>
    Create a Security Profile Group (PAN-OS & Panorama)
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Security Profiles
    5. Security Profile Groups
    6. Create a Security Profile Group (PAN-OS & Panorama)
    Download PDF
    Network Security

    Create a Security Profile Group (PAN-OS & Panorama)

    Table of Contents

    Create a Security Profile Group (PAN-OS & Panorama)

    Create a security profile group and add it to a Security policy.
    To get started, you’ll need to:
    • Add a profile group
      When adding a Security Profile Group to your configuration, begin by providing a descriptive name and optional description to identify the purpose and functionality of the group.
    • Choose your Security Profiles
      Select the security profiles you wish to include within the group. These profiles can encompass various security aspects such as antivirus, antispyware, vulnerability protection, URL Filtering, and more. Customize each selected profile based on specific security rules and threat prevention needs.
      After configuring the profiles, associate the profile group with Security policy rules to ensure consistent and comprehensive threat prevention. Implement this association by editing existing security rules or creating new ones, referencing the Security Profile Group accordingly.
    • Review your Security Profile Group
      Regularly reviewing and updating your Security Profile Groups is crucial to adapt to evolving threats and security requirements. This iterative process involves fine-tuning profile settings and incorporating new threat intelligence to optimize security efficacy. By effectively utilizing security profile groups, you can streamline Security policy management, achieve granular threat prevention, and fortify your network against a wide array of cyberthreats.
    Use the following steps to create a security profile group and add it to a security policy.
    1. Create a security profile group.
      If you name the group default, the firewall will automatically attach it to any new rules you create. This is a time saver if you have a preferred set of security profiles that you want to make sure get attached to every new rule.
      1. Select ObjectsSecurity Profile Groups and Add a new security profile group.
      2. Give the profile group a descriptive Name, for example, Threats.
      3. If the firewall is in Multiple Virtual System Mode, enable the profile to be Shared by all virtual systems.
      4. Add existing profiles to the group.
      5. Click OK to save the profile group.
    2. Add your security profile to a Security policy.
      1. Select PoliciesSecurity and Add or modify a security security rule.
      2. Select the Actions tab.
      3. In the Profile Setting section, select Profiles for the Profile Type.
      4. Select the profiles you want to add to your security rule.
      5. Click OK to save the security rule and Commit your changes.

    Set Up or Override a Default Security Profile Group

    A Security Profile Group streamlines the management and application of security settings, allowing you to apply a set of predefined profiles to traffic based on their security requirements.
    Additionally, you can set up a default Security Profile Group to be used in new security rules, or to override an existing default group. When you create a new Security policy, the default profile group is automatically selected as the policy’s profile settings, and traffic matching the policy are checked according to the settings defined in the profile group (you can choose to manually select different profile settings if desired).
    If you have an existing default Security Profile Group, and you don't want that set of profiles to be attached to a new security rule, you can override the default Security Profile Group and select a different profile group.
    Use the following options to set up a default Security Profile Group or to override your default settings.
    1. Set up a default security profile group.
      1. Select ObjectsSecurity Profile Groups and add a new security profile group or modify an existing security profile group.
      2. Name the security profile group default:
      3. Click OK and Commit.
      4. Confirm that the default security profile group is included in new Security policies by default:
        1. Select PoliciesSecurity and Add a new Security policy.
        2. Select the Actions tab and view the Profile Setting fields:
          By default, the new Security policy correctly shows the Profile Type set to Group and the default Group Profile is selected.
    2. Override a default security profile group.
      If you have an existing default security profile group, and you do not want that set of profiles to be attached to a new Security policy, you can continue to modify the Profile Setting fields according to your preference. Begin by selecting a different Profile Type for your policy (PoliciesSecuritySecurity Policy RuleActions).

    © 2024 Palo Alto Networks, Inc. All rights reserved.