When high traffic from Palo Alto Networks NGFWs to Active Directory servers causes performance issues, optimizing the way NGFWs gather user-to-IP mappings is critical. Palo Alto Networks offers multiple ways to collect user identity information, andCloud Identity Engineprovides a solution that reduces the load on AD servers while still ensuring efficient and accurate mapping.
* Option A (Correct):Cloud Identity Engineallows NGFWs to gather user-to-IP mappings directly from Active Directory authentication logs or other identity sources without placing heavy traffic on the AD servers. By leveraging this feature, the NGFW can offload authentication-related tasks and efficiently identify users without overloading AD servers. This solution is scalable and minimizes the overhead typically caused by frequent User-ID queries to AD servers.
* Option B:UsingGlobalProtect Windows SSOto gather user information can add complexity and is not the most efficient solution for this problem. It requires all users to install GlobalProtect agents, which may not be feasible in all environments and can introduce operational challenges.
* Option C:Data redistributioninvolves redistributing user-to-IP mappings from one NGFW (hub) to other NGFWs (spokes). While this can reduce the number of queries sent to AD servers, it assumes the mappings are already being collected from AD servers by the hub, which means the performance issue on the AD servers would persist.
* Option D:UsingGlobalProtect agentsto gather user information is a valid method for environments where GlobalProtect is already deployed, but it is not the most efficient or straightforward solution for the given problem. It also introduces dependencies on agent deployment, configuration, and management.
How to Implement Cloud Identity Engine for User-ID Mapping:
* EnableCloud Identity Enginefrom the Palo Alto Networks console.
* Integrate the Cloud Identity Engine with the AD servers to allow it to retrieve authentication logs directly.
* Configure the NGFWs to use the Cloud Identity Engine for User-ID mappings instead of querying the AD servers directly.
* Monitor performance to ensure the AD servers are no longer overloaded, and mappings are being retrieved efficiently.
References:
* Cloud Identity Engine Overview: https://docs.paloaltonetworks.com/cloud-identity
* User-ID Best Practices: https://docs.paloaltonetworks.com

The customer's CIO highlights two key pain points: (1) the operations team lacks expertise to efficiently manage PAN-OS upgrades and support interactions, diverting focus from valuable tasks, and (2) the company lacked tools to monitor NGFW capacity, leading to a rushed upgrade. The goal is to recommend long-term solutions leveraging Palo Alto Networks' offerings for Strata Hardware Firewalls. Options B and D-training and AIOps Premium within Strata Cloud Manager (SCM)- address these issues by enhancing team capability and providing proactive management tools. Below is a detailed explanation, verified against official documentation.
Step 1: Analyzing the Customer's Challenges
* Expertise Gap: The CIO notes that identifying issues and engaging support requires expertise the operations team doesn't fully have or can't prioritize. Upgrading PAN-OS on Strata NGFWs involves tasks like version compatibility checks, pre-upgrade validation, and troubleshooting, which demand familiarity with PAN-OS tools and processes.
* Capacity Visibility: The rushed upgrade stemmed from not knowing the NGFWs were nearing capacity (e.g., CPU, memory, session limits), indicating a lack of monitoring or predictive analytics.
Long-term solutions must address both operational efficiency and proactive capacity management, aligning with Palo Alto Networks' ecosystem for Strata firewalls.

North-south traffic refers to the flow of data in and out of a network, typically between internal resources and the internet. To secure this type of traffic, Palo Alto Networks recommends specific CDSS subscriptions in addition to DNS Security:
A: SaaS Security
SaaS Security is designed for monitoring and securing SaaS application usage but is not essential for handling typical north-south traffic.
B: Advanced WildFire
Advanced WildFire provides cloud-based malware analysis and sandboxing to detect and block zero-day threats. It is a critical component for securing north-south traffic against advanced malware.
C: Enterprise DLP
Enterprise DLP focuses on data loss prevention, primarily for protecting sensitive data. While important, it is not a minimum recommendation for securing north-south traffic.
D: Advanced Threat Prevention
Advanced Threat Prevention (ATP) replaces traditional IPS and provides inline detection and prevention of evasive threats in north-south traffic. It is a crucial recommendation for protecting against sophisticated threats.
E: Advanced URL Filtering
Advanced URL Filtering prevents access to malicious or harmful URLs. It complements DNS Security to provide comprehensive web protection for north-south traffic.
Key Takeaways:
* Advanced WildFire, Advanced Threat Prevention, and Advanced URL Filtering are minimum recommendations for NGFWs handling north-south traffic, alongside DNS Security.
* SaaS Security and Enterprise DLP, while valuable, are not minimum requirements for this use case.
References:
* Palo Alto Networks NGFW Best Practices
* Cloud-Delivered Security Services

