Monitor and Fine Tune the Policy Rulebase

A best practice security policy is iterative. It is a tool for safely enabling applications, users, and content by classifying all traffic, across all ports, all the time. As soon as you Define the Initial Internet Gateway Security Policy, you must begin to monitor the traffic that matches the temporary rules designed to identify policy gaps and alarming behavior and tune your policy accordingly. By monitoring traffic hitting these rules, you can make appropriate adjustments to your rules to either make sure all traffic is hitting your whitelist application allow rules or assess whether particular applications should be allowed. As you tune your rulebase, you should see less and less traffic hitting these rules. When you no longer see traffic hitting these rules, it means that your positive enforcement whitelist rules are complete and you can Remove the Temporary Rules.

Because new App-IDs are added in weekly content releases, you should review the impact the changes in App-IDs have on your policy.

Create custom reports that let you monitor traffic that hits the rules designed to identify policy gaps.

Select

Monitor

Manage Custom Reports

Add

a report and give it a descriptive

Name

that indicates the particular policy gap you are investigating, such as Best Practice Policy Tuning.

Set the

Database

Traffic Summary

Select the

Scheduled

check box.

Add the following to the Selected Columns list:

Rule

Application

Bytes

Sessions

Set the desired

Time Frame

Sort By

and

Group By

fields.

Define the query to match traffic hitting the rules designed to find policy gaps and alarming behavior. You can create a single report that details traffic hitting any of the rules (using the

operator), or create individual reports to monitor each rule. Using the rule names defined in the example policy, you would enter the corresponding queries:

(rule eq 'Unexpected Port SSL and Web')

(rule eq 'Unknown User SSL and Web')

(rule eq 'Unexpected Traffic')

(rule eq 'Unexpected Port Usage')

Review the report regularly to make sure you understand why traffic is hitting each of the best practice policy tuning rules and either update your policy to include legitimate applications and users, or use the information in the report to assess the risk of that application usage and implement policy reforms.

Document:PAN-OS Administrator's Guide

Monitor and Fine Tune the Policy Rulebase

Monitor and Fine Tune the Policy Rulebase

Related Documentation