- Configure interface
- Configure zones
- Configure high availability (HA)
- Configure routing
Palo Alto Networks Certification Training Course
Palo Alto Networks Certified Next-Generation Firewall Engineer Certification Training Course
We'll get you ready for the Palo Alto Networks Certified Next-Generation Firewall Engineer exam, the Specialist credential for engineers who deploy, operate and administer Palo Alto Networks NGFWs.
Course focus: PAN-OS networking configuration, PAN-OS device settings, and integration and automation, mapped to the official NGFW Engineer blueprint.
Course Overview
What the Next-Generation Firewall Engineer course covers and who it's for.
Per Palo Alto Networks, NGFW Engineer validates the knowledge and skills engineers and administrators need to deploy, operate and administer the Palo Alto Networks suite of NGFW products. It's also one of the recommended paths after the PCNSE retirement.
The official blueprint has three domains. PAN-OS networking configuration and PAN-OS device settings are 40% each, and integration and automation is 20%. We spend most of the course configuring interfaces, routing, HA, device settings and management so the exam feels familiar.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Course Objectives
Get ready for Next-Generation Firewall Engineer the way the exam is built.
01
Cover the Whole Blueprint
Work through all 3 domains in the official Next-Generation Firewall Engineer datasheet, weighted the way the exam weights them.
02
Go Deep on PAN-OS Networking Configuration
PAN-OS Networking Configuration is 40% of the exam score per Palo Alto Networks, so it gets the most class time.
03
Practice in a Lab
Hands-on lab work on the tasks the Next-Generation Firewall Engineer blueprint lists, not just slides.
04
Be Ready for Test Day
The exam is in person at a Pearson VUE test center with multiple choice, matching and ordering items. We practice all three.
Who Should Attend
- Network security engineers who configure PAN-OS.
- Firewall administrators moving into an engineering role.
- Former PCNSE candidates.
- Engineers who integrate NGFWs with automation and other tools.
Prerequisites
- Palo Alto Networks recommends 2 to 3 years in an IT security field and 2 years with its NGFW solutions.
- Recommended certifications are Network Security Professional and Network Security Analyst. We don't have enrollment prerequisites.
Pathway Map
The Next-Generation Firewall Engineer course in 3 modules.
Each module is one domain from the official datasheet, with its exam weight.
Course Content
- Implement authentication roles, profiles, and sequences
- Configure virtual systems (VSYS)
- Configure logging
- Implement PAN-OS software updates
- Install the selected deployment option
- Use APIs to automate deployment
- Manage third-party services to deploy NGFWs
- Use on-premises centralized management
Course Features
How we teach Next-Generation Firewall Engineer.
Expert-Led Classes
Live instruction with time for questions, so you aren't figuring out the hard parts alone.
Hands-On Labs
Lab work tied to the tasks in the Next-Generation Firewall Engineer blueprint.
Blueprint Mapping
Every module maps to a domain in the official Next-Generation Firewall Engineer datasheet.
Exam Strategy
Practice with multiple choice, matching and ordering questions, plus test center tips.
Certification Exam
About the Next-Generation Firewall Engineer exam.
Next-Generation Firewall Engineer Exam Readiness
Our students pass at a 98.8% rate across Accumentum courses. We'll get you ready for Next-Generation Firewall Engineer the same way.
Per Palo Alto Networks, Next-Generation Firewall Engineer is a Specialist level exam priced at $250 USD, and taxes may apply. Since August 1, 2025, Palo Alto Networks exams are delivered in person at Pearson VUE test centers only. Exams are in English, with multiple choice, matching and ordering questions.
The certification is valid for two years and you renew by retaking the exam. If you fail, the waits before retakes are 15, 30 and then 90 days. Full details are on the official Next-Generation Firewall Engineer page.
Accumentum is an independent training provider. We are not affiliated with, endorsed by or a partner of Palo Alto Networks, and this isn't official Palo Alto Networks training. Palo Alto Networks sets exam content, fees and policies, so check paloaltonetworks.com before you book.
