Create Cloud NGFW resources and provision them to your
AWS CloudFormation template.
The Cloud NGFW provides flexibility to
provision resources to your AWS CloudFormation template (CFT) by
allowing you to create your own resources.
You must enable Programmatic
access before using CloudFormation Registry with the Cloud NGFW.
Use the
PaloAltoNetworks::CloudNGFW::RuleStack
and
PaloAltoNetworks::CloudNGFW::NGFW
schemas
to integrate the Cloud NGFW into your AWS CloudFormation template.
Use the provided syntax in this document to define Cloud NGFW firewall configuration
settings that you can integrate with AWS CloudFormation Registry.
to minimize
antivirus inspection for traffic between trusted security zones,
and to maximize the inspection of traffic received from untrusted
zones, such as the internet, as well as the traffic sent to highly
sensitive destinations, such as server farms. CustomSecurityProfiles
include:
JSON
{
"FileBlocking" : FileBlocking
}
YAML
FileBlocking: FileBlocking
PrefixList
Use
PrefixList
to filter routes based
on prefixes. By defining an order number and IP prefixes, a branch
or a data center ION device can permit or deny routes. The dynamic,
auto-generated prefix list is based on what the ION device advertises.
Prefixes can be split or non-split. A PrefixList includes:
object, DNS provides
the FQDN resolution to the IP addresses, removing the need to know
the IP addresses and manually updating them every time the FQDN
resolves to a new IP address. FqdnList includes:
to create a custom
URL filtering object to specify exceptions to URL category enforcement,
and to create a custom URL category based on multiple URL categories:
Define exceptions to URL category enforcement—Create a custom
list of URLs that you want to use as match criteria in a Security
policy rule. This is a good way to specify exceptions to URL categories,
where you’d like to enforce specific URLs differently than the URL
category to which they belong.
Define a custom URL category based on multiple PAN-DB categories—This
allows you to target enforcement for websites that match a set of
categories. The website or page must match all the categories defined
as part of the custom category.
to identify specific
file types that you want to block or monitor. For most traffic (including
traffic on your internal network) you will want to block files that
are known to carry threats or that have no real use case for upload/download.
FileBlocking includes:
Create
an execution role ARN for the extensions. Both extensions can use
the same role. Establish trust relationships in the role to consume
the Cloud Formation templates:
After
establishing the trust relationship, activate the extensions:
