topic Re: Primsa Sase Web Security in Prisma Access Discussions

Primsa Sase Web Security

batd2 — Sat, 25 Nov 2023 13:45:56 GMT

Hi all

I am trying to understand the Prisma Access Cloud Managed Web Security policies. There are options to match on users or services. But how is traffic identified as "Web" if all settings are left to default. And will Web Security policy take precedence over Security Policy configured in the same folder?

Re: Primsa Sase Web Security

batd2 — Tue, 12 Dec 2023 09:38:44 GMT

No one able to answer?

Re: Primsa Sase Web Security

nikoolayy1 — Mon, 08 Jan 2024 20:39:12 GMT

To get an answer from someone inside Palo Alto better contact your sales manager. From what I can tell it is doing app identification as even If you have not created application override Palo Alto still does basic app identification, so auto matching web-browsing and ssl and app shift when decrypted to web-browsing does not seem complex.

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/about-web-security

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-order-for-web-security-and-security-policy

Re: Primsa Sase Web Security

batd2 — Tue, 09 Jan 2024 08:49:51 GMT

@nikoolayy1 This is not related to the question. The query is about the Prisma Access Cloud based web policy

Re: Primsa Sase Web Security

nikoolayy1 — Tue, 09 Jan 2024 10:38:07 GMT

Prisma Access in the background uses Palo Alto Firewalls. I think that it is not the virtual edition but some form of container based but still the same code with the same functions and it does not matter if it is not managed by Panorama but in the cloud.

Re: Primsa Sase Web Security

nikoolayy1 — Wed, 10 Jan 2024 16:32:11 GMT

Also for SAAS App ID Prisma Access and the firewalls use App-ID Cloud Engine (ACE) https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/cloud-based-app-id-service if you are interested in this.

Re: Primsa Sase Web Security

KeithPartin — Wed, 10 Jan 2024 17:46:47 GMT

I am using Prisma Access SASE and have wondered the same thing. The best resource I have found is here: https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-order-for-web-security-and-security-policy

Web Access Policies are applied before Security Policies. I generally prefer security policies for their granularity, but sometimes it's hard to create a security policy that doesn't violate some "best practice", in which case I fall back on Web Access Policies.