topic Methods for creating security policies in General Topics

Methods for creating security policies

MemphisBrothers — Tue, 17 Dec 2013 01:07:04 GMT

When creating security policies would it be better to create a separate policy for inbound and outbound traffic, trusted and untrusted, per user group or one policy to manage both ways to minimize number of policies

Re: Methods for creating security policies

tasonibare — Tue, 17 Dec 2013 06:56:27 GMT

Hello MemphisBrothers,

Most deployments choose to have separate rules for inbound and outbound traffic in order to properly log the security rule permitting the respective traffic.

By doing this, you could also be more granular and selective in the traffic permitted in or out of your network.

If you only need to permit the same type of traffic in and out, and don't care too much about individual control on either of the directions, then you can create one policy for both directions to minimize number of policies.

Regards,

tasonibare

Re: Methods for creating security policies

Gregoux — Tue, 17 Dec 2013 11:23:50 GMT

Hello guys

a good way is:

you don't have to create on both direction the rule.

you need to create only a rule to allow the traffic base on the initiation side of this traffic, on which you could activate log at start or at end session, we prefere at end session to minimise logs.

and If you want to have a log for all drop packet, create at the bottom of rule list a deny all rule base on any zone src, any zone dst, and any app with a deny action and log at start session.

Re: Methods for creating security policies

MemphisBrothers — Wed, 18 Dec 2013 00:57:45 GMT

That's how we are doing it. I do like more granular management to troubleshoot the apps attached to multimedia sites better.

Re: Methods for creating security policies

Gregoux — Wed, 18 Dec 2013 08:16:47 GMT

Ok in this case you just have to follow the deny action in the log traffic, that could show you what application is reconized by palo even multimedia apps or website multimedia if you have the url categorization enabled.

and create rule base on application or url categorie or service to allow that you want to allow.

regard's