Focus

Prisma SD-WAN Administrator’s Guide

Security Policy Rules

Table of Contents

Security Policy Rules

Prisma SD-WAN supports security policy rules for ZBFW.

Where Can I Use This?	What Do I Need?
Prisma SD-WAN	Active Prisma SD-WAN license

A security policy rule specifies the handling of application traffic between zones in a branch office. For each security policy rule, define source and destination zones, the applications to which the rule applies, optional prefix filters, and the appropriate action.

By default, three security policy rules add to the end of every security policy set. These default policy rules provide a basic framework for handling network traffic and cannot be edited or deleted.

If you don’t configure any security policy rules of your own, the following default security policy rules are applied:

Default—Denies all traffic from any source zone to any destination zone.
Self-Zone—Allows any traffic generated by the ION or destined to the ION on trusted L3 interfaces (L3 LAN, controller, or L3 private WAN interfaces). For an untrusted interface (L3 public WAN), only traffic initiated by the ION untrusted interface permits by this rule; unsolicited inbound traffic to a public WAN port drops by default regardless of ZBFW policy and zones applied.
Intra-Zone—Allows any traffic within the same zone.

The new rules take precedence over the default rules and control how rules evaluate by specifying the ruling order.

There is no limit on the number of security policy rules added to the network configuration.

Security Policy Sets

Actions