Optimize Your Policies with PAN-OS 9.0 (Episode 17) Learning Happy Hour

(Now in 1080p) If you have ever second guessed yourself before removing an App-ID from a rule or if you have caused an outage by removing a policy rule prematurely then this episode is for you!
Jason & Mitch explore the new PAN-OS 9.0 Policy Optimizer which might seem, on the surface, like a simple tool for telling you which rules see more or less traffic but it is much more than that!
The Policy Optimizer will help you save time and furstration in your efforts to achieve greater network security!
If you have over provisioned rules without App-IDs (a.k.a just service/port definitions) or rules with too many App-IDs allowed, the Policy Optimizer can help!
If you have unused rules that are no longer needed for currently sanctioned traffic, the Policy Optimizer can help!
If you have firewalls running PAN-OS 8.1 and older but you have Panorama and are willing to upgrade Panorama to 9.0, You CAN use the Policy Optimizer!
We hope you find this demo-heavy episode of Learning Happy Hour entertaining and helpful!
Episode Feedback: [e-mail]
Episode Timeline:
0:00 - Introduction
1:05 - Opening Discussion
2:24 - How to reduce your attack surface by eliminating port-based rules
4:39 - Port-based rule analogy
5:54 - Whats the harm with TCP 80/443?
8:45 - Typical post-migration scenario
10:00 - Jason is a HUGE FAN of the BPA!
10:34 - Port-based rule optimization demo
19:10 - Decryption changes regarding service "application-default"
22:38 - New procedural options for updating App-ID as a result of the Policy Optimizer
29:20 - Unused Applications optimized with the Add to Rule and Match Usage functions
31:19 - Policy Optimizer in Panorama 9.0
33:40 - Safely identifying and removing unused policy rules
36:28 - Getting the rest of the organization to understand and support your change proposals
38:36 - Additional tools for firewall administration and configuration improvement
39:28 - What we learned
41:28 - Encore of cheerleader Jason
Episode Resources:
• PAN-OS New Features Guide: docs.paloalton...
• Learning Happy Hour: • Learning Happy Hour
• Expedition: live.paloalton...
• AutoFocus: www.paloaltone...
• Security Lifecycle Review: www.paloaltone...
• Best Practice Assessment FAQ: live.paloalton...
• Palo Alto Networks Education Page: www.paloaltone...
• Prevention Architecture Page: www.paloaltone...
• Request a Best Practice Assessment: start.paloalto...
• Run your own Best Practice Assessment: go.paloaltonetw...
• Growth Mindset: www.khanacadem...
• Mitches favorite TH-camrs:
• SciShow: / @scishow
• Great Big Story: / @greatbigstory
• The Infographics Show: / @theinfographicsshow
• BBC Earth Lab: / @bbcearthscience
• LifeHacker: / @lifehacker
• Kurzgesagt: / @kurzgesagt
• Tom Scott: / @tomscottgo
• The Slow Mo Guys: / @theslowmoguys
• Smarter Every Day: / @smartereveryday
• Beyond the Press: / @beyondthepress
• Veritasium: / @veritasium
• Real Engineering: / @realengineering
• Wendover Productions: / @wendoverproductions
• Flite Test: / @flitetest
• Styro Pyro: / @styropyro
• The Backyard Scientist: / @thebackyardscientist
• How to Make Everything: / @htme
• Asap Science: / @asapscience
• Vsauce: / @vsauce
• ChefSteps: / @chefsteps
• Music: www.bensound.com

[@alexlvrd]

Great video. I am working on migrating from port-based rules to application-based and this is helping me. Thank you.

[@J2ThaDBizzle]

Excellent video guys. Great content and brilliantly demonstrated. I am part of a team who administer PA firewalls and I cannot believe I did not discover this channel sooner. I know what I will be binge watching for the next month 😊. thanks also for the channel recommendations, some of these guys are in my subscribe list.

[@blackbourg]

Loved it !!!! Thanks for great explanations❣

[@ronroj]

Gracias! Thank you!

[@Cisco8484]

Is there a quick way to go from a security policy to view the matching traffic (monitor) just for that rule? It's currently a multi-step annoying process. Click on the security rule, copy the name, go to monitor tab, click on another rule name, change the filter to paste the copied rule name. I'm on 8.1.5.

[@benmeagher7666]

Policies - Security - Hover over a rule name, a drop down box appears. One of the options is Log Viewer, this will pivot you to the matching traffic flows in the Monitor tab that match the selected rule.

[@Cisco8484]

@@benmeagher7666 You sir, are correct. Thank-you for this tip.

[@durganaveenmunaga3065]

Is there a Tag Browser in Pan OS 9.0 ?

[@PaloAltoNetworksLiveCommunity]

No, in PAN-OS 9.0 it was replaced by the Policy Optimizer