Primsa Sase Web Security

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Primsa Sase Web Security

L4 Transporter

Hi all 

 

I am trying to understand the Prisma Access Cloud Managed Web Security policies. There are options to match on users or services. But how is traffic identified as "Web" if all settings are left to default. And will Web Security policy take precedence over Security Policy configured in the same folder? 

6 REPLIES 6

L4 Transporter

No one able to answer? 

L6 Presenter

To get an answer from someone inside Palo Alto better contact your sales manager. From what I can tell it is doing app identification as even If you have not created application override Palo Alto still does basic app identification, so auto matching web-browsing and ssl and app shift when decrypted to web-browsing does not seem complex.

 

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/about...

 

 

https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-...

 

 

nikoolayy1_0-1704745795042.png

 

L4 Transporter

@nikoolayy1 This is not related to the question. The query is about the Prisma Access Cloud based web policy

Prisma Access in the background uses Palo Alto Firewalls. I think that it is not the virtual edition but some form of container based but still the same code with the same functions and it does not matter if it is not managed by Panorama but in the cloud.

L6 Presenter

Also for SAAS App ID Prisma Access and the firewalls use App-ID Cloud Engine (ACE)  https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/cloud-based-app-id-service if you are interested in this.

L0 Member

I am using Prisma Access SASE and have wondered the same thing.  The best resource I have found is here: https://docs.paloaltonetworks.com/network-security/security-policy/administration/web-security/rule-...

 

Web Access Policies are applied before Security Policies.  I generally prefer security policies for their granularity, but sometimes it's hard to create a security policy that doesn't violate some "best practice", in which case I fall back on Web Access Policies.

 

  • 1890 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!