Policy order

[jorge]

Is it important to have the Antivus, Vulnerability and Anti-Spyware rule as the first policy?

thanks

[bspilde]

It was explained to me that each rule should have them. At least for how I was applying policies. You just want to make sure that each packet allowed through has policies that apply to your traffic at risk. If you have a rule that traffic matches on the top and you don't have any threat policies there then none will be applied because the traffic has already been permitted without. If I am incorrect in this understanding or was not clear enough please post further clarification.

From: jorge <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

Reply-To: live <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

To: Brad Spilde <brad.spilde@daktronics.com<mailto:brad.spilde@daktronics.com>>

Subject: Policy order

Is it important to have the Antivus, Vulnerability and Anti-Spyware rule as the first policy?

thanks

[jorge]

You're right. I've gone ahead and applied them to all the policies.

Thank You!

[mikand]

The security rules in PA devices is executed in top-down first-match order (similar to how acl's in cisco devices works).

Which gives that if you have a rule where you didnt enable antivirus etc and this rule is hit then the traffic hitting this rule wont be examined for viruses.

You can use the "test" command in cli to figure out which rule will be matched for which traffic.

A general recommendation is to use whitelisting instead of blacklisting (e.g. rules with which traffic you want to allow and then block as default) and when blacklisting is used make sure to make that as broad as possible while whitelisting should be as narrow as possible.

For example setting srczone:any is mostly a good thing for blacklists but often a bad thing for whitelists (security wise).