Private corporate batches, live online cohorts and 1-on-1 mentoring in PAN-OS next-generation firewalls, App-ID and User-ID policy, decryption, GlobalProtect and Panorama — taught by a practitioner who runs it in production.
20 years across DevOps, SRE and Security · 10,000+ engineers trained · Trained teams at JPMorgan Chase, Verizon, Nokia and the World Bank
Principal DevOps Engineer & Architect
Rajesh teaches Palo Alto Networks around policy and evidence rather than menu navigation: the PAN-OS packet flow that explains why a rule did not match, how App-ID and User-ID change what a rule actually means, and how to migrate port-based rules to application-based ones without an outage. Sessions cover decryption decisions and their privacy and compliance exemptions, security profile tuning that reduces false positives instead of muting alerts, and Panorama device groups and template stacks for keeping a multi-site estate consistent — with every concept demonstrated against a lab firewall and its logs. The framing is defensive throughout: designing, operating and auditing controls, and reconstructing what happened from traffic, threat and URL logs.
Twenty years across DevOps, SRE and Security, in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe and others. He has trained engineers at JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus — more than 10,000 people personally. He teaches what he runs, not what he reads.
You are booked with a named engineer, and that is who turns up. Marketplaces and larger providers rotate whoever is free, so the person who sold you the agenda is rarely the person teaching it.
The same trainer is available for the next engagement, which matters when a team builds on what it learned last time.
Your batch is assigned a named trainer before it starts, and that is who teaches it. See the full faculty.
Engagements are matched on the tool, not the calendar. For Palo Alto Networks that means a trainer who has run it in production — PAN-OS next-generation firewalls, App-ID and User-ID policy, decryption, GlobalProtect and Panorama — rather than whoever is free that week. You are told who is teaching before you commit, and that person is on the discovery call that shapes the agenda.
Where a batch is large enough to need a second trainer, the pairing is declared up front. The lead trainer stays accountable for the syllabus and the assessment either way.
Principal DevOps Engineer & Architect
Twenty years across DevOps, SRE and Security in principal and architect roles at PayPay, SoftwareAG, ServiceNow, JDA Software, Intuit, Adobe, IBM/Emptoris, Ness, MindTree and Accenture. He has trained more than 10,000 engineers personally, at organisations including JPMorgan Chase, Verizon, Nokia, the World Bank, VMware, Oracle, Mercedes-Benz and Airbus. He teaches what he runs, not what he reads.
Teams of 8–30
Custom agenda, your timezone, onsite or online, NDA-friendly.
Request a quoteIndividual engineers
A private instructor and a curriculum built around your goal.
₹99,999Individuals who want peers
Scheduled batch, max 8 to 10 hours of live instruction.
₹34,999A private batch starts with a discovery call. We look at the stack you actually run — the CI system, the cloud, the constraints — and map the agenda onto it, so examples use your topology rather than a generic one.
Delivery is onsite at your premises, live online, or hybrid, scheduled around your release calendar rather than ours. Batches run 8 to 30 engineers.
Every attendee leaves with recordings, slides, lab repositories and a completion certificate. You receive an attendance and assessment report. Invoicing supports PO and GST.
Talk to us about a private Palo Alto Networks batchPalo Alto Networks builds next-generation firewalls and the security platform around them. The core product is PAN-OS, the operating system that runs on the hardware appliances, on the VM-Series in public and private cloud, and on the CN-Series for container environments. What distinguishes it from a port-and-protocol firewall is that traffic is classified by application, user and content rather than by port number: App-ID identifies the application regardless of port or encryption, User-ID maps sessions to directory identities, and Content-ID inspects the payload for threats, exploits, malicious URLs and data patterns — all in a single pass over the packet.
A production deployment is more than one box. Security zones and interfaces define where traffic may travel; security policy rules written against applications and user groups decide what is allowed; security profiles attached to those rules decide what is inspected. Decryption policy determines which TLS sessions are opened for inspection and which are deliberately left alone for privacy or compliance reasons. GlobalProtect extends the same policy to remote users, and IPSec tunnels extend it between sites.
At scale, Panorama becomes the control plane: device groups push shared and per-site policy, template stacks push network and device configuration, and log collectors centralise the traffic, threat, URL and WildFire logs that make investigation possible. This course is defensive throughout — it is about designing, operating and auditing controls, reading logs to explain what happened, and tuning policy so that legitimate work is not blocked and malicious activity is.
Firewall policy has become identity and application policy. Flat allow-any rules between internal zones are precisely how an initial foothold turns into a breach, and every serious framework — from segmentation requirements in payment standards to zero-trust guidance — now expects rules expressed in terms of who and what, not which port.
At the same time the estate has spread. The same policy has to hold across a data centre, several cloud VPCs, branch sites and a fully remote workforce, which is why Panorama-managed device groups and template stacks matter more than the CLI syntax of any one device. Getting that consistency wrong produces silent gaps that nobody notices until an incident review.
