Alto MS Series User Manual download pdf (Page 38)

34 Getting Started Guide

Security Perimeter Overview Create the Security Perimeter

About Network Address Translation (NAT)

When you use private IP addresses within your internal networks, you must use network address translation

(NAT) in order to translate the private addresses to public addresses that can be routed on external networks.

In PAN-OS, you create NAT policy rules that instruct the firewall which packets need translation and how to

do the translation. The firewall supports both source address and/or port translation and destination address

and/or port translation. For more details about the different types of NAT rules, refer to the

Understanding and

Configuring NAT Tech Note

It is important to understand the way the firewall applies the NAT and security policies in order to determine

what policies you need based on the zones you have defined. Upon ingress, the firewall inspects a packet to see

if it matches any of the NAT rules that have been defined, based on source and/or destination zone. It then

evaluates and applies any security rules that match the packet based on the original (pre-NAT) source and

destination addresses. Finally, it translates the source and/or destination port numbers for any matching NAT

rules upon egress. This distinction is important, because it means that the firewall determines what zone a packet

is destined for based on the address on the packet, not in the placement of the device based on its internally

assigned address.

About Security Policies

Security policies protect network assets from threats and disruptions and aid in optimally allocating network

resources for enhancing productivity and efficiency in business processes. On the Palo Alto Networks firewall,

security policies determine whether to block or allow a session based on traffic attributes such as the source and

destination security zone, the source and destination IP address, the application, user, and the service. By

default, intra-zone traffic (that is traffic within the same zone, for example from trust to trust), is allowed. Traffic

between different zones (or inter-zone traffic) is blocked until you create a security policy to allow the traffic.

Security policies are evaluated left to right and from top to bottom. A packet is matched against the first rule

that meets the defined criteria; after a match is triggered the subsequent rules are not evaluated. Therefore, the

more specific rules must precede more generic ones in order to enforce the best match criteria. Traffic that

matches a rule generates a log entry at the end of the session in the traffic log, if logging is enabled for that rule.

The logging options are configurable for each rule, and can for example be configured to log at the start of a

session instead of, or in addition to, logging at the end of a session.

Components of a Security Policy

The security policy construct permits a combination of the required and optional components listed below.

1 2 ... 33 34 35 36 37 38 39 40 41 42 43 ... 107 108

No comments

Alto MS Series User Manual Page 38