topic Re: Security Policies - Terminology in General Topics

Security Policies - Terminology

jmayne — Fri, 14 Jun 2013 14:24:43 GMT

I am coming from a Checkpoint environment and I am struggling with some of the terminology. I see a number of references in the Getting Started and the Administrator's guides to "Security Policies". To me this implies that I can create a number of policies but it looks like in fact there is only one policy per box and the policy has multiple rules. Am I missing something? Can you create, save and later apply different policies with distinct sets of rules?

Thanks,

Jim

Re: Security Policies - Terminology

VinceM — Fri, 14 Jun 2013 14:43:59 GMT

Hi Jim,

Welcome in PaloWorld 🙂

Security policy is like in all firewall, a rule which, based criteriun (source / Dest + User laptop profile ) allow or block your traffic

Security profile are type of analyse (antivirus, spyware, malware ..) that you will apply on allowed traffic.

Make sense ?

Re: Security Policies - Terminology

VinceM — Fri, 14 Jun 2013 14:48:53 GMT

Look this doc, it's a good document for starting with palo: https://live.paloaltonetworks.com/docs/DOC-4214

Re: Security Policies - Terminology

jmayne — Fri, 14 Jun 2013 14:55:00 GMT

Vince,

Thanks.I have read the Getting Started Guide but I am still confused. is it accurate that there is only one security policy or can you create, save and later apply different policies with distinct sets of rules? I was thinking that for instance on the Policies tab I could create and name multiple policies but it looks like the + button is the only add and it is to add rules not new overall policies. Again sorry if this is not making sense as it comes from a different perspective.

thanks,

Jim

Re: Security Policies - Terminology

VinceM — Fri, 14 Jun 2013 15:02:45 GMT

Maybe I don't understand what you are calling overall policies ..

If you try to find like policy separator, it doesn't exist in palo, in palo, it's done throught tags and use the research bar (on top) for showing only rule you want.

Re: Security Policies - Terminology

VinceM — Fri, 14 Jun 2013 15:05:15 GMT

https://live.paloaltonetworks.com/docs/DOC-3578#comment-3481

Re: Security Policies - Terminology

craymond — Mon, 24 Jun 2013 22:11:47 GMT

Each policy rule is a separate, individual policy. There is no way to group rules together under a singular policy. They are like individual ACLs. They are recognized in the order that they are organized, all traffic that is coming from the source zone to the destination zone is inspected to see if it matches the rule. As Vince said, there are "security profiles" that are created in the objects tab that can be grouped using "security profile groups" and attached to the policy rules but they are part of the policy rule.

The following DOC may help you understand:

https://live.paloaltonetworks.com/docs/DOC-1628

Re: Security Policies - Terminology

apasupulati — Tue, 25 Jun 2013 01:02:51 GMT

Hello,

If all you're trying to do is to save distinct rulebase configurations, first save the current configuration then make whatever rulebase changes required and save the new configuration. Load this new config to the device as/when needed.

You can save the configuration under Device tab-->Setup-->Operations--->save config snapshot.

Hope that helps,

Aditi

Re: Security Policies - Terminology

jmayne — Tue, 25 Jun 2013 12:59:38 GMT

Thanks. That's what I was looking for. I appreciate everyone's input.

Jim