Demand is for engineers who can do the harder half: convert legacy port-based rules to App-ID safely without an outage, decide what to decrypt and what to exempt, tune threat profiles so they block real attacks instead of generating noise, and reconstruct an incident from traffic and threat logs. Certification tracks such as PCNSA and PCNSE exist because organisations need that competence demonstrated, not asserted.
Where the products fit and how a packet is actually processed. The hardware appliances, VM-Series and CN-Series; the management plane versus the data plane; and the single-pass packet flow — ingress, session lookup, policy lookup, App-ID, Content-ID, egress — which is the mental model that explains almost every confusing rule-match behaviour later in the course.
Topics: Product family: hardware, VM-Series, CN-Series · Management plane and data plane separation · Single-pass architecture and the packet flow diagram · Session setup versus session fast path · Management access, admin roles and authentication · Configuration model: candidate, running and commit · Content and software update lifecycle
The network foundation everything else sits on. Deployment modes and when each applies, security zones as the unit of policy, virtual routers and route redistribution, and the interface management profiles that decide what can be reached on each leg. Then high availability, because a firewall that is a single point of failure is a design flaw.
Topics: Layer 3, Layer 2, virtual wire and tap deployments · Security zones and intra-zone versus inter-zone traffic · Sub-interfaces, VLANs and aggregate links · Virtual routers, static routes and dynamic routing · Interface management profiles · HA active/passive and active/active · Link and path monitoring
Rules as the organisation's stated intent. Rule structure and evaluation order, the implicit and intrazone-default rules people forget about, address and service objects, tags and rule hygiene. Then NAT — source, destination, U-turn and the ordering relationship with security policy that causes the classic 'my rule looks right but nothing passes' problem.
Topics: Rule structure, order and first-match evaluation · Implicit rules and interzone/intrazone defaults · Address, service and tag objects · Source NAT: dynamic IP and port, static · Destination NAT and port forwarding · NAT and security policy ordering · Rule hygiene: shadowed, unused and overly permissive rules
The three classifications that make the firewall next-generation. How App-ID identifies applications regardless of port, what application dependencies and implicit-use mean in practice, and how to migrate to application-based rules using the traffic log and Policy Optimizer rather than guesswork. Then User-ID — the agents, mapping sources and group mapping that make identity-based rules possible.
Topics: How App-ID classifies traffic and handles dependencies · Application groups, filters and custom applications · App-ID content updates and handling classification shifts · Policy Optimizer and port-to-App-ID migration · User-ID mapping sources: agent, agentless, syslog, captive portal · Group mapping from LDAP and identity providers · Content-ID and where inspection occurs in the flow
What actually gets inspected once a rule permits traffic. Each profile type, what it detects, and how to tune it so real detections are visible instead of buried. Profile groups for consistency, exception handling that is documented rather than ad hoc, and zone and DoS protection for volumetric and reconnaissance activity.
Topics: Antivirus and anti-spyware profiles · Vulnerability protection and signature severity · URL filtering categories, overrides and credential-submission control · File blocking and data filtering patterns · WildFire analysis and verdict handling · DNS security and sinkholing · Security profile groups and consistent application · Zone protection and DoS protection profiles · Tuning exceptions without disabling detection
The most consequential and most sensitive control on the platform. What you can and cannot inspect without decryption, how forward proxy and inbound inspection differ, certificate handling and trust distribution, and — equally important — the exemptions you must make for privacy, regulated categories and pinned applications. Covered as a governance decision as much as a configuration one.
Topics: SSL forward proxy · SSL inbound inspection · Certificate management and trust distribution · Decryption policy and exclusion rules · Certificate pinning and applications that must be exempted · Privacy, legal and works-council considerations · Decryption logs and troubleshooting broken sessions · Performance impact and sizing
Extending the same policy beyond the perimeter. GlobalProtect portal and gateway configuration, authentication including multi-factor, host information profiles for posture checks, and split-tunnel decisions. Then IPSec site-to-site tunnels, IKE profiles, and troubleshooting the phase-one and phase-two failures that account for most tunnel incidents.
Topics: GlobalProtect portal, gateway and agent configuration · Authentication profiles, certificates and multi-factor · HIP checks and posture-based policy · Split tunnel versus full tunnel decisions · IPSec site-to-site tunnels and IKE crypto profiles · Route-based tunnels and monitoring · Troubleshooting phase 1 and phase 2 negotiation failures
Managing an estate instead of a device. Panorama deployment modes, device groups with shared and site-specific rules, pre-rules and post-rules and how they sandwich local policy, templates and template stacks for network and device settings, and log collectors for centralised, searchable logging. Then configuration management: commit scope, config audit, rollback and change control.
Topics: Panorama modes and deployment sizing · Device groups, hierarchy and shared objects · Pre-rules, post-rules and local rule interaction · Templates and template stacks · Log collectors and log forwarding · Commit scope, partial commits and push behaviour · Config audit, versioning and rollback · Onboarding a new site consistently
Turning logs into answers. Reading traffic, threat, URL, WildFire and system logs and knowing which one answers which question. The ACC for pattern-finding, custom reports, log forwarding to SIEM, and a structured method for reconstructing what happened during an incident and writing it up defensibly.
