Alto MS Series User Manual download pdf (Page 52)

48 Getting Started Guide

Set Up Basic Security Policies Create the Security Perimeter

Set Up Basic Security Policies

Policies allow you to enforce rules and take action. The different types of policy rules that you can create on the

firewall are: Security, NAT, Quality of Service (QoS), Policy Based Forwarding (PBF), Decryption, Application

Override, Captive Portal, Denial of Service, and Zone protection policies. Different policies work together to

allow, deny, prioritize, forward, encrypt, decrypt, make exceptions, authenticate access, and reset connections as

needed to help secure your network. The following topics describe basic security policies and the default security

profiles:

 Create Security Rules

 Test Your Security Policies

 Monitor the Traffic on Your Network

Create Security Rules

Security policies reference security zones and enable you to allow, restrict, and track traffic on your network.

Because each zone implies a level of trust, the implicit rule for passing traffic between two different zones is

deny, and the traffic within a zone is permitted. To allow traffic between two different zones, you must create a

security rule that allows traffic to flow between them.

While setting up the basic framework for securing the enterprise perimeter, it’s a good idea to start with a simple

security policy that allows traffic between the different zones without being too restrictive. As illustrated in the

following section, our objective is to minimize the likelihood of breaking applications that users on the network

need access to, while providing visibility into the applications and the potential threats for your network.

This section describes security policies only. For information on the other types of policies see

Protect Your Network Against Threats or refer to the following sections in PAN-OS Administrator’s

Guide: “Quality of Service” (for information on QoS policies) and “Map IP Addresses to User

Names Using Captive Portal” (for information on Captive Portal policies).

When defining policies make sure that you do not create a policy that denies all traffic from any

source zone to any destination zone as this will break intra-zone traffic that is implicitly allowed.

By default, intra-zone traffic is permitted because the source and destination zones are the same

and therefore share the same level of trust.

1 2 ... 47 48 49 50 51 52 53 54 55 56 57 ... 107 108

No comments

Alto MS Series User Manual Page 52