Best practice for setting security policies between trusted zones?

lln_neteng — Wed, 27 Apr 2011 22:31:17 GMT

Is it best practice to combine all trusted zones into one policy? (See below)

Or Split them out like this (See Below)

Re: Best practice for setting security policies between trusted zones?

skrall — Thu, 28 Apr 2011 17:16:04 GMT

We really do not have any "Best Practices" with regard to this because different customers/industries have different needs. This is often done to simplify the ruleset especially if there are 2 or more zones with identical security requirements. The paloalto logs traffic that traverse zones so this is sometimes preferred to having 3 interfaces all part of zone = trust. Combining all of the zones in one rule can also fix or compensate for some of the "side effects" of creating an "Any/Any/Deny" rule for cleanup and logging.

Steve Krall

topic Best practice for setting security policies between trusted zones? in General Topics

Best practice for setting security policies between trusted zones?

Re: Best practice for setting security policies between trusted zones?