Security profile group best practice


Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.


Security profile group best practice

HI guys, I've read most of the reference material by Palo alto only applying security profiles on inside->out security polices but not outside->inside polices. I would think that is a given since outside->inside policies are to protect your front facing web services. Do you guys apply security profiles for outside->inside policies. Khai
L3 Networker

Yes, apply your secy=urity profiles to both. Inbound initiated traffic needs security profiles to protect you from exploits targeting a weakness in your front facing web services. Outbound initiated traffic needs security profiles to protect your browsers or other clients from weaknesses in those browsers or malware download. It also benefits from PanDB URL filtering. You may find in practice that you like different profiles for inbound initiated than outbound initiated traffic, e.g. URL filtering makes a lot more sense Outbound than Inbound. Many people may have more Outbound rules than Inbound rules, so you may want to consider using a Security Profile Group with name "default" for your Outbound traffic, which will then be applied automatically to all new security rules you recreate.
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!