>
    Add Applications to an Existing Rule
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. App-ID
    4. Security Policy Rule Optimization
    5. Add Applications to an Existing Rule
    Download PDF

    Add Applications to an Existing Rule

    Table of Contents
    End-of-Life (EoL)

    Add Applications to an Existing Rule

    Use Policy Optimizer to add apps seen on a port-based Security policy rule to an existing application-based rule.
    In some cases, you may want to add applications learned (seen) on a port-based rule to a rule that already exists. For example, an administrator may create a cloned application-based rule for general business web applications from a port-based rule that allows internet access (a port 80/443 rule). Later, the administrator notices that the port-based internet access rule has seen more general business applications and wants to add some or all of them to the cloned application-based rule (cloning another application-based rule for the same type of application would create an unnecessary rule and complicate the rulebase).
    This example assumes that an application-based Security policy rule to control general business traffic already exists or was cloned from a port-based internet access rule, similarly to the Rule Cloning Migration Use Case: Web Browsing and SSL Traffic. In that example, we cloned an application-based rule from the port-based internet access rule and changed the new rule’s Service to application-default to prevent web-based applications from using non-standard ports.
    In addition to adding applications to an existing application-based rule, you can add applications to an existing port-based rule. This converts the port-based rule to an application-based rule for the applications you add to the rule. If you do this, go to the rule and change the Service to application-default to prevent the applications from using non-standard ports (also, the Service configured on the rule may not match the application).
    1. You check the port-based internet access rule and discover that the rule has seen general business applications and that you need to allow some of them for business purposes.
    2. Select the general business apps you want to add to the existing rule.
    3. Click
      Add to Existing Rule
       and select the
      Name
       of the rule to which you want to add the applications, in this example,
      general-business-applications
      .
    4. Click
      OK
       in
      Add Apps to Existing Rule
      to add the selected applications to the
      general-business-applications
       rule.
    5. Click
      OK
       in
      Applications & Usage
      .
    6. The updated rule now controls the original applications on the rule and the applications you just added.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.