An IPSec tunnel is configured between two Palo Alto firewalls, but the tunnel is flapping (going up and down). The engineer checks the IKE gateway and sees that the 'Dead Peer Detection' (DPD) is enabled. What could be causing the flapping?

The pre-shared key is incorrect.

The crypto profile uses a weak encryption algorithm.

The tunnel interface is not assigned to a zone.

The DPD interval is set too low, causing the firewall to think the peer is down and renegotiate the tunnel.

An engineer is configuring an IPSec tunnel on a Palo Alto firewall. The remote peer is a third-party device that only supports IKEv1 and uses main mode. The engineer has created an IKE gateway with IKEv1 and main mode. What else must be configured to complete the tunnel?

Enable NAT traversal on the IKE gateway.

Set the IKE gateway to use aggressive mode instead of main mode.

Create an IPSec crypto profile and assign it to the tunnel interface.

Configure the tunnel interface with a management profile.

On a Palo Alto firewall, what is the first step in configuring a GRE tunnel?

Configure a security policy to allow GRE traffic

Define a static route to the remote network

Create an IKE gateway for the GRE peer

Create a tunnel interface and assign it to a zone

Palo Alto NetworksCertified Next-Generation Firewall Engineer

Domain 1Objective 6

1.6 Configure Tunnels NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 1)

Part of the PAN-OS Networking Configuration domain, which accounts for 40% of the NEXT-GENERATION-FIREWALL-ENGINEER exam.

24questions here

5free pages

8concepts

40%of the exam

Questions 1–5

1application · medium
An IPSec tunnel is configured between two Palo Alto firewalls, but the tunnel is flapping (going up and down). The engineer checks the IKE gateway and sees that the 'Dead Peer Detection' (DPD) is enabled. What could be causing the flapping?
Select an answer first
2application · medium
An engineer is configuring an IPSec tunnel on a Palo Alto firewall. The remote peer is a third-party device that only supports IKEv1 and uses main mode. The engineer has created an IKE gateway with IKEv1 and main mode. What else must be configured to complete the tunnel?
Select an answer first
3foundation · easy
On a Palo Alto firewall, what is the first step in configuring a GRE tunnel?
Select an answer first
4foundation · easy
Which PAN-OS command would you use to verify the operational status of a GRE tunnel interface?
Select an answer first
5foundation · easy
When troubleshooting an IPSec tunnel that fails to establish, which log type on a Palo Alto firewall would provide the most detailed information about IKE negotiation failures?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NEXT-GENERATION-FIREWALL-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “NEXT-GENERATION-FIREWALL-ENGINEER” is a trademark of its owner, used for identification only.

1.6 Configure Tunnels NEXT-GENERATION-FIREWALL-ENGINEER Practice Questions (Page 1)

Questions 1–5

An IPSec tunnel is configured between two Palo Alto firewalls, but the tunnel is flapping (going up and down). The engineer checks the IKE gateway and sees that the 'Dead Peer Detection' (DPD) is enabled. What could be causing the flapping?

An engineer is configuring an IPSec tunnel on a Palo Alto firewall. The remote peer is a third-party device that only supports IKEv1 and uses main mode. The engineer has created an IKE gateway with IKEv1 and main mode. What else must be configured to complete the tunnel?

On a Palo Alto firewall, what is the first step in configuring a GRE tunnel?

Which PAN-OS command would you use to verify the operational status of a GRE tunnel interface?

When troubleshooting an IPSec tunnel that fails to establish, which log type on a Palo Alto firewall would provide the most detailed information about IKE negotiation failures?

Keep studying — PAN-OS Networking Configuration