Engineering reference
What the model represents
42 stages, 77 directed branches, 38 scenarios and 58 representative packet checkpoints. Every displayed edge is exercised by at least one included trace.
Five logical columns
| Column | Responsibilities |
|---|---|
| Ingress | Parsing, inspection eligibility, tunnel decapsulation, IP reassembly, early discard and local/held handling. |
| Session setup | Zone Protection, initial TCP checks, forwarding and NAT lookups, User-ID, DoS policy, firewall Security policy lookup, session installation. |
| Fast path | Session lookup, L2–L4/TCP state, stored NAT, TCP reassembly, SSL proxy gate, application-state decision and content eligibility. |
| App / content | Override/signature lookup, app-based Security policy, profiles/QoS classification, decryption/proxy setup, inspection, app changes, profile actions and re-encryption. |
| Egress | Forwarding, QoS shaping, MTU/DF decisions, IPv4 fragmentation, tunnel encapsulation, outer route lookup and transmission. |
After DoS policy, permitted setup proceeds to firewall Security policy lookup. After SSL proxy processing, an unresolved application with payload enters App-ID; a known application proceeds to content eligibility. Pure handshake packets can bypass payload inspection. Decoder-discovered application changes return to application-aware Security policy. These branches preserve the distinction between first-packet setup and established-session processing.
Included scenario families
- Datacenter connections: public DNAT, DMZ-to-application HTTPS, application-to-database PostgreSQL and Security policy denial.
- TLS and applications: proxy setup and record decryption, inner App-ID, application changes, application policy denial, custom override and decoder assistance.
- Content and identity: alert/drop/reset actions and authentication-portal handling.
- Tunnels and packet handling: IPsec ingress/egress, decapsulation failures, IP fragments, TCP buffering and reassembly errors.
- Egress and NAT: shaping, MTU/DF behavior, fragmentation, SNAT with reverse translation and allocation failure.
- Protection and validation: Zone Protection, DoS, non-SYN new flows, no route, exhausted capacity, discard-state sessions, malformed headers, FIN and a specific L2 non-IP bypass case.
Assumptions and boundaries
- This is a deterministic teaching model, not PAN-OS code, a packet emulator or a real firewall. It does not inspect your network or load live configurations or PCAPs.
- Scenario presets supply the required session/proxy state. Checkpoints are representative packets/events, not every byte of a TCP/TLS exchange. App-ID timing and decisions are illustrative.
- The usual deployment is one Layer 3 firewall and virtual router. The L2 bypass case explicitly changes interface mode. A branch tunnel is added where needed.
- 3D positions show logical groups only. They do not represent physical hardware placement, latency, concurrency, SP3 scheduling, offload or CPU utilization.
- NAT selection and the final mapped/wire views are distinct. Internal rewrite is placed according to the provided packet-flow reference; vendor NAT administration documentation describes translation at egress. No claim is made about exact platform-specific rewrite timing.
- Nested application names and threat detections are modeled results, not a real signature replay. Payload, policy and profile prerequisites are declared in the selected scenario.
- A blocked original packet is not shown as transmitted. TCP resets, authentication challenges and ICMP feedback are described separately rather than expanded into complete generated-packet traces.
- No PBF, ECMP, HA synchronization, multi-VSYS behavior, IPv6-specific pipeline, live routing protocols or actual cryptography is implemented. The topology’s tier-to-tier connections are independent sessions.
- Test-network public addresses and RFC1918 addresses are illustrative. The public-to-private deny case assumes the probe already reached the firewall; it does not imply global routing of private addresses.
Reference material
The model was developed from the supplied “Day in the Life of a Packet” diagram and packet-flow document, and checked against these vendor references:
This is an independent educational project. Palo Alto Networks and PAN-OS are trademarks of their respective owner. No vendor artwork, executable firewall software or source PDF is redistributed in this package.
Validation
The supplied model tests check all 58 traces, every stage and edge, ordering invariants, terminal block/hold/transmit outcomes, reverse NAT and selected application/decryption behaviors. They validate consistency of the implemented model; they are not a certification against every PAN-OS version or platform.