Network Security
Create a Security Policy Rule (Strata Cloud Manager)
Table of Contents
Expand All
|
Collapse All
Network Security Docs
Create a Security Policy Rule (Strata Cloud Manager)
Learn how to create a security rule.
To ensure that end users authenticate when they try to access your network
resources, authentication is evaluated before Security policy. For details, see
Authentication.
- Add a rule. Selectand build your rule by configuring the following rulecomponents. Components marked with an asterisk(*) are mandatory.ManageConfigurationNGFW andPrisma AccessSecurity ServicesSecurity PolicyAdd Rule
- SectionElementDetailsGeneral*NameGive your rule a name the tells other administrators what it does.DescriptionYou can give your rule a detailed description of the rule's intent.Match CriteriaSourceDefine the matching criteria for the source fields in the packet.
- Select a*Zone.
- Specify source IP*Addressesor leave the value set toAny.
- Specify source*Usersor leave the value set toAny. You can selectUsersto enforce policy for individual users or a group of users. If you're using GlobalProtect™ with host information profile (HIP) enabled, you can also base the policy on information collected by GlobalProtect. For example, the user access level can be determined from the HIP that informs your environment about the user's local configuration. The HIP information can be used for granular access control based on the security programs that are running on the host, registry values, and many other checks such as whether the host has antivirus software installed.
If you decide toNegatea region as a source address, ensure that all regions that contain private IP addresses are added to the source address to avoid connectivity loss between those private IP addresses.DestinationDefine the destination zone or destination address for the traffic.- Select a*Zone.
- Specify source IP*Addressesor leave the value set toAny.
If you decide toNegatea region as the destination address, ensure that all regions that contain private IP addresses are added to the destination addresses to avoid connectivity loss between those private IP addresses.As a best practice, use address objects as the destination address to enable access to only specific servers or specific groups of servers especially for commonly exploited services, such as DNS and SMTP. By restricting users to specific destination server addresses, you can prevent data exfiltration and command-and-control traffic from establishing communication through techniques such as DNS tunneling.Application / ServiceSpecify the application that the rule will allow or block. Add theApplicationyou want to safely enable. You can select multiple applications or you can use application groups or application filters. Keep theServiceset toApplication Defaultto ensure that any applications that the rule allows are allowed only on their standard ports. An administrator can also use an existing App-ID signature and customize it to detect proprietary applications or to detect specific attributes of an existing application. Custom applications are defined in.ObjectsApplicationsAs a best practice, always use application-based Security policy rules instead of port-based rules and always set the Service to application-default unless you're using a more restrictive list of ports than the standard ports for an application.URL Category / Tenant Restriction(Optional) Specify a URL category as match criteria for the rule. SelectURL CategoryorTenant Restrictionto specify a specific TCP and/or UDP port number, a URL category, a tenant restriction as match criteria in the security rule. If you select a URL category, only web traffic will match the rule and only if the traffic is destined for that specified category.ActionsActionDefine whatActionyou want taken for traffic that matches the rule. See Security Rule Actions for a description of each action. - Configure the log settings.
- By default, the rule is set toLog at Session End. You can disable this setting if you don’t want any logs generated when traffic matches this rule or you can selectLog at Session Startfor more detailed logging.
- Select aLog Forwardingprofile.
As a best practice, don't select the check box toDisable Server Response Inspection(DSRI). Selecting this option prevents the inspection of packets from the server to the client. For the best security posture, both the client-to-server flows and the server-to-client flows must be inspected to detect and prevent threats. - Attach security profiles to scan all allowed traffic for threats.Make sure you create best practice security profiles that help protect your network from both known and unknown threats.In, select aActionsProfile GroupProfile Groupfrom the drop-down to attach to the rule.
- SelectSaveto save the security rule, thenPush Configto your devices.
- Monitor the security rule usage status and determine the effectiveness of the security rule, and optimize if needed.