PA is Default Deny

[choff123]

Stupid question. Just need confirmation.

PA (42020) devices are default deny correct?

If a packet is not specifically allowed or denied by a rule; when it gets to the bottom of the rules the default action is to deny, correct?

thanks

--CH

[mikand · Accepted solution]

Yes its denied but not logged.

In order to get denied packets logged you need to manually put a security policy in the end that says:

srczone: any

dstzone: any

srcip: any

dstip: any

user: any

appid: any

service: any

options: log on session end

action: deny

[mikand · Accepted solution]

Yes its denied but not logged.

In order to get denied packets logged you need to manually put a security policy in the end that says:

srczone: any

dstzone: any

srcip: any

dstip: any

user: any

appid: any

service: any

options: log on session end

action: deny

[Anon1]

Hi,

just be careful with such an "deny all" rule since it will break intrazone traffic (traffic ingress and egress the same zone, this also includes e.g. ping to a data interface when enabled).

You can temporarily enable logging of the default deny rule on the CLI: set system setting logging default-policy-logging

[Jermaine_Scott]

With an intrazone rule created before it, is there a good reason (security purposes ot other) not to have the Deny All rule in place at the end? Or is it more of personal preference?

[LukeBullimore]

Creating a Deny-All rule is bad practice, don't do it. If there is intrazone traffic (Trust to Trust for example) that has not been allowed by a previous rule, this will be denied because your Deny-All rule will be matching before the Intrazone-default rule.

You don't need to make a deny-all rule to see denied traffic, you can actually click the click the default intra/interzone-default rules, click "Override" next to the Clone button at the bottom to edit them, then you can enable the "Log at session end" options under the Action tab.