Who rated this post

Hello,

On some devices, I started with something like the following:

Source Zone: trust, Source User: AD group that has access, Destination, Zone and IP address of scada/device, enable threat prevention and disable url filtering.

With this I can limit the traffic to those who have access and then watch and see what applications if any are being discovered, then tune from there.

The other thing I have seen is that some PAN models is that the amount of zones is limited. So I created a zone called something like IOT, and then set policies of source and destination IP's/subnets. Since I have a DENY ALL policy as my last rule, the intra zone traffic is blocked. 

Hope that helps a bit.