topic Re: Policies / application question in General Topics

Policies / application question

mathiasj — Fri, 02 Dec 2016 11:29:31 GMT

Just trying to understand PAN and policies better.

If we want to allow all web-browsing, what can we do?

As soon as the application is identified, we will need a policy for this specific application (for example Google base). Otherwise we will hit an interzone default deny (if between zones).

I can allow port 80 and 443 as services, but this will allow tunneling traffic on these ports. But I would like to allow only web browsing.

How can this be done?

Re: Policies / application question

TranceforLife — Fri, 02 Dec 2016 11:45:25 GMT

Hi,

Yes, you need to specify an application in the policy and I would advise using default in the service tab. Palo will do deep packet inspection ( APP-ID) hence tunnelling unlikely here.

https://live.paloaltonetworks.com/t5/Community-Blog/What-is-App-ID/ba-p/51878

Re: Policies / application question

reaper — Fri, 02 Dec 2016 13:08:32 GMT

i did a little video on the topic 😉 : Configuring Your Security Policy