>
    Strata Copilot
    Create Security Rules on Cloud NGFW for Azure
    Focus
    Download PDF
    Focus
    1. Home
    2. Cloud NGFW for Azure Administration
    3. Protect Traffic with Cloud NGFW for Azure
    4. Cloud NGFW Native Policy Management
    5. Create Security Rules on Cloud NGFW for Azure
    Download PDF
    Cloud NGFW for Azure

    Create Security Rules on Cloud NGFW for Azure

    Table of Contents

    Create Security Rules on Cloud NGFW for Azure

    Learn how to create security rules on the Cloud NGFW for Azure.
    Where Can I Use This?What Do I Need?
    • Cloud NGFW for Azure
    • Cloud NGFW subscription
    • Palo Alto Networks Customer Support Portal account
    • Azure Marketplace subscription
    Security rules protect network assets from threats and disruptions and help to optimally allocate network resources for enhancing productivity and efficiency in business processes. On Cloud NGFW for Azure, individual security rules determine whether to block or allow a session based on traffic attributes, such as the source and destination IP address, source and destination FQDNs, or the application.
    All traffic passing through the firewall is matched against a session and each session is matched against a rule. When a session match occurs, the NGFW applies the matching rule to bidirectional traffic in that session (client to server and server to client). For traffic that doesn’t match any defined rules, the default rules apply.
    Security policy rules are evaluated left to right and from top to bottom. A packet is matched against the first rule that meets the defined criteria and, after a match is triggered, subsequent rules are not evaluated. Therefore, the more specific rules must precede more generic ones in order to enforce the best match criteria.
    After creating a rulestack, you can now create rules and add them to your rulestack.
    To create security rules, familiarize yourself with how rulestacks work.
    1. Click the Local Rulestacks icon from the homepage and select a previously-created rulestack on which you wish to add Rules.
    2. Click Rules and then click Add.
    3. In the general section, enter a descriptive Name for your rule.
    4. (Optional) Enter a Description of your rule.
    5. Set the Rule Priority.
      The rule priority determines the order in which the rules are evaluated. Rules with a lower priority are evaluated first. Additionally, each rule within a rulestack.
    6. By default, the security rule is Enabled. Uncheck Enabled to disable the rule. You can enable or disable a rule at any time.
    7. Set the Source.
      1. Select Any, Match, or Exclude.
        Selecting Any means the traffic is evaluated against the rule regardless of source.
      2. If you select Match, specify the IP Address (CIDR), Prefix List, Countries, Intelligent Feeds, or Dynamic Prefix List.
    8. Set the Destination.
      1. Select Any, Match, or Exclude.
        Selecting Any means the traffic is evaluated against the rule regardless of destination.
      2. If you select Match, specify the Prefix List, FQDN List, Countries.
    9. Set Granular Control.
      1. Choose Any or Select.
        When choosing Any, traffic is evaluated regardless of the application. By specifying an application(s), traffic is evaluated against the rule if the traffic matches the specified application.
      2. If you choose Select, specify the applications.
    10. Set URL Category Granular Control.
      1. Choose Any or Select.
        When choosing Any, traffic is evaluated regardless of the URL.
      2. If you choose Select, Choose one of the Predefined Categories from the drop-down.
    11. Set Port & Protocol Granular Control.
      1. Choose application-default, any, or Select.
        When choosing any, traffic is evaluated regardless of the port and protocol. By specifying a port and protocol, traffic is evaluated against the rule if the traffic matches the specified port and protocol.
      2. If you choose Select, select the protocol from the drop-down and enter the port number. You can specify a single port number.
    12. Set Actions.
      1. Set the Action the firewall takes when traffic matches the rule—Allow, Deny, Drop, or Reset both client and server.
      2. Enable Egress Decryption.
      3. Enable Logging.
    13. Click Add.
    14. After creating rules for your rulestack, validate or deploy your configuration.

    © 2026 Palo Alto Networks, Inc. All rights reserved.