Tutorial: Configuring Your Security Policy

View details at bit.ly/28JlJoc. Guidelines and best practices when building and reviewing your security policy. Let's take a closer look at zones, security profiles, and more. See more and learn more at live.paloalton...

[@RogueDire]

Great video, I really would've loved to see more of "configuring security policy" best practices in terms of overall rule positioning i.e. top rules vs more specific or block rules etc. best practice to get started with a well structured sec policy and also cover more on app dependencies in a sec rule etc. thanks!

[@sajjadanwer8908]

Well - explained Sir , Thanks for making this wonderful video .

[@PANgurus]

thanks! :D

[@HughJass-jv2lt]

13:00
Where that link to the *File Blocking* video you spoke of?
lol

[@PaloAltoNetworksLiveCommunity]

Here you go 😉: th-cam.com/video/RsIDpTFAKKA/w-d-xo.html

[@christianalinas]

Awesome!!!!

[@PaloAltoNetworksLiveCommunity]

Thank you!
Feel free to check out the LIVEcommunity page for more great info:
live.paloaltonetworks.com

[@delroyfletcher8089]

Is the 3rd WAN-connection rule allowing unsolicited inbound traffic from the internet?

[@vindaniell1111]

I also think this allows unsolicited inbound traffic. Granted, only for approved apps but still not good.

[@amerrasheed3986]

Great work

[@PaloAltoNetworksLiveCommunity]

Thanks for your comment! We're glad you found the video helpful!

[@rastafariaanh1252]

Based on the policy match Palo Alto design + the rules order from the video ( with first rule with deny) , wouldn't all the traffic from the zones and subnets mentioned in the rules be Blocked by default, thus making the below rules to have no hits?

[@PaloAltoNetworksLiveCommunity]

No, only the traffic that matches the applications configured in the blocked-apps-filter object will be denied by the first rule. Other traffic (read other applications) will not match this rule and will hit the below rules.

[@rastafariaanh1252]

@@PaloAltoNetworksLiveCommunity but why? On the 1st policy look up, the matching is done based on src zone dst zone src ip dst ip + services .

[@rastafariaanh1252]

@@PaloAltoNetworksLiveCommunity but why? On the 1st policy look up, the matching is done based on src zone dst zone src ip dst ip + services .

[@muhammadikbalharahap3621]

I want to limit bandwidth, how to configure on palo alto 220 ?

[@PaloAltoNetworksLiveCommunity]

There are many things you can do to limit bandwidth. One way is with QoS. Please check out this video for more info: th-cam.com/video/7fU91SZ5xDk/w-d-xo.html