3

security policy and nat policy

Security policy fundamental concepts

• All traffic traversing the data plane of the Palo Alto Networks firewall is matched against a Security Policy

• ❗Traffic matching does not include traffic originating from MGT interface as MGT interface does not pass through the data plane of the firewall

Sessions and Flows

• All traffic passing through the firewall is matched against a session

• A session is matched against a security policy rule

• Each session is assigned a unique session ID number

• After a session is matched, firewall applies matching SPR to the bidirectional traffic in that session.

Security Policy Rule Type

1. Intrazone

   1. Applies matching traffic within the specified source zone

   2. A destination zone cannot be applied, all traffic will be within the Zone specified.

2. Interzone

   1. Applies matching traffic between specified source and destination zone

3. Universal

   1. Applies matching interzone and intrazone traffic in specified source and destination zone

By default, firewall allows intrazone traffic and denies interzone

Policy Rule Hit Count

• Identify rules that are used frequently to determine which rules are unused and should be removed

Rule Shadowing

• Traffic can match multiple rules

• Earlier rule hides over later rule

• Rule Shadow in Commit tab will show any rules that are shadowed

Security Policy Administration

Network Address translation

• Source NAT is used for internal users to access public internet

• Destination NAT is used for external users to access internal servers

Source NAT configuration

• Translates original source IP address to an alternate source IP address

Types of Source NAT

1. Static

   1. 1-1fixed translations

   2. Changes source IP while leaving source port unchanged

   3. Supports implicit bidirectional rule feature

2. Dynamic

   1. 1-to-1 translations of a source IP address only (no port number)

   2. Private source address translates to the next available address in the range

3. Dynamic IP and port (DIPP)

   1. Allows multiple clients to use the same public IP address with different source port numbers

   2. Assigned address can be set to the interface address or to a translated address.

Destination NAT configuration

• Translates original destination IP address to an alternate destination IP address