Configuring Palo Firewall into an IDS

[SuhaimiMohd]

Typically the ATP license would be used if we want to have the IPS features on the PA firewall. However, how do we configure the firewall if its meant to function as an IDS?

[emr_1 · Accepted solution]

IDS means you just need to detect and then pass through them. (don't have to block/protect)

To do so, you just need to select "alert" action.

Please refer to following doc for the detail of each action.
https://docs.paloaltonetworks.com/network-security/security-policy/administration/security-profiles/...

[SuhaimiMohd]

Thanks for the quick response. So in this case, we still need the ATP, AURL license the least as it still pertains to Security Profiles except that the policies action will all be set to "alert"?

[emr_1]

Yes, you need subscriptions/licenses to detect (and also to block)