StudyToCert

All certifications / NGFW Engineer / Lessons

Palo Alto Networks Certified Next-Generation Firewall Engineer NGFW-Engineer · Domain 3: Integration and automation

VM-Series bootstrapping (init-cfg.txt, bootstrap.xml, content/license/software/plugins folders) and Zero Touch Provisioning

▶ Watch the overview video

Last reviewed September 30, 2026 · Leer en español

Deploying a firewall by hand, logging in to set an IP, license it, update it and configure it, does not scale in the cloud or across hundreds of sites. Bootstrapping lets a VM-Series firewall configure itself on first boot, and Zero Touch Provisioning (ZTP) does something similar for supported hardware firewalls. Both remove the skilled engineer from the first-boot process, which makes autoscaling and large rollouts possible, and it guarantees every new firewall starts from the same known configuration. A bootstrap package is a set of folders the firewall reads at first boot. config holds init-cfg.txt and optionally bootstrap.xml. license holds an authcodes file with the license authorization codes. software holds a PAN-OS image to upgrade to. content holds Applications and Threats and optionally antivirus content packages to install. plugins holds VM-Series plugin images. The config, license, software and content folders must exist even when empty; plugins is optional.

Free account

Keep reading for free

Create a free StudyToCert account to read the rest of this lesson: 7 more sections, 6 key terms, a real-world example, an exam tip and self-check questions. Every lesson, lab and practice test is free with an account.

Sign up free Log in

Study NGFW Engineer for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the NGFW Engineer study plan