Primsa Sase Web Security

[batd2]

Hi all 

I am trying to understand the Prisma Access Cloud Managed Web Security policies. There are options to match on users or services. But how is traffic identified as "Web" if all settings are left to default. And will Web Security policy take precedence over Security Policy configured in the same folder? 

[batd2]

No one able to answer? 

[nikoolayy1]

To get an answer from someone inside Palo Alto better contact your sales manager. From what I can tell it is doing app identification as even If you have not created application override Palo Alto still does basic app identification, so auto matching web-browsing and ssl and app shift when decrypted to web-browsing does not seem complex.

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/about...

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-...

[batd2]

@nikoolayy1 This is not related to the question. The query is about the Prisma Access Cloud based web policy

[nikoolayy1]

Prisma Access in the background uses Palo Alto Firewalls. I think that it is not the virtual edition but some form of container based but still the same code with the same functions and it does not matter if it is not managed by Panorama but in the cloud.

[nikoolayy1]

Also for SAAS App ID Prisma Access and the firewalls use App-ID Cloud Engine (ACE)  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/cloud-based-app-id-service if you are interested in this.

[KeithPartin]

I am using Prisma Access SASE and have wondered the same thing.  The best resource I have found is here: https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-...

Web Access Policies are applied before Security Policies.  I generally prefer security policies for their granularity, but sometimes it's hard to create a security policy that doesn't violate some "best practice", in which case I fall back on Web Access Policies.