Clarification on how PA process Security profile with applied Service/URL Category

RadianLinog — Thu, 12 Oct 2023 09:23:56 GMT

Hi All,

I have a quick question and hopefully someone can help me understand how security profile is processed by PA.

I understand that security profile is processed from left to right, then top to bottom. My question is, does all criteria need to match so that the traffic will match the rule? Is the logic used by PA is AND or OR?

Source and destination address
Source ports and destination ports
Applications
User-ID
URL category
Source and destination zones

Re: Clarification on how PA process Security profile with applied Service/URL Category

emr_1 — Thu, 12 Oct 2023 09:44:56 GMT

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVHCA0

This explains how PAN device handles packet and each feature works.

At beginning of section 3, it says...

A firewall session consists of two unidirectional flows, each uniquely identified. In PAN-OS ’s implementation, the firewall identifies the flow using a 6-tuple key:

Source and destination addresses: IP addresses from the IP packet.
Source and destination ports: Port numbers from TCP/UDP protocol headers. For non-TCP/UDP, different protocol fields are used (e.g. for ICMP the ICMP identifier and sequence numbers are used, for IPSec terminating on device the Security Parameter Index (SPI) is used, and for unknown, a constant reserved value is used to skip Layer-4 match).
Protocol: The IP protocol number from the IP header is used to derive the flow key .
Security zone: This field is derived from the ingress interface at which a packet arrives.

Other elements you are listing are used after few more packets are traversed.

Hope this helps you.

topic Clarification on how PA process Security profile with applied Service/URL Category in General Topics

Clarification on how PA process Security profile with applied Service/URL Category

Re: Clarification on how PA process Security profile with applied Service/URL Category