Thinking of policy PAN-style (instead of Cisco-style)

Not applicable

Thinking of policy PAN-style (instead of Cisco-style)

Is there a document or recommended approach that has been written down that provides a starting point for people building a policy from scratch or when converting from a legacy firewall?  I'm referring to recommended approaches for building policy based on least privilege for apps instead of port and protocol. For example, let's say you place apps into 2 or 3 categories such as OK, maybe, and definitely not. Then as apps are identified flowing through they can be placed into the OK category if they are needed by the business. Someone in the past must have grouped the top 10 or 15 legitimate biz apps together into a chunk then implemented as a policy line.

Essentially I'm looking for a doc that is entitled something like, "Building policy PAN style when you're used to Cisco ASA (or Juniper or checkpoint)."


Not applicable

Re: Thinking of policy PAN-style (instead of Cisco-style)

I would *really* like more discussion on this. For me it seems apples-to-oranges when comparing/migrating from anything to PAN.

L4 Transporter

Re: Thinking of policy PAN-style (instead of Cisco-style)

We started out building port policies. Then after traffic was generated, we converted them to app rule.

L3 Networker

Re: Thinking of policy PAN-style (instead of Cisco-style)

+1 on that!

L0 Member

Re: Thinking of policy PAN-style (instead of Cisco-style)

I love gmoerschel's  approach.  I am a large non-profit in a major arena (extremely high profile)...we too have Cisco ASA's as our perimeter GW's.  We have had PAN in our midst for a year and one half.  We have had some majore learning issues, but our initial policies were based on app (Category) criteria.  Out of the shut came gaming...cut it.  Second was  (sub category) type - which was file-sharing...cut it (we can make one off decisions about each case later). Third went the "technology" group...equating to peer-to-peer.  I really did not want to see any of the p2p that had been working long before PAN to continue.  The next day after implementing, HR tickets rose through the roof.  I told HR prior...just route then to me directly.  With policy "acceptable use" in hand...I took them on one by by one.  No one to date, has come up with a viable defense against said policy.  Policy enception date was July 1994.

Can I take my ASA rule set and convert them? IF I know what it is (back end programs) that is attempting to be converted?  I have yet to find ONE Cisco SE who can weight in on this matter.  How come Cisco has not acquired this company and made it a part of their security division?  Layer 7 for most of us is a hindrance.  Where are we to go to?  Above the nexxus 7K(Cicso propietary) this is by far the best technology leap i've seen over the last 10 years.  Join in and see why PAN can revolutionize your perimeter network. I am not a paid spokesman.  Their technology is by far the best thing I've seen since heirachy.  Don't believe me?  I've been in this industry for over 16 years.  I love my Cisco firewalls...they are unhampered.  However, when it comes to IDS....even with AIP modules for the ASA, at best it's cludgy.  PAN however, looks into the packet much like NetGen does.  It gives you insight into what comes and goes, even if it's encrypted. 

Encrypted did he say?  YES.  They have the ability to decrypt on the fly.  AWESOME!!!!  Can I say anymore?   One thing that you will note...learning your perimeter takes time...wiht this device (no matter how small or large you will take time to "learn" your environment.

Not applicable

Re: Thinking of policy PAN-style (instead of Cisco-style)

My first step in a mid-sized conversion from another firewall (PIX/ASA/Sonicwall) is to put the new PA's in monitor mode on both the inside and outside interfaces for 2-3 days.  Then, I evaluate the inbound flows by filtering for each previosly allowed inbound port to see what applications are running over them.  I'll add a rule for each, so that 95% of inbound connectivity should work right away.  I'll also find the 20-30 most common outbound applications and add them as well to the base configuration.  This way, when you first turn on the PA, you have a very good baseline for what should be running.  As far as typical categories for outbound connectivity, I do the following:

Create base Application Filters:



Peer2Peer (encrypted-tunnel, file-sharing) for peer-to-peer





Application Groups:


  • web-browsing
  • ssl
  • ftp
  • ping
  • ntp
  • dns
  • flash

MS-Networking (for inter-zone traffic as needed later)

  • netbios-dg
  • netbios-ss
  • ms-ds-smb


  • google-analytics
  • google-calendar
  • google-docs
  • google-toolbar
  • google-translate

Base Policies would be

Allow-SMTP-Outbound (mail server only)

Deny-SMTP-All (everyone else SMTP on any port)

Deny-KnownBad (Proxies, Peer2Peer)

Deny-HighBandwidth (Audio-Streaming,Video-Streaming)

Deny-BusinessInappropriate (Games, SocialNetworking)

Allow-Unrestricted (flexnet-installanywhere, soap, ocsp, Updates)

Allow-ByUserGroup (sharepoint-base, silverlight, office-live, linkedin-base, citrix, gotomeeting, facebook-base, gmail-base, gmail-enterprise, citrix-jedi, yahoo-toolbar, netsuite, KnownGood, GoogleApps)

Allow-All (but just temporarily)

Cleanup-Rule to deny all others and log

This covers most of the business needs, and you modify from there.  I even built a base template with everything above (and a lot more), and use that when deploying new customer firewalls.

Not applicable

Re: Thinking of policy PAN-style (instead of Cisco-style)

Very nice. I like the structure. Care to share that base template?  Thanks

L3 Networker

Re: Thinking of policy PAN-style (instead of Cisco-style)

Would be very helpful.


L0 Member

Re: Thinking of policy PAN-style (instead of Cisco-style)

Grant: Did you find anything?  Can you share?  I'm a new user having the same issue with building a policy from scratch.



Not applicable

Re: Thinking of policy PAN-style (instead of Cisco-style)

If you check out jblum.2's answer higher in the thread, that is the way I do it.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!