A systems engineer (SE) has joined a team to work with a managed security services provider (MSSP) that is evaluating PAN-OS for edge connections to…

To address the MSSP’s requirement for logically separated BGP peering setups while efficiently

managing standard routing rules and updates, Palo Alto Networks offers the Advanced Routing

Engine introduced in PAN-OS 11.0. The Advanced Routing Engine enhances routing capabilities,

including support for logical routers, which is critical in this scenario.

Why A is Correct

Logical routers enable the MSSP to create isolated BGP peering configurations for each customer.

The Advanced Routing Engine allows the MSSP to share standard routing profiles (such as filters,

policies, or maps) across logical routers, simplifying the deployment and maintenance of routing

configurations.

This approach ensures scalability, as each logical router can handle the unique needs of a customer

while leveraging shared routing rules.

Why Other Options Are Incorrect

B: While using APIs to automate deployment is beneficial, it does not solve the need for logically

separated BGP peering setups. Logical routers provide this separation natively.

C: While virtual routers in PAN-OS can separate BGP peering setups, they do not support the efficient

sharing of standard routing rules and profiles across multiple routers.

D: Virtual systems (vsys) are used to segregate administrative domains, not routing configurations.

Vsys is not the appropriate solution for managing BGP peering setups across multiple customers.

Key Takeaways:

PAN-OS Advanced Routing Engine with logical routers simplifies BGP peering management for

MSSPs.

Logical routers provide the separation required for customer environments while enabling shared

configuration profiles.

Reference:

Palo Alto Networks PAN-OS 11.0 Advanced Routing Documentation