Exam Blueprint
Every Next-Generation Firewall Engineer objective, domain by domain.
We map our lessons to the official Next-Generation Firewall Engineer datasheet. Here is that blueprint, all 3 domains and 18 objectives, so you can see exactly what is in scope.
Domain 1: PAN-OS Networking Configuration (40%)
1.1 Configure interface
- Layer 2
- Layer 3
- Virtual wire
- Tunnel interfaces
- Aggregate Ethernet (AE)
- Management
1.2 Configure zones
1.3 Configure high availability (HA)
- Active/active
- Active/passive
- Link and path monitoring
1.4 Configure routing
- Dynamic routing protocols
- Redistribution and policies
- Route monitoring
- Advanced Routing Engine
1.5 Configure GlobalProtect
- Portals
- Gateways
- Authentication
- Split tunneling
1.6 Configure tunnels
- IPSec
- Quantum-resistant cryptography
- Generic Routing Encapsulation (GRE)
Domain 2: PAN-OS Device Setting Configuration (40%)
2.1 Implement authentication roles, profiles, and sequences
2.2 Configure virtual systems (VSYS)
- Interfaces and zones
- Virtual routers
- Logical routers
- Inter-VSYS routing and security
2.3 Configure logging
- Strata Logging Service
- Log forwarding
- Log collectors and log collector groups
2.4 Implement PAN-OS software updates
2.5 Configure certificates
- PKI integration
- Authentication
- SLS/TLS profiles
- Decryption (for example subordinate CA, forward trust/untrust)
- Certificate profiles
2.6 Configure on-premises and Cloud Identity Engine User-ID
- Group mapping and directory sync
- User-to-IP mapping and user context
- Redistribution and segments
2.7 Configure web proxy on PAN-OS
Domain 3: Integration and Automation (20%)
3.1 Install the selected deployment option
- PA-Series
- VM-Series
- CN-Series
- Cloud NGFW
- AI Runtime Security
3.2 Use APIs to automate deployment
3.3 Manage third-party services to deploy NGFWs (for example Kubernetes, hypervisors, CSPs, Terraform, Ansible)
3.4 Use on-premises centralized management
- Panorama
- Templates and device groups
- Pre- and post-ruleset
3.5 Build Application Command Center (ACC) dashboards and custom reports
Before You Start
What you should know before Next-Generation Firewall Engineer.
Here is who Palo Alto Networks says the Next-Generation Firewall Engineer exam is for and what it expects you to bring, taken from the official datasheet.
Who Palo Alto Networks wrote this exam for
This exam is designed for security professionals responsible for configuration of PAN-OS networking and device settings, integration and automation, object configurations and policies, and management and operation in network security environments.
Knowledge, skills and abilities
- Working knowledge of network security
- Working knowledge of TCP/IP and how traffic is directed within a network
- Working knowledge of networking infrastructure, protocols, and topology
- Basic understanding of endpoint OS fundamentals and security hardening methods
- Working knowledge of next generation firewalls and security automation technology
- Basic knowledge of current and emergent trends in information security
- Ability to use security models / architectures (for example defense-in-depth, Zero Trust)
- Engineering-level competency of all NGFW offerings
- Basic knowledge of programming and scripting languages (for example Python, Powershell, and SQL)
Recommended background
Recommended work experience: 2 to 3 years in an IT security-related field, 2 years with Palo Alto Networks NGFW solutions.
Recommended certifications first: Palo Alto Networks Network Security Professional, Palo Alto Networks Certified Network Security Analyst.
Study Plan
How we approach Next-Generation Firewall Engineer prep.
The weights tell you where to spend your hours. PAN-OS Networking Configuration leads at 40%.
Palo Alto Networks products change often, and the exam follows the current release. Read the release notes for anything you use in the lab so you aren't studying an old screen.
Our course follows the same blueprint, with on demand lessons you can pause and replay, and our students pass at a 98.8% rate across Accumentum courses.
Exam Policies
Next-Generation Firewall Engineer retakes, renewal and badges.
