Rules check by logs with expedition

[FWPalolearner]

Hello,

For one of our client , using PA 850 in cluster,

They have 8 zones for voip , printer , camera etc

And all the security policies are wide open.

Now we want to restrict the policy by looking at logs from each zone towars other.

Can we export logs from panorama to expedition to see or analyse it ? 

Or what is best approach to do reverse engineering and implement the specific rules between zones.

[Rene_Boehme]

Hi,

you can go with this filter so see respective logs.

Monitor > Logs > Traffic > ( zone.src eq SRC_ZONE) and ( zone.dst eq DST_ZONE )

You can export the output shown into an CSV file.

Based on this output normally a good approach, in my opinion, is:

- setup an application group with apps you want to allow (good apps)

- setup an application group with apps you do not want to allow (bad apps),

- set up a policy with "application" = application group good apps, set it do allow, enable logging at session end

- set up a policy with "application" = application group bad apps, set it to deny or drop (whatever suits your setup), enable logging at session end

- set up a policy with "application" = any, set it to allow, enable logging at session end

Continually monitor this rules and fine tune your policy. In Policies > Name column > hover over policy name > triangle icon > log viewer. Later on it might become more difficult because with a single "allow rule" you will be forced to decide for a service (any/select/app default). In case of you need different ports other than "app-default" you need to add a specific policy.

Hope that helps.

[FWPalolearner]

@Rene_Boehme  thanks .this is indeed a better approach.

I will see if expedition automates it 

[Rene_Boehme]

Good luck. Let us know if anything is missing.