topic Re: Selecting Appropriate Security Profile in Next-Generation Firewall Discussions

Selecting Appropriate Security Profile

Aaida — Mon, 22 May 2023 18:34:37 GMT

I am planning to make a group profile of security profiles which include, Vulnerability protection , antivirus , anti spyware and wildfire analysis profile. I am planning to provide same group for every policy in firewall. I have few questions on this approach.

1. Is this a good practice , Do calling this group for every policy will increase firewall processing time, as the group contains lot of security profile?

2. Suppose vulnerability protection profile has wide verity of security scanning in it. Some are for Web traffic or some are for DB traffic. The security group I provided for every rule is same. Hence do firewall will scan web vulnerabilities for DB traffic as well. Or do the firewall has the intelligence to scan only scan what in scope. or simply ignore unnecessary check even though it is included in rule profile?

Re: Selecting Appropriate Security Profile

S.Cantwell — Thu, 25 May 2023 22:43:14 GMT

Hello there.

It is recommended to apply a group profile to all rules that are allowed (no need to do it for drop/discard policies)
I would recommend you name the group to be called "default", so that when you create new policies, the FW will automatically associate that "default" group profile into your new rule. May not save too much time, but a few seconds is good. 😛

The FW is intelligent to scan what is in scope and ignore what is not needed.

Re: Selecting Appropriate Security Profile

Aaida — Fri, 26 May 2023 04:51:57 GMT

Hi @S.Cantwell ,

Thank you so much. This helped.