Policy rules organization

Support_IT — Thu, 23 Apr 2020 12:29:58 GMT

hello Everyone hope everything is doing well.

questions for the experts on palo

i have 260 rules on my palo alto environment and they are subdivided in zones and i would like to make things more organized on my rules .

question is the rules more high used on the palo should be always first ? like more verbose rules or it doesn't matter where they are they will be no performance issue ?

thank you

Matheus

Re: Policy rules organization

OtakarKlier — Thu, 23 Apr 2020 21:10:44 GMT

Hello,

Tricky question. If you are running code 9 or 9.1 then there is a counter for each policy so you can see which ones get hit more often. A few things to remember is that the PAN evaluates policies top to bottom left to right. So the order of the policies matter. What I do is put the stuff I know is a block, e.g. dynamic block lists, at the top so they dont sneak through. Then order the policies of highest use closer to the top without over riding a more specific policy.

Basically take your time and think it out. Do one or a few at a time so as not to cause confusion.

Hope that helps.

topic Re: Policy rules organization in General Topics

Policy rules organization

Re: Policy rules organization