Step 1: Understand the Best Practice Assessment (BPA)
* Purpose: The BPA assesses NGFW (e.g., PA-Series) and Panorama configurations against best practices, including Center for Internet Security (CIS) Critical Security Controls, to enhance security and feature adoption.
* Process: Requires a Tech Support File (TSF) upload or telemetry data from onboarded devices to generate the report.
* Evolution: Historically available via the Customer Support Portal, the BPA has transitioned to newer platforms like AIOps and Strata Cloud Manager.
"BPA measures security posture against best practices" (paloaltonetworks.com, Best Practice Assessment Overview).
Step 2: Evaluate Each Option
Option A: PANW Partner Portal
Description: The Palo Alto Networks Partner Portal is a platform for partners (e.g., resellers, distributors) to access tools, resources, and customer-related services.
BPA Capability:
Historically, partners could generate BPAs on behalf of customers via the Customer Success Portal (accessible through Partner Portal integration), but this was not a direct customer-facing feature.
As of July 17, 2023, the BPA generation capability in the Customer Support Portal and related partner tools was disabled, shifting focus to AIOps and Strata Cloud Manager.
Partners can assist customers with BPA generation but cannot directly generate reports for customer review in the Partner Portal itself; customers must access reports via their own interfaces (e.g., AIOps).
Verification:
"BPA transitioned to AIOps; Customer Support Portal access disabled after July 17, 2023" (live.
paloaltonetworks.com, BPA Transition Announcement, 07-10-2023).
No current documentation supports direct BPA generation in the Partner Portal for customer review.
Conclusion: Not a customer-accessible location for generating BPAs. Not Applicable.
Option B: Customer Support Portal
Description: The Customer Support Portal (support.paloaltonetworks.com) provides customers with tools, case management, and historically, BPA generation.
BPA Capability:
Prior to July 17, 2023, customers could upload a TSF under "Tools > Best Practice Assessment" to generate a BPA report (HTML, XLSX, PDF formats).
Post-July 17, 2023, this functionality was deprecated in favor of AIOps and Strata Cloud Manager. Historical BPA data was maintained until December 31, 2023, but new report generation ceased.
As of March 08, 2025, the Customer Support Portal no longer supports BPA generation, though it remains a support hub.
Verification:
"TSF uploads for BPA in Customer Support Portal disabled after July 17, 2023" (docs.paloaltonetworks.com
/panorama/10-2/panorama-admin/panorama-best-practices).
"Transition to AIOps for BPA generation" (live.paloaltonetworks.com, BPA Transition to AIOps, 07-10-
2023).
Conclusion: No longer a valid location for BPA generation as of the current date. Not Applicable.
Option C: AIOps
Description: AIOps for NGFW is an AI-powered operations platform for managing Strata NGFWs and Panorama, offering real-time insights, telemetry-based monitoring, and BPA generation.
BPA Capability:
Supports two BPA generation methods:
On-Demand BPA: Customers upload a TSF (PAN-OS 9.1 or higher) via "Dashboards > On Demand BPA" to generate a report, even without telemetry or onboarding.
Continuous BPA: For onboarded devices with telemetry enabled (PAN-OS 10.0+), AIOps provides ongoing best practice assessments via the Best Practices dashboard.
Available in free and premium tiers; the free tier includes BPA generation.
Reports include detailed findings, remediation steps, and adoption summaries.
Use Case: Ideal for customers managing firewalls with or without full AIOps integration.
Verification:
"Generate on-demand BPA reports by uploading TSFs in AIOps" (docs.paloaltonetworks.com/aiops/aiops-for- ngfw/dashboards/on-demand-bpa).
"AIOps Best Practices dashboard assesses configurations continuously" (live.paloaltonetworks.com, AIOps On-Demand BPA, 10-25-2022).
Conclusion: A current, customer-accessible location for BPA generation. Applicable.
Option D: Strata Cloud Manager (SCM)
Description: Strata Cloud Manager is a unified, AI-powered management interface for NGFWs and SASE, integrating AIOps, digital experience management, and configuration tools.
BPA Capability:
Supports on-demand BPA generation by uploading a TSF under "Dashboards > On Demand BPA," similar to AIOps, for devices not sending telemetry or not fully onboarded.
For onboarded devices, provides real-time best practice checks via the "Best Practices" dashboard, analyzing policies against Palo Alto Networks and CIS standards.
Available in Essentials (free) and Pro (paid) tiers; BPA generation is included in both.
Use Case: Offers a modern, centralized platform for customers to manage and assess security posture.
Verification:
"Run BPA directly from Strata Cloud Manager with TSF upload" (docs.paloaltonetworks.com/strata-cloud- manager/dashboards/on-demand-bpa, 07-24-2024).
"Best Practices dashboard measures posture against guidance" (paloaltonetworks.com, Strata Cloud Manager Overview).
Conclusion: A current, customer-accessible location for BPA generation. Applicable.
Step 3: Select the Two Valid Locations
C (AIOps): Supports both on-demand (TSF upload) and continuous BPA generation, accessible to customers via the Palo Alto Networks hub.
D (Strata Cloud Manager): Provides identical on-demand BPA capabilities and real-time assessments, designed as a unified management interface.
Why Not A or B?
A (PANW Partner Portal): Partner-focused, not a direct customer tool for BPA generation.
B (Customer Support Portal): Deprecated for BPA generation post-July 17, 2023; no longer valid as of March 08, 2025.
Step 4: Verified References
AIOps BPA: "On-demand BPA in AIOps via TSF upload" (docs.paloaltonetworks.com/aiops/aiops-for-ngfw
/dashboards/on-demand-bpa).
Strata Cloud Manager BPA: "Generate BPA reports in SCM" (docs.paloaltonetworks.com/strata-cloud- manager/dashboards/on-demand-bpa).
Customer Support Portal Transition: "BPA moved to AIOps/SCM; CSP access ended July 17, 2023" (live.
paloaltonetworks.com, BPA Transition, 07-10-2023).