Add a Stacked Security Policy Rule

Add a security policy rule to a simple security stack.
Select
Manage
Policies
Security
Security Stacks
Simple
Select a Stack
Add Rule
.
Select an action for the rule.
Configure general allow or deny rules first, then add more specific access and deny rules and have them listed in higher priority order so that they are evaluated before the broader rules.
On the
Info
tab:
Enter a
Name
for the policy rule, and optionally enter description and tags.
Enter an
order
between 1-65535 for the policy rule.
An order of 1 indicates the highest priority for the policy rule. If you leave this field blank, the rule is given the least priority.
(Optional)
Select
Disable Rule
if you do not want the ION device to consider this rule.
Select the action to take for traffic matching this rule as either
Allow
,
Deny
, or
Reject
. The default action is
Allow
.
Allow—Indicates that the ION device allows traffic that matches the parameters specified in the rule.
Deny—Indicates that the ION device drops traffic without sending a RESET or ICMP HOST UNREACHABLE message to the client or server.
Reject—Indicates that the ION device rejects traffic that matches the parameters specified in the rule and sends a RESET message to both the client and the server.
(Optional)
Configure services for the rule.
Add protocols, source ports, and destination ports to make the policy rule more specific.
On the
Services
tab:
(Optional)
Click
Add Service
to add protocols, source ports, and/or destination ports.
(Optional)
Select a protocol from the
Protocol
drop-down.
(Optional)
Select
Source Port Ranges
between 1 and 65535. Click
Add Port Range
for additional port ranges. You can add a maximum of 16 source port ranges.
(Optional)
Select
Destination Port Ranges
between 1 and 65535. Click
Add Port Range
for additional port ranges. You can add a maximum of 16 destination port ranges.
(Optional)
Add zones and prefixes.
While creating security policy rules, specify the source and destination zones to which the rule applies and establish one or more source and destination zones for each security rule. The source zone identifies the LAN network from where traffic originates, and the destination zone identifies traffic from the LAN network.
Prefixes restrict access within a branch and filter out traffic to specific IP addresses within the particular source and destination zones.
Configure security zones and security prefixes before using them in security policy rules.
On the
Zones & Prefixes
tab:
(Optional)
Select a source
Zone
and
Prefix
.
(Optional)
Select a destination
Zone
and
Prefix
.
(Optional)
Add applications.
Applications are the core element of the security solution for controlling network traffic and implementing security policies. You can use the same application definitions and fingerprinting technologies for security policies, path selection for network policies, and for Quality of Service (QoS) implementation in QoS policies.
On the
Applications
tab:
Select the applications to apply the policy rule.
You can select 16 applications for one policy rule.
You can filter applications based on:
For sites 6.0.1 or above—Select this option to view system applications from PANW, applications common to PANW and
Prisma SD-WAN
, and custom applications defined in
Prisma SD-WAN
.
For sites below 6.0.1—Select this option to view legacy system applications in
Prisma SD-WAN
, applications common to PANW and Prisma SD-WAN, and custom applications defined in
Prisma SD-WAN
.
For any site—Use this option to view applications common to PANW and
Prisma SD-WAN
along with custom applications defined in
Prisma SD-WAN
.
(Optional)
You can check the type of application -
System (PANW, CGX)
,
System (CGX)
, or
Custom
by selecting the application first and then using the filters to view the type of application.
Add a security policy rule to an advanced security stack.
Select
Manage
Policies
Security
Security Stacks
Advanced
Security Sets
Select a Security Set
Add Rule
.
Follow the steps above for adding a security policy rule to an advanced security stack.