Palo Alto Networks Certified Next-Generation Firewall Engineer credential artwork

Palo Alto Networks Certified Next-Generation Firewall Engineer (NGFW Engineer) (NGFW-Engineer)

Validates practical skills in configuring Palo Alto Networks firewalls, including PAN-OS networking, device settings, Panorama and deployment automation.

Summary

NGFW Engineer is Palo Alto Networks' specialist certification for engineers who configure and run its next-generation firewalls. It tests PAN-OS networking, device settings, Panorama and deployment automation, the skills involved in running these firewalls day to day.

Good fit if

  • You configure and run Palo Alto firewalls and Panorama
  • You held or were preparing for the retired PCNSE
  • You work for a partner, MSP or Palo Alto enterprise

Look elsewhere if

  • You need vendor-neutral networking foundations first: CCNA
  • You want broad security fundamentals: Security+
  • You do not use Palo Alto firewalls daily: the exam assumes hands-on experience

Prerequisites

No required prerequisites. Anyone can buy a voucher and book the exam.

2–3 years in IT security

Recommended

Including about two years working with Palo Alto Networks NGFW products.

Network Security Professional or Network Security Analyst

Recommended

Palo Alto’s professional- and specialist-level certifications in the same track.

Cost

USD · US voucher price
$250
Vouchers expire 12 months after purchase. A retake needs a new voucher, after a 15-day wait for the second attempt.

What holders say

Renewal

NGFW Engineer is valid for two years from the day you pass.

Validity
2 years
Renewal requirement
Pass the current exam again
Renewal fee
$250 USD
Exam voucher

You can retake the exam to recertify from 18 months after passing. Earning a higher-level certification in the same Palo Alto track also extends an active certification by two years.

Palo Alto Networks certification handbook ↗

Alternatives

Cisco Certified Network Associate credential artwork
CCNA$300 required · Intermediate

Vendor-neutral networking foundations, from Cisco.

Cisco Certified Network Professional Enterprise credential artwork
CCNP Enterprise$700 required · Intermediate

Enterprise networking on Cisco platforms.

CompTIA Security+ credential artwork
CompTIA Security+$439 required · Entry

Broad, vendor-neutral security fundamentals.

FAQ

Is NGFW Engineer the same as PCNSE?

No. It replaced PCNSE in 2025 with a new blueprint covering similar hands-on firewall skills, plus current deployment options and automation.

Can I still take PCNSE?

No. PCNSE, PCNSA and PCSFE were retired in 2025. NGFW Engineer is the current firewall engineering exam.

How much does the NGFW Engineer exam cost?

$250 for a US voucher, valid for 12 months.

How do I renew NGFW Engineer?

Pass the current exam again within two years. You can retake it from 18 months after passing. A higher-level certification in the same track also extends it.

Last updated October 2026