>
    PAN-OS & Panorama
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Policy Objects
    5. Policy Object: Services
    6. PAN-OS & Panorama
    Download PDF
    Network Security

    PAN-OS & Panorama

    Table of Contents

    PAN-OS & Panorama

    Specify the source and destination ports and protocol that a service can use.
    Follow these steps to create a custom service.
    1. Go to
      Objects
      Services
      .
    2. Add
       a service.
    3. Configure the settings in this table:
      Service Settings
      Description
      Name
      Enter the service name (up to
      63
       characters). This name appears in the services list when defining Security security rules. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
      Description
      Enter a description for the service (up to 1,023 characters).
      Shared
      Select this option if you want the service object to be available to:
      • Every virtual system (vsys) on a multi-vsys. If you clear this selection, the service object will be available only to the
        Virtual System
         selected in the
        Objects
         tab.
      • Every device group on Panorama. If you clear this selection, the service object will be available only to the
        Device Group
         selected in the
        Objects
         tab.
      Disable override (
      Panorama only
      )
      Select this option to prevent administrators from overriding the settings of this service object in device groups that inherit the object. This selection is cleared by default, which means administrators can override the settings for any device group that inherits the object.
      Protocol
      Select the protocol used by the service (
      TCP
       or
      UDP
      ).
      Destination Port
      Enter the destination port number (0 to 65535) or range of port numbers (port1-port2) used by the service. Multiple ports or ranges must be separated by commas. The destination port is required.
      Source Port
      Enter the source port number (0 to 65535) or range of port numbers (port1-port2) used by the service. Multiple ports or ranges must be separated by commas. The source port is optional.
      Session Timeout
      Define the session timeout for the service:
      • Inherit from application
         (default)—No service-based timeouts are applied; the application timeout is applied.
      • Override
        —Define a custom session timeout for the service. Continue to populate the TCP Timeout, TCP Half Closed, and TCP Wait Time fields.
      The following settings display only if you choose to override application timeouts and create custom session timeouts for a service:
      TCP Timeout
      Set the maximum length of time in seconds that a TCP session can remain open after data transmission has started. When this time expires, the session closes.
      Range is 1 - 604800. The default value is 3600 seconds.
      TCP Half Closed
      Set the maximum length of time in seconds that a session remains open when only one side of the connection has attempted to close the connection.
      This setting applies to:
      • The time period after the first FIN packet is received (indicates that one side of the connection is attempting to close the session) but before it receives the second FIN packet (indicates that the other side of the connection is closing the session).
      • The time period before receiving an RST packet (indicating an attempt to reset the connection).
      If the timer expires, the session closes.
      Range is 1 - 604800. The default value is 120 seconds.
      TCP Wait Time
      Set the maximum length of time in seconds that a session remains open after receiving the second of the two FIN packets required to terminate a session, or after receiving an RST packet to reset a connection.
      When the timer expires, the session closes.
      The range is 1 - 600. The default value is 15 seconds.
    4. Select
      OK
       to save your configuration.
    5. Commit
       the configuration.

    Create a Service Group

    To simplify the creation of Security rules, you can combine services that have the same security settings into Service Groups.
    1. Go to
      Manage
      Configuration
      NGFW and Prisma Access
      Objects
      Service
      Service Groups
      .
    2. Add Service Group
      .
    3. Configure the settings in this table:
      Service Group Settings
      Description
      Name
      Enter the Service Group name (up to
      63
       characters). This name appears in the services list when defining Security rules. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, and underscores.
      Shared
      Select this option if you want the Service Group to be available to:
      • Every virtual system (vsys) on a multi-vsys. If you clear this selection, the Service Group will be available only to the
        Virtual System
         selected in the
        Objects
         tab.
      • Every device group on Panorama. If you clear this selection, the Service Group will be available only to the
        Device Group
         selected in the
        Objects
         tab.
      Disable override (
      Panorama only
      )
      Select this option to prevent administrators from overriding the settings of this Service Group object in device groups that inherit the object. This selection is cleared by default, which means administrators can override the settings for any device group that inherits the object.
      Service
      Click
      Add
       to add services to the group. Select from the drop-down or click
      Service
       at the bottom of the drop-down and specify the settings.
    4. Select
      OK
       to save your configuration.
    5. Commit
       the configuration.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.