topic Re: PA is Default Deny in General Topics

PA is Default Deny

choff123 — Wed, 17 Apr 2013 17:09:27 GMT

Stupid question. Just need confirmation.

PA (42020) devices are default deny correct?

If a packet is not specifically allowed or denied by a rule; when it gets to the bottom of the rules the default action is to deny, correct?

thanks

--CH

Re: PA is Default Deny

mikand — Wed, 17 Apr 2013 17:11:43 GMT

Yes its denied but not logged.

In order to get denied packets logged you need to manually put a security policy in the end that says:

srczone: any

dstzone: any

srcip: any

dstip: any

user: any

appid: any

service: any

options: log on session end

action: deny

Re: PA is Default Deny

Anon1 — Wed, 17 Apr 2013 20:09:32 GMT

Hi,

just be careful with such an "deny all" rule since it will break intrazone traffic (traffic ingress and egress the same zone, this also includes e.g. ping to a data interface when enabled).

You can temporarily enable logging of the default deny rule on the CLI: set system setting logging default-policy-logging

Re: PA is Default Deny

Jermaine_Scott — Tue, 31 Oct 2017 21:29:05 GMT

With an intrazone rule created before it, is there a good reason (security purposes ot other) not to have the Deny All rule in place at the end? Or is it more of personal preference?

Re: PA is Default Deny

LukeBullimore — Fri, 03 Nov 2017 09:36:02 GMT

Creating a Deny-All rule is bad practice, don't do it. If there is intrazone traffic (Trust to Trust for example) that has not been allowed by a previous rule, this will be denied because your Deny-All rule will be matching before the Intrazone-default rule.

You don't need to make a deny-all rule to see denied traffic, you can actually click the click the default intra/interzone-default rules, click "Override" next to the Clone button at the bottom to edit them, then you can enable the "Log at session end" options under the Action tab.