Palo Alto: Security Policies

This article is to provide advanced advice on security policies with best practices for administrator level users for Palo Alto Firewalls and virtual systems. Palo Alto Firewall rules are processed to make a match reading through the individual rules from left to right. This article will address the features of the firewall rules in this order.

For some areas on campus, the firewalls contain rules which were migrated from a non-Palo Alto firewall. The technique used during the migration implemented a naming scheme seen below (these rule names are editable by the fw-admin):

"Vlan-####-Rule-##"


Policy-Example

During the firewall migration the engineers implemented a naming schema for tags to provide clarity. The naming scheme begins with the traffic direction, followed by the departmental code, then the VLAN number, then the name of the physical firewall where the rule resides. Examples are:

"IN-UNITSHORTCODE-VLAN-FIREWALLNAME"

In-Tag-Example

"OUT-UNITSHORTCODE-VLAN-FIREWALLNAME"

Out-tag-example

By default, all manually created rules are created with the type Universal. The rule "type" can change from Universal to inter/intra-zone to limit unwanted access. 

  • Intrazone rule type manages the traffic within a zone.
  • Interzone rule type manages the traffic between zones.
  • Universal rule type includes both Intra and inter-zone traffic.

When applying Security Zones, it is best practice from Palo Alto to avoid "Any" in the source or destination zone fields. This opens the possibility for the "any-any" rule to unintentionally allow sessions that are not accounted for or unintended. Rather, use specific zones for the desired source or destination.

When the firewall processes a packet it takes the packet and attempts to match it to a rule to allow the packet to flow through the firewall.

  • The first check happens outside the Network security policies, under the DoS (Denial of Service) and Zone protection policies, to protect against: network floods, Denial of Service attacks and host scanning.
    • By nature, these attacks act on networks before the delivery stage of the cyber-attack lifecycle.
  • The firewall then checks any packets that passes these checks against the security policies first matching the destination address.
  • The security policies are processed from the top down and then read from left to right to find a rule match.
    • Caution: This top-down logic allows for rules to be "shadowed", which occurs when a more general rule is placed above a rule with a more specific source, destination or service object.
  • Once it has reached a match for the request, the firewall stops and acts on the packet according to the action specified by the rule and logs the event based on the logging profile setting.
  • During the request the application-id, as recognized on the network, can change when more information is communicated between hosts during TCP life cycle; which can cause the connection to shift to a different rule in the security policy.

The concept of the Application ID feature is the Next Generation feature which the Palo Alto firewalls provide, to verify access requests match the official use-case.

  • Palo Alto has generated Application Identifications based on network hash information, matching traffic specific to the application used.
  • Application IDs are stored online in their website here.
  • Review this KB article on Application-ID specifics for more information.

Palo Alto by default has columns hidden, these can be shown by hovering over a column header to display sub-menus.

 Security_Policies_HiddenColumns

Rule Usage

With PAN OS version 8.1 the Rule Usage hit-counters were provided for each rule. As seen in the above image the rule usage is broken down into Hit Count, Last Hit and First Hit.

This translates into:

      • Hit Count: Number of times the rule has been hit since the last hit-counter reset
        Reset-Rule-HitCounter
      • Last Hit: The time-stamp for the latest packet to match the rule
      • First Hit: The time-stamp for the first time the rule was hit

 

For more UW Madison Knowledge Base articles, see: https://kb.wisc.edu/search.php?q=palo+alto

For assistance please contact: cybersecurity@cio.wisc.edu