Palo alto intrazone and interzone rules

Bumenang — Thu, 26 May 2022 11:47:52 GMT

I want to be alerted if the Palo Alto default intrazone or interzone rules are ever set to "allow".

Re: Palo alto intrazone and interzone rules

PavelK — Thu, 26 May 2022 13:33:17 GMT

Thank you for the post @Bumenang

one way to go about it is to configure all Firewalls to send configuration logs to Panorama. This setting is under: Device > Log Settings > Configuration > [Configure new profile and select Panorama check box]. Then in Panorama configure under: Device > Log Settings > Configuration a new Configuration profile with below filter:

( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'intrazone-default\']' ) or ( full-path contains 'rulebase/default-security-rules/rules/entry[@name=\'interzone-default\']' )

and add an email profile:

With the above configuration every time, somebody changes intrazone-default or interzone-default rules, you will get an email alert.

Kind Regards

Pavel

Re: Palo alto intrazone and interzone rules

Bumenang — Tue, 31 May 2022 17:08:48 GMT

Thanks very much Pavel.

Please would you know how i can input this via code (Terraform)?

topic Re: Palo alto intrazone and interzone rules in Panorama Discussions

Palo alto intrazone and interzone rules

Re: Palo alto intrazone and interzone rules

Re: Palo alto intrazone and interzone rules