Set Up a Basic Security Policy
Table of Contents
Expand All
|
Collapse All
Next-Generation Firewall Docs
-
-
- Cloud Management of NGFWs
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
- PAN-OS 9.1 (EoL)
-
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1 & Later
-
-
-
- Cloud Management and AIOps for NGFW
- PAN-OS 10.0 (EoL)
- PAN-OS 10.1
- PAN-OS 10.2
- PAN-OS 11.0
- PAN-OS 11.1
- PAN-OS 11.2
- PAN-OS 8.1 (EoL)
- PAN-OS 9.0 (EoL)
- PAN-OS 9.1 (EoL)
End-of-Life (EoL)
Set Up a Basic Security Policy
Now that you defined some zones and attached
them to interfaces, you are ready to begin creating your Security
Policy. The firewall will not allow any traffic to flow from
one zone to another unless there is a Security policy rule that
allows it. When a packet enters a firewall interface, the firewall
matches the attributes in the packet against the Security policy
rules to determine whether to block or allow the session based on
attributes such as the source and destination security zone, the
source and destination IP address, the application, user, and the
service. The firewall evaluates incoming traffic against the Security policy
rulebase from left to right and from top to bottom and then takes
the action specified in the first Security rule that matches (for
example, whether to allow, deny, or drop the packet). This means
that you must order the rules in your Security policy rulebase so
that more specific rules are at the top of the rulebase and more
general rules are at the bottom to ensure that the firewall is enforcing
policy as expected.
Even though a Security policy rule allows
a packet, this does not mean that the traffic is free of threats. To
enable the firewall to scan the traffic that it allows based on
a Security policy rule, you must also attach Security
Profiles—including URL Filtering, Antivirus, Anti-Spyware,
File Blocking, and WildFire Analysis—to each rule (the profiles
you can use depend on which Subscriptions you purchased).
When creating your basic Security policy, use the predefined security
profiles to ensure that the traffic you allow into your network
is being scanned for threats. You can customize these profiles later
as needed for your environment.
Use the following workflow
set up a very basic Security policy that enables access to the network
infrastructure, to data center applications, and to the internet.
This enables you to get the firewall up and running so that you
can verify that you have successfully configured the firewall. However,
this initial policy is not comprehensive enough to protect your
network. After you verify that you successfully configured the firewall
and integrated it into your network, proceed with creating a Best Practice Internet Gateway Security Policy that
safely enables application access while protecting your network
from attack.
- (Optional) Delete the default Security policy rule.By default, the firewall includes a Security policy rule named rule1 that allows all traffic from Trust zone to Untrust zone. You can either delete the rule or modify the rule to reflect your zone-naming conventions.
- Allow access to your network infrastructure resources.
- Selectand clickPoliciesSecurityAdd.
- In theGeneraltab, enter a descriptiveNamefor the rule.
- In theSourcetab, set theSource ZonetoUsers.
- In theDestinationtab, set theDestination ZonetoIT Infrastructure.As a best practice, use address objects in theDestination Addressfield to enable access to specific servers or groups of servers only, particularly for services such as DNS and SMTP that are commonly exploited. By restricting users to specific destination server addresses, you can prevent data exfiltration and command and control traffic from establishing communication through techniques such as DNS tunneling.
- In theApplicationstab,Addthe applications that correspond to the network services you want to safely enable. For example, selectdns,ntp,ocsp,ping, andsmtp.
- In theService/URL Categorytab, keep theServiceset toapplication-default.
- In theActionstab, set theAction SettingtoAllow.
- SetProfile TypetoProfilesand select the following security profiles to attach to the policy rule:
- ForAntivirus, selectdefault
- ForVulnerability Protection, selectstrict
- ForAnti-Spyware, selectstrict
- ForURL Filtering, selectdefault
- ForFile Blocking, selectbasic file blocking
- ForWildFire Analysis, selectdefault
- Verify thatLog at Session Endis enabled. Only traffic that matches a Security policy rule will be logged.
- ClickOK.
- Enable access to general internet applications.This is a temporary rule that allows you to gather information about the traffic on your network. After you have more insight into which applications your users need to access, you can make informed decisions about which applications to allow and create more granular application-based rules for each user group.
- SelectandPoliciesSecurityAdda rule.
- In theGeneraltab, enter a descriptiveNamefor the rule.
- In theSourcetab, set theSource ZonetoUsers.
- In theDestinationtab, set theDestination ZonetoInternet.
- In theApplicationstab,AddanApplication Filterand enter aName. To safely enable access to legitimate web-based applications, set theCategoryin the application filter togeneral-internetand then clickOK. To enable access to encrypted sites,Addthesslapplication.
- In theService/URL Categorytab, keep theServiceset toapplication-default.
- In theActionstab, set theAction SettingtoAllow.
- SetProfile TypetoProfilesand select the following security profiles to attach to the policy rule:
- ForAntivirus, selectdefault
- ForVulnerability Protection, selectstrict
- ForAnti-Spyware, selectstrict
- ForURL Filtering, selectdefault
- ForFile Blocking, selectstrict file blocking
- ForWildFire Analysis, selectdefault
- Verify thatLog at Session Endis enabled. Only traffic that matches a security rule will be logged.
- ClickOK.
- Enable access to data center applications.
- SelectandPoliciesSecurityAdda rule.
- In theGeneraltab, Enter a descriptiveNamefor the rule.
- In theSourcetab, set theSource ZonetoUsers.
- In theDestinationtab, set theDestination ZonetoData Center Applications.
- In theApplicationstab,Addthe applications that correspond to the network services you want to safely enable. For example, selectactivesync,imap,kerberos,ldap,ms-exchange, andms-lync.
- In theService/URL Categorytab, keep theServiceset toapplication-default.
- In theActionstab, set theAction SettingtoAllow.
- SetProfile TypetoProfilesand select the following security profiles to attach to the policy rule:
- ForAntivirus, selectdefault
- ForVulnerability Protectionselectstrict
- ForAnti-Spywareselectstrict
- ForURL Filteringselectdefault
- ForFile Blockingselectbasic file blocking
- ForWildFire Analysisselectdefault
- Verify thatLog at Session Endis enabled. Only traffic that matches a security rule will be logged.
- ClickOK.
- Save your policy rules to the running configuration on the firewall.ClickCommit.
- To verify that you have set up your basic policies effectively, test whether your Security policy rules are being evaluated and determine which Security policy rule applies to a traffic flow.For example, to verify the policy rule that will be applied for a client in the user zone with the IP address 10.35.14.150 when it sends a DNS query to the DNS server in the data center:
- Selectand selectDeviceTroubleshootingSecurity Policy Match(Select Test).
- Enter theSourceandDestinationIP addresses.
- Enter theProtocol.
- Selectdns(Application)
- Executethe Security policy match test.