Next-Generation Firewall Engineer lasts two years from your pass date, and Palo Alto Networks renews it when you pass the exam again.
Passing a higher level exam in the same track automatically extends your active lower level certifications in that track by two years. For Next-Generation Firewall Engineer that can include an active Network Security Professional, Cybersecurity Practitioner or Cybersecurity Apprentice certification.
If you don't pass, you get a results report broken down by domain. Palo Alto Networks requires a 15 day wait before a second attempt, 30 days before a third and 90 days before any attempt after that. After a pass you can't sit the same exam again for 18 months.
Exams are delivered in English through Pearson VUE, and candidates testing in non English speaking countries get a 30 minute time extension by default. Your badge and certificate come through Credly.
Career Outcomes
Jobs that line up with Next-Generation Firewall Engineer.
NGFW Engineer suits engineers who own PAN-OS deployments. Teams that run large Palo Alto Networks firewall estates look for people who can handle the networking, device settings and automation side, which is exactly what this exam covers.
Per the U.S. Bureau of Labor Statistics, information security analysts earned a median annual wage of $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you have been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding
Ways to pay for Next-Generation Firewall Engineer training.
Our funding page lays out every way to pay for training, and PathPay lists the courses that qualify for a monthly plan.
Veterans can look at VR&E benefits for career training, and our Veteran Skill Forge programs bundle several courses into one path. Questions about your situation? Contact us and we'll talk it through.
Frequently Asked Questions
Common questions about our Next-Generation Firewall Engineer course.
Palo Alto Networks Certified Next-Generation Firewall Engineer is a Specialist level certification from Palo Alto Networks. Details are on the official certification page at https://www.paloaltonetworks.com/services/education/palo-alto-networks-ngfw-engineer.
No. We're an independent training provider and we aren't a Palo Alto Networks partner. Our course follows the public exam blueprint in the official datasheet. Palo Alto Networks offers its own learning paths at learn.paloaltonetworks.com.
Palo Alto Networks lists Specialist exams at $250 USD, and taxes may apply. Vouchers are sold through Pearson VUE and expire 12 months after purchase. Check the current price before you buy.
No. Since August 1, 2025, Palo Alto Networks certification exams are delivered in person at Pearson VUE test centers only.
Two years from the date you pass. You renew by retaking the exam, and passing a higher level exam in the same track renews your active lower level certifications.
Palo Alto Networks recommends 2 to 3 years in an IT security field and 2 years with its NGFW solutions. Recommended certifications are Network Security Professional and Network Security Analyst. We don't have enrollment prerequisites.
Expert-led, with hands-on labs and practice questions. Ask us about upcoming class dates.
Use the registration page linked below, or email info@accumentum.net and we'll follow up with dates and next steps.
3. Per the official datasheet they are PAN-OS Networking Configuration (40%), PAN-OS Device Setting Configuration (40%), Integration and Automation (20%).
PAN-OS Networking Configuration at 40%, per the Palo Alto Networks datasheet.
Recommended work experience: 2 to 3 years in an IT security-related field, 2 years with Palo Alto Networks NGFW solutions.
Palo Alto Networks recommends Palo Alto Networks Network Security Professional and Palo Alto Networks Certified Network Security Analyst. They aren't required.
This exam is designed for security professionals responsible for configuration of PAN-OS networking and device settings, integration and automation, object configurations and policies, and management and operation in network security environments.
Palo Alto Networks requires a 15 day wait after a first failed attempt, 30 days after a second and 90 days after a third. Once you pass, you can't retake the same exam for 18 months.
Our PathPay page lists the courses that qualify for a monthly plan. For anything else, contact us and we'll go over options.
Enrollment
Enroll in Next-Generation Firewall Engineer training with Accumentum.
Enroll in our Next-Generation Firewall Engineer course to get ready for the Palo Alto Networks Certified Next-Generation Firewall Engineer exam with expert-led classes and hands-on labs.
For dates and next steps, use the registration page linked below or email info@accumentum.net.
Ready to start on Next-Generation Firewall Engineer?
Tell us your target date and we'll help you plan the path.