topic Configuring Palo Firewall into an IDS in General Topics

Configuring Palo Firewall into an IDS

SuhaimiMohd — Tue, 15 Apr 2025 07:20:19 GMT

Typically the ATP license would be used if we want to have the IPS features on the PA firewall. However, how do we configure the firewall if its meant to function as an IDS?

Re: Configuring Palo Firewall into an IDS

emr_1 — Tue, 15 Apr 2025 07:26:32 GMT

IDS means you just need to detect and then pass through them. (don't have to block/protect)

To do so, you just need to select "alert" action.

Please refer to following doc for the detail of each action.
https://docs.paloaltonetworks.com/network-security/security-policy/administration/security-profiles/security-profile-vulnerability-protection

Re: Configuring Palo Firewall into an IDS

SuhaimiMohd — Tue, 15 Apr 2025 07:32:15 GMT

Thanks for the quick response. So in this case, we still need the ATP, AURL license the least as it still pertains to Security Profiles except that the policies action will all be set to "alert"?

Re: Configuring Palo Firewall into an IDS

emr_1 — Tue, 15 Apr 2025 07:34:56 GMT

Yes, you need subscriptions/licenses to detect (and also to block)