Security profiles best practise

[GKumar10]

Palo Alto have the following Security profiles by default (pre-defined)

Antivirus - default 

Antivirus - default & strict

Vulnerability protection- default & strict

Would like to Palo alto recommendation on applying the different security profiles

If we are deploying a new Palo Alto firewalls in a new environment , would like to know if we can apply the default security profiles on all security policies belongs to Inbound and outbound firewalls without causing any business disruption.

[TomYoung · Accepted solution]

Hi @GKumar10 ,

You have asked 2 questions:

1. Can you apply the security profiles to traffic without any business disruption?  In most cases, yes.  However, to verify no disruption you can apply the security profiles in alert mode and review the Threat/URL Filtering/Data Filtering logs for legitimate traffic that would be blocked.  You can then tune the profiles before changing the action to block.
2. What is the PANW best practice recommendation for applying security profiles for a new NGFW?
   1. Run the Day 1 Configuration from the Customer Support Portal (CSP) and load it on your new NGFW.
   2. Run a Best Practice Assessment (BPA) on your NGFW from the CSP and apply those changes to the configuration.
   3. Here is a good doc for best practice security profiles -> https://docs.paloaltonetworks.com/best-practices/10-1/internet-gateway-best-practices/best-practice-....  These recommendations should be consistent with the BPA.

Thanks,

Tom