Security Policy

Palo Alto Networks Training

Security Policy Fundamentals

Brief Overview

This guide explores the essential role of Security Policies within PAN-OS.
It explains how policies act as conditional statements to allow or deny traffic, the different rule types available, best practices for rule ordering, and the professional workflow for managing policy changes in a production environment.

---

Beginner Notes (Simple Explanations)

At its core, a Security Policy is a set of conditions created by a firewall administrator.
You can think of it as a gatekeeper that inspects every piece of traffic attempting to pass through the firewall.

How It Works

• The administrator defines specific criteria such as:
  • Where the traffic is coming from
  • Where the traffic is going
• If traffic matches the conditions, the firewall follows the instruction to:
  • Allow the traffic
  • Deny the traffic

Basic Criteria

• Source Zone
• Destination Zone

These are typically the first checks performed by the firewall.

Layers of Inspection

The firewall makes decisions using multiple network layers:

• Layer 3 (Network Layer): IP addresses
• Layer 4 (Transport Layer): Port numbers

---

Intermediate Notes (How It Works, Configurations, Best Practices)

As environments grow, PAN-OS provides more granular control and multiple rule types to manage traffic efficiently.

Types of Security Rules

1. Intrazone
   • Traffic moving within the same zone
   • Example: Zone A → Zone A
2. Interzone
   • Traffic moving between different zones
   • Example: Zone A → Zone B
3. Universal
   • Applies to both intrazone and interzone traffic
   • Useful for flexible or global rules

---

Granular Control Parameters

Beyond zones and IP addresses, security can be enhanced using:

• Application-ID
  • Identifies traffic based on the actual application (Layer 7)
  • Not just port-based inspection
• User-ID (Source User)
  • Creates rules based on usernames instead of IP addresses
  • Policies follow users no matter where they connect from
• Additional Parameters
  • URL Categories
  • HIP Profiles
  • Specific service ports

---

Policy Optimization

In production environments, firewalls may contain hundreds or thousands of rules.

Hit Counts

• Tracks how many times a rule is matched
• A hit count of zero may indicate:
  • The rule is unnecessary
  • The rule is incorrectly configured

Policy Optimizer

• Located under the Policies tab in PAN-OS
• Identifies unused rules over:
  • 30 days
  • 90 days
  • Custom time ranges
• Essential for:
  • Reducing clutter
  • Passing security audits
  • Maintaining compliance

---

Advanced Notes (Design, Troubleshooting, Security Insights)

In complex enterprise networks, rule order and verification methods are critical for stability and security.

---

Rule Processing Logic

Palo Alto Networks firewalls process security policies top-to-bottom.

Design Strategy

• Place specific rules at the top
  • Example: Single host IP
• Place broader rules at the bottom
  • Example: Entire subnet or any-any rules

The Risk

• If a broad rule is placed above a specific rule:
  • The firewall matches the broad rule first
  • The specific rule is never evaluated

---

Professional Production Workflow

When implementing a new security policy, follow this structured approach:

1. Test Policy Match
   • Use the Test Policy Match tool
   • Found at the bottom of the Security tab
   • Input:
     • Source IP
     • Destination IP
     • Port
   • Confirms whether an existing rule already allows or blocks the traffic
2. Route Verification
   • Check the routing table
   • Identify which interfaces are used
   • Determine the correct:
     • Source Zone
     • Destination Zone
3. Implementation
   • Create the new policy only after verification
   • Apply advanced controls if required:
     • Application-ID
     • User-ID

---

Key Terms

• Security Policy
  A condition-based rule that permits or blocks network traffic

• Hit Count
  A metric showing how many times traffic has matched a specific rule

• Intrazone / Interzone
  Describes whether traffic stays within one zone or crosses into another

• Policy Optimizer
  A PAN-OS tool used to identify and remove unused or redundant rules

• Test Policy Match
  A troubleshooting tool used to determine which rule applies to specific traffic

---

Quick Revision Summary

• Policies are conditional rules that allow or deny traffic
• Rule order matters because processing is top-to-bottom
• Three rule types:
  • Intrazone (same zone)
  • Interzone (different zones)
  • Universal (both)
• Optimization is essential:
  • Use Hit Counts
  • Use Policy Optimizer
• Always verify before adding rules:
  • Check routing tables
  • Use Test Policy Match

---

🙌 Connect With Me