The firewall automatically numbers each rule and the order of the rules will change as rules are moved. When you filter rules to match specific filters, each rule displays with its number in the context of the complete set of rules in the rulebase and its place in the evaluation order.

Panorama independently numbers pre-rules and post-rules. When Panorama pushes rules to a managed firewall, the rule numbering incorporates hierarchy in pre-rules, firewall rules, and post-rules within a rulebase and reflects the rule sequence and its evaluation order.

Enter a name to identify the rule. The name is case-sensitive and can have up to 63 characters, which can be letters, numbers, spaces, hyphens, and underscores. The name must be unique on a firewall and, on Panorama, unique within its device group and any ancestor or descendant device groups.

Specifies whether the rule applies to traffic within a zone, between zones, or both:

Enter a description for the policy (up to 1,024 characters).

Specify the tag for the policy.

A policy tag is a keyword or phrase that allows you to sort or filter policies. This is useful when you have defined many policies and want to view those that are tagged with a particular keyword. For example, you may want to tag certain rules with specific words like Decrypt and No-decrypt, or use the name of a specific data center for policies associated with that location.

You can also add tags to the default rules.

Add source zones (default is Any). Zones must be of the same type (Layer 2, Layer 3, or virtual wire). To define new zones, refer to Network > Zones.

Multiple zones can be used to simplify management. For example, if you have three different internal zones (Marketing, Sales, and Public Relations) that are all directed to the untrusted destination zone, you can create one rule that covers all cases.

Add source addresses, address groups, or regions (default is Any). Select from the drop-down or select Address object, Address Group, or Regions (bottom of the drop-down) to specify the settings. Objects>Addresses and Objects>AddressGroups describe the types of address objects and address groups, respectively, that a Security policy rule supports.

Selecting the Negate option will apply the rule to source addresses from the specified zone except for the addresses specified.

Add the source users or groups of users subject to the policy:

Add the host devices subject to the policy:

Add host information profiles (HIP) to enable you to collect information about the security status of your end hosts, such as whether they have the latest security patches and antivirus definitions installed. Using host information profiles for policy enforcement enables granular security that ensures that the remote hosts accessing your critical resources are adequately maintained and in adherence with your security standards before they are allowed to access your network resources. The following source HIP profiles are supported:

Add one or more source subscribers in a 5G or 4G network using the following formats:

Add one or more source network slices based on network slice service type (SST) in a 5G network, as follows:

Add destination zones (default is any). Zones must be of the same type (Layer 2, Layer 3, or virtual wire). To define new zones, refer to Network > Zones.

Multiple zones can be used to simplify management. For example, if you have three different internal zones (Marketing, Sales, and Public Relations) that are all directed to the untrusted destination zone, you can create one rule that covers all cases.

Add specific applications for the Security policy rule. If an application has multiple functions, you can select the overall application or individual functions. If you select the overall application, all functions are included and the application definition is automatically updated as future functions are added.

If you are using application groups, filters, or containers in the Security policy rule, you can view details of these objects by hovering over the object in the Application column, opening the drop-down, and selecting Value. This allows you to view application members directly from the policy without having to navigate to the Object tab.

Select the services that you want to limit to specific TCP or UDP port numbers. Choose one of the following from the drop-down:

Select the Action the firewall takes on traffic that matches the attributes defined in a rule:

Because the default deny action varies by application, the firewall could block the session and send a reset for one application while it silently drops the session for another application.

To view the ICMP Unreachable Packet Rate configured on the firewall, view Session Settings (DeviceSetupSession).

To override the default action defined on the predefined interzone and intrazone rules: see Overriding or Reverting a Security Policy Rule.

To specify the additional checking that the firewall performs on packets that match the Security profile rule, select individual Antivirus, Vulnerability Protection, Anti-Spyware, URL Filtering, File Blocking, Data Filtering, WildFire Analysis, Mobile Network Protection, and SCTP Protection profiles.

To specify a profile group rather than individual profiles, select the Profile Type to be Group and then select a Group Profile.

To define new profiles or profile groups, click New next to the appropriate profile or select New Group Profile.

You can also attach Security Profiles (or profile groups) to the default rules.

To generate entries in the local traffic log for traffic that matches this rule, select the following options:

You can also modify the log settings on the default rules. Specify any combination of the following options:

Enable (check) to push the policy rule to all managed firewalls in the device group.