topic Re: Restrict Any Any from Security Policy in General Topics

Restrict Any Any from Security Policy

nicford — Thu, 08 Jun 2017 20:15:21 GMT

Hi There,

At one of our sites we fell vicitim and have the dreaded any any security policy in place. We are trying to determine the best course of action to lock it down.

Would I create tap firewall ports and span all the traffic, then create new rules based on it in tap zones?

Any guides out them to assist for this specific situation?

Re: Restrict Any Any from Security Policy

Raido_Rattameister — Thu, 08 Jun 2017 20:16:55 GMT

Check Monitor tab or run reports to see what applications pass this firewall.

Create rule to permit those applications you want.

You can also create second rule for known bad above any any.

Eventually nothing should hit any any rule and you can remove it.

Re: Restrict Any Any from Security Policy

nicford — Thu, 08 Jun 2017 20:18:04 GMT

this article looks promising: https://popravak.wordpress.com/2014/08/27/palo-alto-ngfw-use-case-one-monitoring-traffic-tap-mode/

It's unfortunate now i cant identify zones too easily. But I can make intelligent guesses based on source/dest ips.

Re: Restrict Any Any from Security Policy

Raido_Rattameister — Thu, 08 Jun 2017 21:02:54 GMT

Can you explain if Palo is in place and inline already as firewall or you have some legacy firewall and you want to put Palo into tap mode to listen what is going on?

Re: Restrict Any Any from Security Policy

BPry — Thu, 08 Jun 2017 21:04:47 GMT

Such as @Raido_Rattameister said you need to slowly start chipping away at the rule by monitoring what's actually hitting the any any rule. Eventually it will get to the point where you can delete it and use it as a learning experiance of "this is why you don't do it like this, it took me weeks to fix it". Have fun!

edit: You do realize that if you put it in tap mode you can't act on the traffic right?