👾
syte
  • 🎋readme.txt
  • 🔒security.txt
  • 2023
    • 📶network security
      • 1
        • 1.1
        • 1.2
      • 2
      • 3
        • 3.1
      • 4
        • 4.1
      • 5
      • 11
      • 12
      • 13
      • Revision for CT
  • 📓TERABYTES
    • explaining success
    • better utilizing luck
    • cyber list resources
    • zeek
    • exploration in rhel
    • devops pain
    • OSINT
  • 2025
    • y1.2
      • three-three-zero-one
        • content
        • writings
        • theories
      • one-zero-six
      • one-zero-five
        • 105 cheat sheet 0
        • 105 cheat sheet 1
        • 105 cheat sheet 2
      • tfb
        • lvl 2
        • lvl 1
    • cpts
      • notes
      • command cheat sheet
Powered by GitBook
On this page
  • Security policy fundamental concepts
  • Security Policy Administration
  • Network Address translation
  • Source NAT configuration
  • Destination NAT configuration
  1. 2023
  2. network security

3

security policy and nat policy

Previous2Next3.1

Last updated 1 year ago

Security policy fundamental concepts

  • All traffic traversing the data plane of the Palo Alto Networks firewall is matched against a Security Policy

  • Traffic matching does not include traffic originating from MGT interface as MGT interface does not pass through the data plane of the firewall

Sessions and Flows

  • All traffic passing through the firewall is matched against a session

  • A session is matched against a security policy rule

  • Each session is assigned a unique session ID number

  • After a session is matched, firewall applies matching SPR to the bidirectional traffic in that session.

Security Policy Rule Type

  1. Intrazone

    1. Applies matching traffic within the specified source zone

    2. A destination zone cannot be applied, all traffic will be within the Zone specified.

  2. Interzone

    1. Applies matching traffic between specified source and destination zone

  3. Universal

    1. Applies matching interzone and intrazone traffic in specified source and destination zone

By default, firewall allows intrazone traffic and denies interzone

Policy Rule Hit Count

  • Identify rules that are used frequently to determine which rules are unused and should be removed

Rule Shadowing

  • Traffic can match multiple rules

  • Earlier rule hides over later rule

  • Rule Shadow in Commit tab will show any rules that are shadowed

Security Policy Administration

Network Address translation

  • Source NAT is used for internal users to access public internet

  • Destination NAT is used for external users to access internal servers

Source NAT configuration

  • Translates original source IP address to an alternate source IP address

Types of Source NAT

  1. Static

    1. 1-1fixed translations

    2. Changes source IP while leaving source port unchanged

    3. Supports implicit bidirectional rule feature

  2. Dynamic

    1. 1-to-1 translations of a source IP address only (no port number)

    2. Private source address translates to the next available address in the range

  3. Dynamic IP and port (DIPP)

    1. Allows multiple clients to use the same public IP address with different source port numbers

    2. Assigned address can be set to the interface address or to a translated address.

Destination NAT configuration

  • Translates original destination IP address to an alternate destination IP address

📶
❗