An engineer is troubleshooting a traffic-routing issue. What is the correct packet-flow sequence?

The Palo Alto Networks firewall processes packets in a specific, logical order. For a new session (slow path), the firewall first checks for a matching Policy-Based Forwarding (PBF) rule to determine if a special forwarding path is required. If no PBF rule matches, the firewall performs a standard route lookup in the virtual router's table to find the best route, which could be a static route. After the forwarding decision is made (determining the egress interface and zone) and any applicable NAT policy is evaluated, the firewall enforces the security policy to allow or deny the session. This sequence ensures routing is decided before the security posture is evaluated.

A. PBF > Zone Protection Profiles > Packet Buffer Protection: This is incorrect. Zone Protection and Packet Buffer Protection are applied during the initial ingress stage, before the PBF lookup occurs in the forwarding stage.
B. BGP > PBF > NAT: This is incorrect. BGP is a control plane protocol that populates the routing table. The PBF lookup occurs before the main route lookup (which uses BGP-learned routes).
D. NAT > Security policy enforcement > OSPF: This is incorrect. The forwarding decision (using routes learned via OSPF) occurs before both NAT and security policy evaluation. NAT policy is evaluated before security policy.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. Packet Flow Sequence in PAN-OS. The documentation outlines the packet flow, showing the forwarding lookup (including PBF and then route table lookup) occurs before security policy enforcement. Specifically, it details the "Slowpath (First Packet)" processing order.

2. Palo Alto Networks. (2021). Day in the Life of a Packet. This document provides a detailed diagram and explanation of the packet flow. In the "Session Setup" section, it clearly shows "Forwarding Lookup (PBF/Route)" (Step 5) occurs before "Security Policy Lookup" (Step 8).

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. Policy Based Forwarding. This section states, "The firewall evaluates PBF rules before it performs a route lookup in the virtual router." This confirms PBF is checked before standard routing (like static routes).