A customer with a legacy firewall architecture is focused on port and protocol level security, and has heard that next generation firewalls open all ports by default. What is the appropriate rebuttal that positions the value of a NGFW over a legacy firewall?

This statement accurately refutes the misconception. Palo Alto Networks Next-Generation Firewalls (NGFWs) operate on a default-deny principle for traffic between different security zones (interzone). No traffic is allowed unless an explicit security policy permits it. When creating a policy to allow an application, administrators have granular control. They can restrict the application to its standard, default ports (application-default) or specify a custom list of allowed ports. This approach combines application-level control with traditional port-based security, providing a more secure posture than legacy firewalls.

A. The firewall policy is configured in advance; it does not open ports dynamically "after understanding the application request."
B. This is false. App-ID uses port information as one of its identification mechanisms, and policies explicitly reference ports.
D. This is fundamentally incorrect. The firewall's default posture is to block traffic, not to leave all ports open.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide (Version 11.0). Security Policy. This section details the two default security rules, including the interzone-default rule which has an action of deny.

2. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide (Version 11.0). Objects > Services. This section explains how the Service column in a policy can be set to application-default to "allow the application on its default ports only."