Security profiles best practise

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Security profiles best practise

L0 Member

Palo Alto have the following Security profiles by default (pre-defined)

 

Antivirus - default 

Antivirus - default & strict

Vulnerability protection- default & strict

 

Would like to Palo alto recommendation on applying the different security profiles

If we are deploying a new Palo Alto firewalls in a new environment , would like to know if we can apply the default security profiles on all security policies belongs to Inbound and outbound firewalls without causing any business disruption.

 

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Hi @GKumar10 ,

 

You have asked 2 questions:

 

  1. Can you apply the security profiles to traffic without any business disruption?  In most cases, yes.  However, to verify no disruption you can apply the security profiles in alert mode and review the Threat/URL Filtering/Data Filtering logs for legitimate traffic that would be blocked.  You can then tune the profiles before changing the action to block.
  2. What is the PANW best practice recommendation for applying security profiles for a new NGFW?
    1. Run the Day 1 Configuration from the Customer Support Portal (CSP) and load it on your new NGFW.
    2. Run a Best Practice Assessment (BPA) on your NGFW from the CSP and apply those changes to the configuration.
    3. Here is a good doc for best practice security profiles -> https://docs.paloaltonetworks.com/best-practices/10-1/internet-gateway-best-practices/best-practice-....  These recommendations should be consistent with the BPA.

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

View solution in original post

1 REPLY 1

Cyber Elite
Cyber Elite

Hi @GKumar10 ,

 

You have asked 2 questions:

 

  1. Can you apply the security profiles to traffic without any business disruption?  In most cases, yes.  However, to verify no disruption you can apply the security profiles in alert mode and review the Threat/URL Filtering/Data Filtering logs for legitimate traffic that would be blocked.  You can then tune the profiles before changing the action to block.
  2. What is the PANW best practice recommendation for applying security profiles for a new NGFW?
    1. Run the Day 1 Configuration from the Customer Support Portal (CSP) and load it on your new NGFW.
    2. Run a Best Practice Assessment (BPA) on your NGFW from the CSP and apply those changes to the configuration.
    3. Here is a good doc for best practice security profiles -> https://docs.paloaltonetworks.com/best-practices/10-1/internet-gateway-best-practices/best-practice-....  These recommendations should be consistent with the BPA.

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.
  • 1 accepted solution
  • 1749 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!