Restrict Any Any from Security Policy

[nicford]

Hi There,

At one of our sites we fell vicitim and have the dreaded any any security policy in place. We are trying to determine the best course of action to lock it down.

Would I create tap firewall ports and span all the traffic, then create new rules based on it in tap zones? 

Any guides out them to assist for this specific situation?

[Raido_Rattameister]

Check Monitor tab or run reports to see what applications pass this firewall.

Create rule to permit those applications you want.

You can also create second rule for known bad above any any.

Eventually nothing should hit any any rule and you can remove it.

[nicford]

this article looks promising: https://popravak.wordpress.com/2014/08/27/palo-alto-ngfw-use-case-one-monitoring-traffic-tap-mode/

It's unfortunate now i cant identify zones too easily. But I can make intelligent guesses based on source/dest ips.

[Raido_Rattameister]

Can you explain if Palo is in place and inline already as firewall or you have some legacy firewall and you want to put Palo into tap mode to listen what is going on?

[BPry]

Such as @Raido_Rattameister said you need to slowly start chipping away at the rule by monitoring what's actually hitting the any any rule. Eventually it will get to the point where you can delete it and use it as a learning experiance of "this is why you don't do it like this, it took me weeks to fix it". Have fun! 

edit: You do realize that if you put it in tap mode you can't act on the traffic right?