProtect portal and gateway.
• Created security and NAT policies for GlobalProtect clients.

Centralized management

• Used Panorama to manage multiple firewalls in the lab environment.

I worked through six support tickets in a simulated enterprise network with Linux and Windows endpoints, VyOS routers, and an OPNsense firewall. I traced connectivity and security issues, corrected configuration problems, and documented the findings.

View full-size topology (opens in a new tab) ↗

1. FTP traffic investigation

   I filtered a supplied packet capture in Wireshark and identified the unauthorized FTP server from its greeting and the direction of client/server traffic. I documented the server address in the requested file.

2. Incorrect DNS resolution

   I traced a website redirect to an incorrect internal DNS zone overriding a public domain. I removed the zone on Windows Server, cleared the client’s DNS cache, and verified correct name resolution and browser access.

3. Routing loop between VyOS routers

   I used ping, traceroute, and routing-table checks to isolate a loop caused by an incorrect default route. I corrected the upstream next hop, committed and saved the configuration, and verified connectivity from the affected Ubuntu server.

4. Windows endpoint addressing

   I diagnosed a Windows laptop with a self-assigned 169.254.x.x address and no default gateway. After confirming the segment required static addressing, I restored its IP, subnet mask, gateway, and DNS settings, then tested internal and internet access.

5. DMZ server access

   I checked the server’s addressing and SSH service, then traced failed access to a host-specific outbound block rule in OPNsense. I removed the offending rule, applied the change, and confirmed ping and TCP/22 connectivity from outside the DMZ.

6. Unauthorized listening ports

   I inspected the server’s listening sockets with ss, compared the results with the approved port list, and normalized the output to avoid transcription errors. I documented the non-permitted ports in the requested format.

My troubleshooting approach

I established the scope, checked the affected host, followed the network path, and tested one hypothesis at a time. For configuration fixes, I made a targeted change and validated from the original endpoint; for investigation tickets, I documented the requested findings.

I completed the 67-lab AWS Certified Cloud Practitioner (CLF-C02) series on Whizlabs. My work covered:

1. Compute — 16 labs. EC2 provisioning and lifecycle operations, Windows Remote Desktop and SSH access, Elastic IPs, AMI creation, instance resizing, hibernation, and CLI automation. Container labs introduce ECS, Fargate, and EKS with kubectl; additional topics include Application Load Balancers, Auto Scaling, Lambda, and Elastic Beanstalk.
2. Database — 4 labs. RDS and DynamoDB fundamentals, connecting to RDS from EC2, and creating and working with DynamoDB tables through NoSQL Workbench.
3. Networking & content delivery — 6 labs. VPC creation through the CLI, public and private subnets, layered VPC security, NAT gateways, CloudFront distributions, and controlling CloudFront access with AWS WAF.
4. Security & compliance — 16 labs. IAM users, roles, policies, and role-based S3 access; CloudWatch monitoring, alarms, and dashboards; CloudTrail event logging and access alerts; and S3 encryption with KMS. Other topics include Trusted Advisor, WAF traffic controls, a VPN server, AWS Config compliance checks, Artifact, GuardDuty, and Macie.
5. Storage — 6 labs. S3 buckets and object access, static website hosting, EFS mounts on EC2, SNS notifications for S3 events, and KMS encryption for S3, EBS volumes, and AMIs.
6. Management & governance — 8 labs. CloudFormation and EC2 provisioning, SNS email subscriptions, CloudShell and AWS CLI commands, SQS dead-letter queues, Athena queries against S3 data, and automated EBS snapshots with Data Lifecycle Manager.
7. Billing & pricing — 4 labs. EC2 Spot Instances, Cost Explorer, AWS Budgets and alerts, and Cost and Usage Reports.
8. Challenges — 7 labs. RDS MySQL, S3 static website hosting, VPC environments, ECS containers, CloudWatch and CloudTrail alerts, EC2 event logging, and launching an EC2 instance with Apache through CloudShell.

I completed the 110-lab AWS Solutions Architect Associate (SAA-C03) series on Whizlabs, covering secure, resilient, high-performing, and cost-optimized architectures, along with challenges and projects. My work covered:

1. Design secure architectures — 21 labs. IAM and EC2 fundamentals, VPCs with public and private subnets, CloudFormation, NAT gateways and instances, VPC Flow Logs, private S3 access through VPC endpoints, network ACLs, and Transit Gateway connectivity. Security topics included GuardDuty, Macie, WAF with Application Load Balancers, KMS encryption for S3, EBS, AMIs, and RDS, CloudTrail monitoring, a VPN server, and streaming web logs with the CloudWatch Agent.
2. Design resilient architectures — 28 labs. API Gateway resources, methods, stages, parameters, Lambda integration, and logging; SQS visibility timeouts, delay queues, dead-letter queues, and private endpoints; and SNS and SES. Other work covered CloudFront origin groups, load balancing and sticky sessions, ECS and Fargate, Secrets Manager with ECS, EKS and kubectl, Step Functions workflows, connectivity troubleshooting, SQS-driven EC2 scaling, X-Ray monitoring, and EBS storage for ECS tasks.
3. Design high-performing architectures — 29 labs. S3 versioning, cross-region replication, Transfer Acceleration, static hosting, and batch operations; EFS, EBS resizing and Multi-Attach, and FSx for Lustre. Compute and networking work included Elastic Beanstalk, Auto Scaling with launch templates, Elastic IPs, Reachability Analyzer, a highly available web application with a bastion host, and Lambda vulnerability scanning with Inspector. Data topics included RDS connectivity, Multi-AZ deployments, read replicas and simulated failover, snapshot exports, DynamoDB indexes and queries, Athena, and Kinesis streaming.
4. Design cost-optimized architectures — 8 labs. EBS migration from gp2 to gp3, EC2 Spot Instances, hibernation, and instance creation from snapshots. Networking labs covered Transit Gateway configuration with Terraform, VPC peering, multiple IP addresses through elastic network interfaces, and a cross-region image viewer using VPC peering.
5. Challenges — 20 labs. Applied configuration tasks across CloudWatch events and dashboards, S3 notifications through SNS, NAT gateways, VPC endpoints, Kinesis streaming, ECS, WordPress hosting, CloudFormation stacks, and Transit Gateway. Additional challenges covered EC2-to-database connectivity, CloudFront regional restrictions, load balancing, API Gateway with Lambda, Elastic IPs, RDS Multi-AZ and failover, sticky sessions, Macie, and S3 encryption with KMS and CloudTrail.
6. Projects — 4 labs. CloudFront access controls with AWS WAF, querying VPC Flow Logs with Athena, serverless contact forms, and a Wokwi IoT device simulation connected to an AWS IoT Core real-time dashboard.