06-08-2023 06:40 AM
Hi,
This is a new Palo Alto deployment. We used to have Cisco FTD as IPS and now we are replacing with Palo Alto. We have 3 devices (router and SDWAN) that we configured using vwire so all traffic to the DC would pass through the Palo Alto inspection as IPS.
I would like to deploy the security profiles/group (vulnerability/antivirus/spyware) as monitor mode only, so I can see what traffic would have been blocked by PA and then correct all the false positives. In Cisco FMC we have the option of the policy rule action as monitor to achieve this. I cannot find something similar in Palo Alto. Please can someone help with how to set the security policy to monitor only (not take the drop or reset-action) but I want to know the traffic that it would have dropped.
06-08-2023 08:27 AM
Hello,
The simple answer is use an 'allow' policy. Deploying the firewall there are two options:
Here is a guide for Best Practice to deployment:
What I did since it was a Cisco appliance I was migrating from, was to create the policies as layer 3/4 as with the standard Cisco ASA would. Then once deployed, I would create stricter policies with applications instead of 'services'(ports). I then created my own day one policy that had a lot of the config already built in both best practices and DISA STIG's etc. Its not fully complete due to differences in network and designed etc. but its a great start if your truly brave. The config does not allow for much to pass so treat it as DENY ALL allow by Exception, so you have to put in the allow policies.
Cheers!
06-08-2023 02:17 PM
To explicitly answer your profile questions, you'd want to create new profiles and ensure that you have all actions set to alert. The one thing that I'll mention here is that some of the profiles you'll have to think a little bit about when you actually enforce them. For example, if you setup an Anti-Spyware profile and have all severities set to alert that doesn't show you everything that the firewall would actually take an action on if you set the action back to default.
That will at least get you to the point where you're gathering as much data as possible so you have it when changing the action and actually enforcing standards however.
06-08-2023 08:27 AM
Hello,
The simple answer is use an 'allow' policy. Deploying the firewall there are two options:
Here is a guide for Best Practice to deployment:
What I did since it was a Cisco appliance I was migrating from, was to create the policies as layer 3/4 as with the standard Cisco ASA would. Then once deployed, I would create stricter policies with applications instead of 'services'(ports). I then created my own day one policy that had a lot of the config already built in both best practices and DISA STIG's etc. Its not fully complete due to differences in network and designed etc. but its a great start if your truly brave. The config does not allow for much to pass so treat it as DENY ALL allow by Exception, so you have to put in the allow policies.
Cheers!
06-08-2023 02:17 PM
To explicitly answer your profile questions, you'd want to create new profiles and ensure that you have all actions set to alert. The one thing that I'll mention here is that some of the profiles you'll have to think a little bit about when you actually enforce them. For example, if you setup an Anti-Spyware profile and have all severities set to alert that doesn't show you everything that the firewall would actually take an action on if you set the action back to default.
That will at least get you to the point where you're gathering as much data as possible so you have it when changing the action and actually enforcing standards however.
06-12-2023 05:40 PM
Thank you OtakarKlier and BPry for the replies.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
