If you manage Palo Alto firewalls, your engineers may be working with tools their last training never covered. PAN-OS 12.2, Palo Alto’s August 2026 release, introduced AI agents in Strata Cloud Manager to help with configuration and troubleshooting. Administrators still control how much autonomy these agents have.
Your engineers still need to write security rules that stop threats without blocking the apps people rely on. And when an AI agent suggests a change, it’s their call whether that change is safe for a live firewall.
You find out how well the training worked when something goes wrong. A new rule blocks an app the finance team needs, or traffic suddenly stops. Can your engineers trace the problem and fix it themselves?
That takes an instructor who explains why rules behave as they do and gives engineers enough lab time to troubleshoot without risking the live network.
The same course can produce very different results depending on the instructor. Here are five things to look for in a Palo Alto network security training partner, followed by how Datacipher approaches each one.
5 Factors to Check in a Top Palo Alto Network Security Training Partner
Before you book Palo Alto network security training for your engineers, it helps to check five things first. Some focus on what the partner teaches, and others on how well they teach it. You’ll see both play out the next time your engineers deal with a firewall issue.
1. Are They Authorized to Teach the Course You Need?
Palo Alto offers five instructor-led network security courses covering firewall configuration, troubleshooting, Panorama, and Strata Cloud Manager. Each course focuses on a different part of managing the platform.
So before comparing partners, it helps to know which of these tools your engineers actually use to manage firewalls day to day. If you’re in the middle of moving to Strata Cloud Manager, it makes more sense to train on that than on Panorama.
Once you know which course you need, the next step is finding a partner that’s authorized to teach it. Palo Alto’s authorized training schedule makes this easy, because you can pick a course and see every partner currently running it.
Source – Palo Alto Networks
Authorization also helps you assess the instructor’s qualifications. Palo Alto requires partner instructors to earn certification to teach its authorized courses. They must also pass a workshop that assesses how clearly they explain the material and answer questions. The certification comes as a digital badge, so it’s easy to verify once you start talking to a partner.
| Question to ask: Are you authorized to deliver the Palo Alto Network Security Training courses? |
2. Do They Offer Courses Beyond Firewall Essentials?
Your engineers may need different courses depending on their experience with Palo Alto. Someone newer to the platform would usually start with Firewall Essentials. It’s a five-day course on setting up a firewall and writing the security rules that decide what traffic gets through.
Engineers who already manage your firewalls can move on to troubleshooting. Firewall: Troubleshooting is a three-day course on working out why traffic isn’t getting through. Engineers practice tracing traffic step by step through the firewall to find where it stops.
Then there are the courses on managing firewalls from one place. Panorama: NGFW Management is a two-day course on using Panorama to manage many firewalls from a single screen. Panorama: Centralized Network Security Administration covers the fundamentals on day one and Prisma Access management on day two. It’s particularly relevant for organizations that manage remote access through Prisma Access alongside their firewalls. Engineers moving off Panorama can take the new Strata Cloud Manager course, launched in September 2026 with a module on AI agents.
A partner offering all five courses can support your engineers as their responsibilities grow, without requiring you to switch providers. You should also make sure the courses you need have upcoming dates on the partner’s schedule. While you’re checking dates, it helps to ask which PAN-OS version each course covers, as older material can miss newer features.
| Question to ask: Which Palo Alto network security courses do you offer, and which PAN-OS version does each one cover? |
3. Do They Offer Formats That Fit Around Your Engineers’ Work?
Firewall Essentials alone covers five days of training, and the other courses take two to three. Someone still has to handle changes and outages while engineers are in class, so it’s worth planning when each person trains.
Live online classes are often the easiest to fit around work, especially if your engineers are spread across offices. They still run in a set time zone, though, so a class scheduled for another region can mean late nights.
When your engineers share an office, classroom training puts everyone in one room to work through lab problems together. Some partners can also run a private class at your site, so nobody has to travel.
| Question to ask: Which formats can you deliver this course in? |
4. Can the Instructor Make Network Security Concepts Easy to Follow?
Much of Palo Alto network security depends on processes that aren’t immediately visible to administrators. A firewall checks security rules in order and applies the first rule that matches a connection. Panorama and Strata Cloud Manager let administrators manage settings centrally and apply them across multiple firewalls.
