Basic Policy Overview Palo Alto

Policy Policy-based Controls Enable Appropriate Application Usage The increased visibility into network activity generated by App-ID, User-ID and Content-ID can help simplify the task of determining which applications are traversing the network, who is using them, the potential security risk and then easily determine the appropriate response. Armed with these data points, administrators can apply policies with a range of responses that are more fine-grained than allow or deny.

Policy control responses include: • Allow or Deny • Allow but scan • Allow based on schedule • Decrypt and inspect • Apply traffic shaping • Any combination • Allow certain application functions • Allow for certain users or groups

Policy Editor: • Assign Saleforce.com and Oracle to the sales and marketing groups by leveraging Active Directory integration. • Enable only the IT group to use a fixed set of management applications such as SSH, telnet and RDP. • Block bad applications such as P2P file sharing, circumventors and external proxies. • Define and enforce a corporate policy that allows and inspects specific webmail and instant messaging usage. • Control the file transfer functionality within an individual application, allowing application use yet preventing file transfer. Using a policy editor that carries a familiar look and feel, experienced firewall administrators can quickly create flexible firewall policies such as

Policy Editor: • Identify the transfer of sensitive information such as credit card numbers or social security numbers, either in text or file format. • Deploy multi-level URL filtering policies that block access to obvious non-work related sites, monitor questionable sites and “coach” access to others. • Implement QoS policies to allow media and other bandwidth intensive applications but limit their impact on business critical applications.

GUI Policy Editor:

Network Tab: Network tab -> Zones Create one or more zones of type “tap”, and assign appropriate names. If you plan to implement user-ID, check the box to “enable user-identification”.

Network Tab: Network tab-> Interfaces Configure one or more interfaces to be of type “tap”, and assign those interfaces to the tap zones you just created

Network Tab:

Application Command Center (ACC): A standard feature that requires no configuration effort, ACC graphically displays a wealth of information on current network activity including applications, URL categories, threats, and data. If a new application appears in ACC, a single click displays a description of the application, its key features, its behavioral characteristics, who is using it, and what security rules allowed it to be used. Additional filters can be added to learn more about application use for individual users along with the threats detected within the application traffic. In the span of just a few minutes. ACC provides administrators with the data they need to make more informed security policy decisions

ACC Functions: What are the top applications used on the network and how many are high-risk applications? Who are the top users of high-risk applications on the network What are the top URL categories being viewed in the last hour? What are the top bandwidth-using applications? Who are the users/hosts that consume the highest bandwidth?

ACC Functions: What content or files are being blocked and are there specific users who trigger this file blocking/data filtering policy?  What is the amount of traffic exchanged between two specific IP addresses or generated by a specific user? Where is the destination server or client located geographically?

ACC Tab

Resources https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/IntegrationArticles/29/1/PaloAltoNetworks-Designs-Guide-RevB.pdf