https://live.paloaltonetworks.com/t5/general-topics/security-profile-group-best-practice/m-p/185482#M56737 Yes, apply your secy=urity profiles to both. Inbound initiated traffic needs security profiles to protect you from exploits targeting a weakness in your front facing web services. Outbound initiated traffic needs security profiles to protect your browsers or other clients from weaknesses in those browsers or malware download. It also benefits from PanDB URL filtering. You may find in practice that you like different profiles for inbound initiated than outbound initiated traffic, e.g. URL filtering makes a lot more sense Outbound than Inbound. Many people may have more Outbound rules than Inbound rules, so you may want to consider using a Security Profile Group with name "default" for your Outbound traffic, which will then be applied automatically to all new security rules you recreate. Sat, 04 Nov 2017 15:49:37 GMT BenLassila 2017-11-04T15:49:37Z https://live.paloaltonetworks.com/t5/general-topics/security-profile-group-best-practice/m-p/185451#M56732 HI guys, I've read most of the reference material by Palo alto only applying security profiles on inside->out security polices but not outside->inside polices. I would think that is a given since outside->inside policies are to protect your front facing web services. Do you guys apply security profiles for outside->inside policies. Khai Sat, 04 Nov 2017 00:41:48 GMT https://live.paloaltonetworks.com/t5/general-topics/security-profile-group-best-practice/m-p/185451#M56732 Jurlique_NetworkAdmin 2017-11-04T00:41:48Z https://live.paloaltonetworks.com/t5/general-topics/security-profile-group-best-practice/m-p/185482#M56737 Yes, apply your secy=urity profiles to both. Inbound initiated traffic needs security profiles to protect you from exploits targeting a weakness in your front facing web services. Outbound initiated traffic needs security profiles to protect your browsers or other clients from weaknesses in those browsers or malware download. It also benefits from PanDB URL filtering. You may find in practice that you like different profiles for inbound initiated than outbound initiated traffic, e.g. URL filtering makes a lot more sense Outbound than Inbound. Many people may have more Outbound rules than Inbound rules, so you may want to consider using a Security Profile Group with name "default" for your Outbound traffic, which will then be applied automatically to all new security rules you recreate. Sat, 04 Nov 2017 15:49:37 GMT https://live.paloaltonetworks.com/t5/general-topics/security-profile-group-best-practice/m-p/185482#M56737 BenLassila 2017-11-04T15:49:37Z