Policy order

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Policy order

Not applicable

Is it important to have the Antivus, Vulnerability and Anti-Spyware rule as the first policy?

thanks

3 REPLIES 3

L4 Transporter

It was explained to me that each rule should have them. At least for how I was applying policies. You just want to make sure that each packet allowed through has policies that apply to your traffic at risk. If you have a rule that traffic matches on the top and you don't have any threat policies there then none will be applied because the traffic has already been permitted without. If I am incorrect in this understanding or was not clear enough please post further clarification.

From: jorge <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

Reply-To: live <live@paloaltonetworks.com<mailto:live@paloaltonetworks.com>>

To: Brad Spilde <brad.spilde@daktronics.com<mailto:brad.spilde@daktronics.com>>

Subject: Policy order

Is it important to have the Antivus, Vulnerability and Anti-Spyware rule as the first policy?

thanks

You're right. I've gone ahead and applied them to all the policies.

Thank You!

The security rules in PA devices is executed in top-down first-match order (similar to how acl's in cisco devices works).

Which gives that if you have a rule where you didnt enable antivirus etc and this rule is hit then the traffic hitting this rule wont be examined for viruses.

You can use the "test" command in cli to figure out which rule will be matched for which traffic.

A general recommendation is to use whitelisting instead of blacklisting (e.g. rules with which traffic you want to allow and then block as default) and when blacklisting is used make sure to make that as broad as possible while whitelisting should be as narrow as possible.

For example setting srczone:any is mostly a good thing for blacklists but often a bad thing for whitelists (security wise).

  • 2285 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!