Methods for creating security policies

[MemphisBrothers]

When creating security policies would it be better to create a separate policy for inbound and outbound traffic, trusted and untrusted, per user group or one policy to manage both ways to minimize number of policies

[tasonibare]

Hello MemphisBrothers,

Most deployments choose to have separate rules for inbound and outbound traffic in order to properly log the security rule permitting the respective traffic.

By doing this, you could also be more granular and selective in the traffic permitted in or out of your network.

If you only need to permit the same type of traffic in and out, and don't care too much about individual control on either of the directions, then you can create one policy for both directions to minimize number of policies.

Regards,

tasonibare

[Gregoux]

Hello guys

a good way is:

you don't have to create on both direction the rule.

you need to create only a rule to allow the traffic base on the initiation side of this traffic, on which you could activate log at start or at end session, we prefere  at end session to minimise logs.

and If you want to have a log for all drop packet, create at the bottom of rule list a deny all rule base on any zone src, any zone dst, and any app with a deny action and log at start session.

[MemphisBrothers]

That's how we are doing it.  I do like more granular management to troubleshoot the apps attached to multimedia sites better. 

[Gregoux]

Ok in this case you just have to follow the deny action in the log traffic, that could show you what application is reconized by palo even multimedia apps or website multimedia if you have the url categorization enabled.

and create rule base on application or url categorie  or service to allow that you want to allow.

regard's