Security profiles best practise

GKumar10 — Wed, 12 Apr 2023 06:47:47 GMT

Palo Alto have the following Security profiles by default (pre-defined)

Antivirus - default

Antivirus - default & strict

Vulnerability protection- default & strict

Would like to Palo alto recommendation on applying the different security profiles

If we are deploying a new Palo Alto firewalls in a new environment , would like to know if we can apply the default security profiles on all security policies belongs to Inbound and outbound firewalls without causing any business disruption.

Re: Security profiles best practise

TomYoung — Mon, 10 Apr 2023 12:17:29 GMT

Hi @GKumar10 ,

You have asked 2 questions:

Can you apply the security profiles to traffic without any business disruption? In most cases, yes. However, to verify no disruption you can apply the security profiles in alert mode and review the Threat/URL Filtering/Data Filtering logs for legitimate traffic that would be blocked. You can then tune the profiles before changing the action to block.
What is the PANW best practice recommendation for applying security profiles for a new NGFW?
1. Run the Day 1 Configuration from the Customer Support Portal (CSP) and load it on your new NGFW.
2. Run a Best Practice Assessment (BPA) on your NGFW from the CSP and apply those changes to the configuration.
3. Here is a good doc for best practice security profiles -> https://docs.paloaltonetworks.com/best-practices/10-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles. These recommendations should be consistent with the BPA.

Thanks,

Tom

topic Security profiles best practise in Advanced Threat Prevention Discussions

Security profiles best practise

Re: Security profiles best practise