Create a Security Policy Rule
- (Optional) Delete the default Security
policy rule.By default, the firewall includes a security rule named rule1 that allows all traffic from Trust zone to Untrust zone. You can either delete the rule or modify the rule to reflect your zone naming conventions.
- Add a rule.
- Select PoliciesSecurity and Add a new rule.
- In the General tab, enter a descriptive Name for the rule.
- Select a Rule Type.
- Define the matching criteria for the source fields in
- In the Source tab, select a Source Zone.
- Specify a Source IP Address or leave the value set to any.
- Specify a Source User or leave the value set to any.
- Define the matching criteria for the destination fields
in the packet.
- In the Destination tab, set the Destination Zone.
- Specify a Destination IP Address or
leave the value set to any.As a best practice, use address objects as the Destination Address to enable access to only specific servers or specific groups of servers especially for commonly exploited services, such as DNS and SMTP. By restricting users to specific destination server addresses, you can prevent data exfiltration and command-and-control traffic from establishing communication through techniques such as DNS tunneling.
- Specify the application that the rule will allow or block.As a best practice, always use application-based security policy rules instead of port-based rules and always set the Service to application-default unless you are using a more restrictive list of ports than the standard ports for an application.
- In the Applications tab, Add the Application you want to safely enable. You can select multiple applications or you can use application groups or application filters.
- In the Service/URL Category tab, keep the Service set to application-default to ensure that any applications that the rule allows are allowed only on their standard ports.
- (Optional) Specify a URL category as match criteria
for the rule.In the Service/URL Category tab, select the URL Category.If you select a URL category, only web traffic will match the rule and only if the traffic is destined for that specified category.
- Define what action you want the firewall to take for
traffic that matches the rule.In the Actions tab, select an Action. See Security Policy Actions for a description of each action.
- Configure the log settings.
As a best practice, do not select the check box to Disable Server Response Inspection (DSRI). Selecting this option prevents the firewall from inspecting packets from the server to the client. For the best security posture, the firewall must inspect both the client-to-server flows and the server-to-client flows to detect and prevent threats.
- By default, the rule is set to Log at Session End. You can disable this setting if you don’t want any logs generated when traffic matches this rule or you can select Log at Session Start for more detailed logging.
- Select a Log Forwarding profile.
- Attach security profiles to enable the firewall to scan
all allowed traffic for threats.Make sure you create best practice security profiles that help protect your network from both known and unknown threats.In the Actions tab, select Profiles from the Profile Type drop-down and then select the individual security profiles to attach to the rule.Alternatively, select Group from the Profile Type drop-down and select a security Group Profile to attach.
- Click Commit to save the policy rule to the running configuration on the firewall.
- To verify that you have set up your basic security policies
effectively, test whether your security policy rules are being evaluated and
determine which security policy rule applies to a traffic flow.The output displays the best rule that matches the source and destination IP address specified in the CLI command.For example, to verify the policy rule that will be applied for a server in the data center with the IP address 220.127.116.11 when it accesses the Microsoft update server:
- Select DeviceTroubleshooting, and select Security Policy Match from the Select Test drop-down.
- Enter the Source and Destination IP addresses.
- Enter the Protocol.
- Execute the security policy match test.
- After waiting long enough to allow traffic to pass through the firewall, View Policy Rule Usage to monitor the policy rule usage status and determine the effectiveness of the policy rule.
Set Up a Basic Security Policy
Set Up a Basic Security Policy Now that you defined some zones and attached them to interfaces, you are ready to begin creating your Security ...
Use Device Groups to Push Policy Rules
Use Device Groups to Push Policy Rules The third task in Use Case: Configure Firewalls Using Panorama is to create the device groups to manage ...
Security Policy Overview
Security Policy Overview Security policies allow you to enforce rules and take action, and can be as general or specific as needed. The policy rules ...
Create Internet-to-Data-Center Decryption Policy Rules
Create rules that decrypt partner, vendor, customer, and other third-party traffic from the internet to the data center so you can inspect the traffic and ...
Use Case: Use URL Categories for Policy Matching
Use Case: Use URL Categories for Policy Matching You can also use URL categories as match criteria in the following policy types: Authentication, Decryption, Security, ...
Create a Decryption Policy Rule
Decryption policy rules granularly define the traffic to decrypt or not to decrypt based on the source, destination, service (application port), and URL Category. ...
Create Data-Center-to-Internet Decryption Policy Rules
Create rules that decrypt update, certificate checking, and any other traffic from data center servers to internet servers so that you can inspect the traffic ...
Enforce Policy on an External Dynamic List
Enforce Policy on an External Dynamic List Block or allow traffic based on IP addresses or URLs in an external dynamic list, or use an ...
Building Blocks in a Security Policy Rule
Building Blocks in a Security Policy Rule Policies > Security The following section describes each component in a Security policy rule . When you create ...