topic Security policy using group in negate form in General Topics

Security policy using group in negate form

zanonibs — Sat, 09 Apr 2011 20:54:05 GMT

Hi,

is it possible to create a security policy with user/group with NOT form?

for example : LAN => WAN !domain-group any all-app deny

My task is to create a rule in order to block all known users except those belongs to a specific domain group indentified correctly in the PAN GUI via LDAP handshake.

I've tried introducing a simple "!" simbol before the group name. Commit is OK but in practice nothing happened.

If somebody has tried succesfully a smarter solutions please inform me.

Regards

Re: Security policy using group in negate form

kbrazil — Sun, 10 Apr 2011 18:41:13 GMT

There are certain fields that can be negated (e.g. source and destination address) but I don't believe you can negate by source user group. The way to accomplish this is to use two rules in this order:

LAN -> WAN domain-group any all-app Allow
LAN -> WAN any-user any all-app Deny

Cheers,

Kelly

Re: Security policy using group in negate form

zanonibs — Thu, 14 Apr 2011 08:40:19 GMT

Sometimes is quite useful deny a specific source in the beginning rather than apply the classic "deny any any" at the end.

But if is not possible using the negate form of a source group/user then the solution you proposed it's the only that works.

Thanks for support