pa3220 POS 9.1.5

[PA200-1]

howdy,

The short question is a block country rule on 1/8 the thing to do?

or  a white list of ip? and apps?

Thank you

Mike

[OtakarKlier]

Hello,

The answer is it depends. If you ask me, I have whitelist policies to allow inbound traffic. It would depend on what you have exposed, e.g. inbound traffic. If you have nothing, I say block it all unless it needs to connect for something, i.e. VPN, web server, etc. What I would start with are 'Negate' ( negate = not equal to ) policies. Say block everything except the US, but you only have to put the US and then Negate so you dont have to list everything.

Hope that helps.