StudyToCert

All certifications / NGFW Engineer / Lessons

Palo Alto Networks Certified Next-Generation Firewall Engineer NGFW-Engineer · Domain 1: PAN-OS networking configuration

Policy-based forwarding with path monitoring; service routes; DHCP server/relay and DNS proxy

▶ Watch the overview video

Last reviewed September 30, 2026 · Leer en español

Normally the firewall forwards by destination using the routing table. Policy-based forwarding (PBF) overrides that for traffic matching specific criteria, for example sending guest traffic out a cheap broadband link while corporate traffic uses MPLS (Multiprotocol Label Switching). PBF rules live under Policies > Policy Based Forwarding and are evaluated before the route lookup for a new session. This lesson also covers three services the firewall provides to itself and to clients: service routes, DHCP and DNS proxy.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study NGFW Engineer for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the NGFW Engineer study plan