When engineers don’t understand that, small fixes can turn into bigger problems. A new rule may never take effect because an earlier rule matches the traffic first. They might then create a broader rule that allows more traffic than intended.
A good instructor explains why each step matters instead of asking engineers to follow clicks without understanding them. When something goes wrong in the lab, the instructor works through the problem with the class and explains the cause.
Classes often mix newer administrators with engineers who’ve worked with Palo Alto for years. The best instructors adjust their explanations to the room, so newer people keep up and experienced engineers still learn something.
| Question to ask: How does your instructor help engineers understand why a rule behaves the way it does? |
5. Do the Labs Give Engineers Real Problems to Solve?
Labs let engineers apply what they’ve learned in a simulated network instead of just watching slides. The value depends on whether the exercises challenge them to solve realistic problems.
Some labs guide engineers through building a network setup from scratch. Others give them a broken setup and ask them to diagnose the problem. Both are useful, but troubleshooting exercises help engineers practice applying their knowledge.
For example, a lab might simulate a branch office that can’t connect to headquarters or a website that remains accessible despite a blocking rule. Solving these problems in a lab gives engineers practice diagnosing similar issues on a live network.
A good instructor stays involved during lab exercises. When an engineer gets stuck, the instructor offers hints rather than giving away the solution. It also helps to know how much of each day is spent in the lab. Some partners keep the lab open after class, so engineers can go back to an exercise they found tricky.
| Question to ask: How do your lab exercises prepare engineers for the network security problems they’ll run into on the job? |
These five factors give you a practical way to compare training partners. Here’s how Datacipher approaches each one.
How Datacipher Approaches Palo Alto Network Security Training
At Datacipher, we train engineers on the full Palo Alto network security track, from a single firewall to centralized management. We make sure your team is able to work through real problems on their own network.
Source – Datacipher
Here’s how our training measures up against each of the five factors.
1. A Global Authorized Partner You Can Check for Yourself
When you book a network security course with us, your engineers get the official course Palo Alto Networks designed. It’s taught by an instructor Palo Alto has certified to deliver it.
That’s possible because we’re a Global Authorized Training Provider for Palo Alto Networks, and our classes run for organizations in India and KSA, as well as the US and APAC. And if you want to confirm it, Palo Alto’s own training schedule lists us among the authorized partners for these courses.
Source – Palo Alto Networks
Our instructors also hold Palo Alto’s trainer certification, which assesses both teaching ability and technical knowledge.
The official curriculum covers the skills Palo Alto considers essential, from configuring a single firewall to managing multiple firewalls centrally. Our instructors connect these topics to practical scenarios so engineers can apply what they learn.
2. All Five Network Security Courses Under One Roof
Whether an engineer is new to Palo Alto or moving their firewalls to Strata Cloud Manager, there’s a course for it. We run all five of Palo Alto’s instructor-led network security courses, so engineers can keep learning with us as their responsibilities expand.
Here’s a quick look at who each one is for.
| Course | Who It’s For |
| Firewall Essentials: Configuration and Management (EDU-210) | Engineers new to Palo Alto firewalls |
| Firewall: Troubleshooting (EDU-330) | Engineers who run firewalls every day and handle the problems that come up |
| Panorama: NGFW Management | Engineers managing lots of firewalls through Panorama |
| Panorama: Centralized Network Security Administration | Engineers using Panorama for both firewalls and Prisma Access |
| Strata Cloud Manager: Network Security Management and Administration | Engineers moving to Strata Cloud Manager, or already using it |
Palo Alto launched the Strata Cloud Manager course in September 2026, and it’s one of the five courses we offer. Engineers moving off Panorama can train on the new tool with us.
We’ll confirm the PAN-OS version covered by each course before you book. If your firewalls run a newer release, our instructors can explain the relevant changes.
