Firewall interview questions, answered for FortiOS 7.6 and PAN-OS 12.1
By Radhe, Ping My Lab. Last updated .
Interview questions on FortiGate and Palo Alto firewalls, answered for the versions Ping My Lab teaches. Each answer starts with a short version you can say aloud, then shows the commands that prove it.
Independent training; not affiliated with Fortinet or Palo Alto Networks.
01What interviewers test
Firewall interviews test whether you can predict what the firewall will do, and prove it with a command. Both course kits cover the same core areas:
- Matching traffic: zones and interfaces, rule order, and where NAT fits.
- High availability: which unit becomes active, and what survives a failover.
- Encrypted traffic: what you can see without decryption, and why certificate warnings appear.
- Application identification: naming traffic by what it is, not by its port.
- Troubleshooting: the order of checks, with the commands that prove each step.
Interviewers like scenario questions, so practise the order of checks, not just the fix.
02Same task, two vendors
| Task | FortiGate (FortiOS 7.6) | Palo Alto (PAN-OS 12.1) |
|---|---|---|
| Choosing the active unit | FGCP compares monitored interfaces, then HA uptime (override disabled, the default), then the highest priority. Full answer | The lower device priority number becomes active, and preemption is off by default. |
| Decrypting outbound HTTPS | Deep inspection re-signs trusted server certificates with Fortinet_CA_SSL, and bad ones with Fortinet_CA_Untrusted. Full answer | SSL Forward Proxy signs with the forward trust certificate, or with the forward untrust certificate for bad server certificates. |
| Inspecting HTTPS to your own server | An SSL/SSH profile with server-cert-mode replace and the server’s certificate and key. Full answer | SSL Inbound Inspection with the server’s certificate and private key. |
| NAT and security policy | DNAT happens at ingress, before routing. Without central NAT, source NAT is set inside the firewall policy. | NAT and security are separate rulebases. Security rules use the pre-NAT address and the post-NAT zone. |
Each row comes from the course kits. Official sources are listed at the end of this page.
03Vendor hubs and topic pages
- Fortinet FortiGate interview questions, answered for FortiOS 7.6 What interviewers test on FortiOS 7.6, the top questions, and how to practise them.
- Palo Alto Networks Palo Alto interview questions, answered for PAN-OS 12.1 What interviewers test on PAN-OS 12.1, the top questions, and how to practise them.
All topic pages
04Preparing for a certification too?
The exam guides explain the 2026 certification paths, checked against the vendors’ own pages:
- Palo Alto certifications in 2026: PCNSE is retired, here’s what replaced it
- Fortinet NSE in 2026: what NSE 4 means now
Sources
Sources for the comparison table. The topic pages list the sources for each answer.
- Technical Tip: HA primary unit selection, override disabled vs enabled (Fortinet Community): the FGCP election order.
- Device Priority and Preemption (Palo Alto Networks): the lower number wins; preemption is off by default.
- config firewall ssl-ssh-profile, FortiOS 7.6.6 CLI Reference (Fortinet): caname and server-cert-mode re-sign or replace.
- Keys and Certificates for Decryption Policies (Palo Alto Networks): the forward trust and forward untrust roles.
- SSL Inbound Inspection (Palo Alto Networks): importing the server certificate and key.
- FortiOS 7.6.0 Parallel Path Processing (PDF) (Fortinet): DNAT before routing, and SNAT at egress.
- NAT Policy Rules (Palo Alto Networks): security policy uses pre-NAT addresses and post-NAT zones.
Daily practice
Get one interview question every morning
One firewall interview question with its answer, on the channel you already use.