Determine whether to block or allow a session based on traffic attributes such as the source and destination security zone, the source and destination IP address, the application, user, and the service. For details, see Security Policy.

Determine which packets need translation and how to do the translation. Both source address and/or port translation and destination address and/or port translation are supported. For details, see NAT.

Identify traffic requiring QoS treatment (either preferential treatment or bandwidth-limiting) using a defined parameter or multiple parameters and assign it a class. For more details, see Quality of Service.

Identify traffic that should use a different egress interface than the one that would normally be used based on the routing table. For more details, see Policy Based Forwarding.

Identify encrypted traffic that you want to inspect for visibility, control, and granular security. Decryption security rules allow you to define traffic to decrypt and the type of SSL decryption, you want to perform on the indicated traffic. All you need to do to start decrypting traffic is set up the certificates Prisma Access requires to act as a trusted third-party to a session. For everything else, we’ve built in best practice decryption settings, including settings to exclude sensitive content from decryption, as well as sites that are known to not work well when decrypted. For more details, see Decryption.

Enforce Security, DoS Protection, and QoS policies on tunneled traffic, and to view tunnel activity.

Identify sessions that you do not want processed by the App-ID engine, which is a Layer-7 inspection. Traffic matching an application override policy forces the session to be handled as a regular stateful inspection at Layer-4 and saves application processing times. You can create an application override security rule when you do not want traffic inspection for custom applications between known IP addresses. For example, if you have a custom application on a non-standard port that you know users accessing the application are sanctioned, and both are in the Trust zone, you can override the application inspection requirements for the trusted users accessing the custom application. For more details, see Application Override Policy.

Identify traffic that requires users to authenticate. For more details, see Authentication Policy.

Identify potential denial-of-service (DoS) attacks and take protective action in response to rule matches. For more details, see DoS Protection Profiles.