If you’re unsure which course fits each engineer, we can help you match them to the right one before you register.
3. Training That Fits Around Keeping Your Network Running
We choose the delivery format based on where your engineers are based. For organizations in India and KSA, our instructors come to your office, so engineers can train without leaving the building. For organizations in the US and APAC, we run classes live online, with an instructor your engineers can talk to throughout.
On-site classes put engineers who share the same network in one room. When someone asks how a lesson applies to your setup, the instructor’s answer helps everyone at once.
Live online classes have an advantage of their own when engineers are spread across several offices. Everyone learns the same material from the same instructor, so security practices stay consistent from one site to the next. For larger groups, we can run a private class for your organization alone.
4. Instructors Who Make Network Security Concepts Click
Our instructors care just as much about why something works as how to set it up. Once engineers understand the reasoning, they can work out problems on their own network with confidence.
In a recent Firewall Essentials class, the instructor compared rule order to a security guard checking visitors against a list of instructions. The guard follows the first matching instruction, ignoring the ones below it. The analogy helped participants identify why a lab rule wasn’t working. A broader rule above it matched the traffic first.
The same approach helps when engineers manage many firewalls at once. During a Panorama: NGFW Management class, a participant sent a change to all the lab firewalls, and all but one updated. The instructor paused the lab to show everyone why. That firewall had the setting changed directly on it, and the local change was taking priority over Panorama. Participants learned to check for local overrides when troubleshooting similar issues.
Because classes include engineers with different experience levels, instructors adjust the pace as needed. Newer engineers get more support with the fundamentals, while experienced participants can explore more complex scenarios.
5. Hands-On Practice With Real Network Problems
All five of our network security courses come with hands-on labs, set in a practice network built for the class. If a change breaks something, engineers can see exactly why and try again.
Much of the lab work involves diagnosing and fixing broken configurations. Engineers can practice the troubleshooting process in a controlled environment, without the pressure of a live outage.
In a recent Firewall: Troubleshooting class, participants investigated a simulated outage between a branch office and headquarters. Several checked the security rules first, but those weren’t the cause. The problem turned out to be mismatched security settings at the two ends of the connection. Rather than reveal the cause, the instructor guided participants toward the next place to investigate. After they solved it, the class reset the lab with a different fault and repeated the exercise.
And the practice doesn’t have to stop when the course does. Engineers retain lab access for two days after the course, giving them time to revisit difficult exercises and reinforce what they’ve learned.
Here’s how one participant described the hands-on side of the course:
Using Palo Alto Networks Training Credits for Network Security Courses
If your organization has Palo Alto Networks Training Credits, you can use them on any of our five network security courses. It’s an easy way to put credits you’ve already paid for to good use.
Palo Alto Networks values each Training Credit at $100 and charges 10 credits per training day. Here’s how many credits each course requires.
| Course | Length | Training Credits |
| Firewall Essentials: Configuration and Management (EDU-210) | 5 days | 50 |
| Firewall: Troubleshooting (EDU-330) | 3 days | 30 |
| Panorama: NGFW Management | 2 days | 20 |
| Panorama: Centralized Network Security Administration | 2 days | 20 |
| Strata Cloud Manager: Network Security Management and Administration | 2 days | 20 |
An engineer taking Firewall Essentials followed by Strata Cloud Manager would use 70 Training Credits in total.
However, keep an eye on the date. Training Credits expire 12 months after they’re purchased, so it helps to book courses well before that.
To book with Training Credits, email training@datacipher.net with your Training Credit ID and preferred course, or use the form on any Palo Alto course page. We’ll confirm the credits required for each engineer and help schedule training before your credits expire.
Choosing Your Palo Alto Network Security Training Partner
As Palo Alto’s network security platform evolves, your engineers need training that keeps pace. The right training partner helps them build the skills to manage firewalls and troubleshoot problems effectively.
Use these five factors to compare training partners based on your team’s needs. To explore Datacipher’s courses and upcoming dates, contact us at training@datacipher.net or use the form on any Palo Alto course page.
