Best practise For TAP Mode

[hamza_ineos]

Hello Brothers,

Plz i want make a POC with one of our clients, but i need to know what's th best practise for putting the PaloAlto in TAP mode !!

i mean:

1-what's the rule policy that i must create ?? must enable all security profile ?

2-must make dycryption rule ?

3-Wich elements i must focus on for the best practise and give the best report to the client ??

Plz help

NB:(technicaly i can deploy PA on TAP mode with no problem)

Thanks

[reaper · Accepted solution]

Hi @hamza_ineos

1. you will want to set a policy from tap to tap, allow

This will ensure you allow all the packets to be received and APP-ID and scanning to take place on all the received sessions (if you select drop you will only see discarded packets with no further context)

2. decryption will only work for inbound connections since you are not able to insert te firewall into the stream (for inbound connections you can import the server certificate and will know the private key)

3. make sure you have all the security profiles enabled (best is to create all new profiles that mimic strict enforcement), and set all the desirable URL categories to 'alert' (as allow does not log). If you have a WildFire License fdon't forget to enable WildFire profiles in the AntiVirus profile

[hamza_ineos]

thanks for very much brother

ok also i need to know plz, after this POC, what's the very important things that i must looking at and talking about it with client in report side for exemple ??

[reaper]

Hi @hamza_ineos

do you know how to run the Security Lifecycle Review? https://riskreport.paloaltonetworks.com/SLR 

This will outline the most notable information found in your logs

You may want to reach out to your local sales team for assistance how to 'bring' this information to your customer most efficiently

[hamza_ineos]

ok thanks very much brother 🙂