>
    Provide Granular Access to the Policy Tab
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. Firewall Administration
    4. Reference: Web Interface Administrator Access
    5. Web Interface Access Privileges
    6. Provide Granular Access to the Policy Tab
    Download PDF

    Provide Granular Access to the Policy Tab

    Table of Contents

    Provide Granular Access to the Policy Tab

    If you enable the Policy option in the Admin Role profile, you can then enable, disable, or provide read-only access to specific nodes within the tab as necessary for the role you are defining. By enabling access to a specific policy type, you enable the ability to view, add, or delete policy rules. By enabling read-only access to a specific policy, you enable the administrator to view the corresponding policy rule base, but not add or delete rules. Disabling access to a specific type of policy prevents the administrator from seeing the policy rule base.
    Because policy that is based on specific users (by username or IP address) must be explicitly defined, privacy settings that disable the ability to see full IP addresses or usernames do not apply to the Policy tab. Therefore, you should only allow access to the Policy tab to administrators that are excluded from user privacy restrictions.
    Access Level
    Description
    Enable
    Read Only
    Disable
    Security
    Enable this privilege to allow the administrator to view, add, and/or delete security rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the security rulebase, disable this privilege.
    Yes
    Yes
    Yes
    NAT
    Enable this privilege to allow the administrator to view, add, and/or delete NAT rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the NAT rulebase, disable this privilege.
    Yes
    Yes
    Yes
    QoS
    Enable this privilege to allow the administrator to view, add, and/or delete QoS rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the QoS rulebase, disable this privilege.
    Yes
    Yes
    Yes
    Policy Based Forwarding
    Enable this privilege to allow the administrator to view, add, and/or delete Policy-Based Forwarding (PBF) rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the PBF rulebase, disable this privilege.
    Yes
    Yes
    Yes
    Decryption
    Enable this privilege to allow the administrator to view, add, and/or delete decryption rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the decryption rulebase, disable this privilege.
    Yes
    Yes
    Yes
    Network Packet Broker
    Enable this privilege to allow the administrator to view, add, and/or delete Network Packet Broker policy rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the Network Packet Broker rulebase in the interface, disable this privilege.
    Yes
    Yes
    Yes
    Tunnel Inspection
    Enable this privilege to allow the administrator to view, add, and/or delete Tunnel Inspection rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the Tunnel Inspection rulebase, disable this privilege.
    Yes
    Yes
    Yes
    Application Override
    Enable this privilege to allow the administrator to view, add, and/or delete application override policy rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the application override rulebase, disable this privilege.
    Yes
    Yes
    Yes
    Authentication
    Enable this privilege to allow the administrator to view, add, and/or delete Authentication policy rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the Authentication rulebase, disable this privilege.
    Yes
    Yes
    Yes
    DoS Protection
    Enable this privilege to allow the administrator to view, add, and/or delete DoS protection rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the DoS protection rulebase, disable this privilege.
    Yes
    Yes
    Yes
    SD-WAN
    Enable this privilege to allow the administrator to view, add, and/or delete SD-WAN policy rules. Set the privilege to read-only if you want the administrator to be able to see the rules, but not modify them. To prevent the administrator from seeing the SD-WAN policy rulebase, disable this privilege.
    Yes
    Yes
    Yes

    © 2024 Palo Alto Networks, Inc. All rights reserved.