Topics: Traffic, threat, URL, WildFire and system logs · Session browser and live session inspection · The Application Command Center for pattern discovery · Custom reports and scheduled reporting · Log forwarding profiles and SIEM integration · Correlation objects and automated correlation · Reconstructing an incident timeline from logs · Writing a defensible incident finding
Keeping it healthy over time and knowing what sits alongside it. PAN-OS upgrade paths and content update discipline, backup and restore, certificate expiry, capacity monitoring. Then the XML API and automation with Terraform and Ansible so policy changes become reviewable code, and an honest map of the wider portfolio — Prisma Access, Prisma Cloud, Cortex XDR and XSOAR — and where each is and is not relevant.
Topics: PAN-OS upgrade paths and pre-upgrade checks · Content and threat update discipline · Configuration backup, restore and disaster recovery · Certificate lifecycle and expiry monitoring · Capacity, throughput and session-table monitoring · The XML and REST APIs · Automating policy with Terraform and Ansible · Where Prisma Access, Prisma Cloud, Cortex XDR and XSOAR fit · Preparing for PCNSA and PCNSE
We rebuild the agenda around the tools you actually run.
Request a custom agendaBuild a multi-zone lab with Layer 3 interfaces, virtual routers and an HA pair, then prove with logs that traffic only flows where policy permits.
Take a legacy port-based ruleset, use traffic logs and Policy Optimizer to identify the real applications, and migrate to application-based rules without breaking a service.
Configure User-ID mapping and LDAP group mapping, write rules that apply to directory groups, and prove attribution in the traffic log.
Attach a full security profile group, generate benign traffic that trips a signature, and tune the exception properly instead of disabling the profile.
Enable SSL forward proxy for one zone, distribute trust, then build and justify an exemption list covering pinned applications and regulated categories.
Given traffic, threat, URL and WildFire logs from a simulated event, establish what was allowed, by which rule, and produce a written finding with remediation actions.
Billed yearly at ₹9,996
Max 8 to 10 hours of live instruction
Full program, private instructor
8–30 engineers · custom agenda · onsite or online · PO and GST invoicing
Refunds. If we cancel or postpone a cohort, you get a full refund within 15 days. There is no money-back guarantee otherwise.
Terms. Course material remains licensed to the attendee. Read the terms.
Your data. We don't share it with third parties. Privacy policy.
Certificate of completion
My experience with the AIOps training was positive. The course covered important topics in a structured way, and Rajesh Kumar explained the concepts patiently. I found the practical aspects particularly helpful because they made the technical content easier to understand.
I was looking to improve my understanding of AIOps, and this training helped me achieve that goal. Rajesh Kumar explained the subject in a structured and practical manner. The sessions on different AIOps concepts were informative.
I recently did a SRE Session with Rajesh Kumar from DevOps School and the session was great. Right from 1st day till day 15, we had a very interactive session. Rajesh clarified our doubts and the tool demos were excellent without any hiccups. He simplified the concepts while sticking to the content with a fine balance between theory and practice. Am convinced he is one of the best trainers for SRE & DevOps concepts.
The Rundeck developer session was excellent and highly engaging. I appreciated how well the session was structured, with the theoretical concepts explained clearly and in simple terms. What stood out most to me was the demo — it was both informative and enjoyable. I especially liked how Rajesh walked us through not only the happy path but also the sad path, showcasing common issues and sharing practical troubleshooting tips.
Rajesh's experience and knowledge are exceptional and we learnt invaluable practical knowledge which we can apply in our production environment. Incredibly friendly and gave us a fantastic insight both in-depth and at a high level of the Rundeck product.
Great learning experience from a very knowledgeable instructor with well-prepared course notes. The lab exercises on AWS instance work well to learn the hands-on side of the course.
| What matters | YouTube + blogs | Generic online course | Freelance marketplace | DevOpsSchool |
|---|---|---|---|---|
| Named practitioner | No | Rarely | Varies per booking | Yes — same trainer each time |
| Production experience | Unknown | Unknown | Unverified | 20 years, named employers |
| Custom agenda | No | No | Sometimes | Built from your stack |
| Onsite delivery | No | No | Sometimes | Yes |
| Lab environment | None | Sandbox that expires | Varies | Your own cloud — skill goes with you |
| Assessment | None | Quiz | Rarely | Assignments + capstone per module |
| Per-attendee certificates | No | Sometimes | Rarely | Yes |
| Corporate invoicing | No | Limited | Varies | PO and GST |
| Post-training support | None | Forum, time-limited | None | Lifetime forum access |
Tell us the team, the stack and the timeline. You'll get a straight answer, not a sales sequence.
Talk to an advisorPrefer to call or email?
More ways to reach us on the contact page.