Security Policy Best Practice

[GCSS-RT]

Hello all,

I've read multiple documents from PA and read some on the forums here, but cannot find anything definitive on this.

What I'm trying to find out is what is the best practice/most effective way to configure a Security Policy for filtering. I understand there are several ways to do this, but I've found that the way I've been doing it doesn't always seem to work the best. Are there any issues with the following config?

Create a Security Policy and set the Action to Allow. Set a URL Filtering Profile. Create a Custom URL Category for Allowed URLs. Create a Custom URL Category for Denied URLs. Apply these Custom URL Categories inside the URL Filtering Profile. Set other categories to Deny within the URL Filtering Profile.

If I were to set the Action for a Security Policy to Deny, does that Deny all traffic that matches?

Any advice will be very helpful. Thanks.

[reaper · Accepted solution]

The action of the security policy works at the network layer, so it interrupts a flow of packets, whereas a security profile interacts with layer7, so a url blocking profile will throw up a blocked page instead of the actual webpage, from the network layer perspective the traffic will act normally

A 'block' security policy will never use security profiles as the packets are blocked before that rule would engage security profiles

Your rule needs to be allow, and with your profiles set, only the allowed custom category urls will be allowed and all others will create block pages for the users

There is an in-between solution, where you apply a custom URL category in the 'services' of the security policy

This works as a sort of ip-lookup and only allow/deny traffic  for the "ips" that match the urls in your custom category

[MP18]

Thanks for great explanation.