PAN-OS · MANAGER

PAN-OS-style: pre-rules, local rules and post-rules

Head office writes rules that a site can’t get around: pre-rules. It also writes a catch-all that the site’s own rules come before: post-rules. In between sit the firewall’s local rules. F1 already has a pushed rule OUT that allows everything, and the site wants to allow one thing of its own.

Palo Alto PAN-OS-style track · Palo Alto PAN-OS-style, Cisco router, Buddy Policy Manager · 4 objectives

Open in simulator More Palo Alto PAN-OS-style labs

Objectives

The simulator ticks each one as soon as the network meets it.

In device group SITE, add pre-rule NO-TELNET: deny application telnet from trust to untrust. Delete the old pre-rule OUT, and add a post-rule CATCH-ALL: deny everything. Commit and push.
On F1 (locally, not on the manager): add rule LOCAL-WEB allowing web-browsing from trust to untrust, service application-default, and rule LOCAL-TELNET allowing telnet the same way. Commit on F1.
From PC1: traffic tcp 192.0.2.1 80 payload "GET /index.html" arrives through the local rule, traffic tcp 192.0.2.1 23 is denied by the pre-rule though a local rule allows it, and traffic tcp 192.0.2.1 22 is denied by the post-rule.
F1’s show running security-policy lists all of them, in order, each marked by where it came from.

Start this lab

Before you start

A firewall reads shared pre, group pre, its own rules, group post, shared post, then the defaults. F1 can’t change or delete what was pushed: try it. A pushed rule and a local rule can’t share a name.

Concept

Pre-rules, local rules, post-rules

A firewall reads pushed rules around its own. Pre-rules come first, so a site can’t get around them. Local rules come next. Post-rules come last, as a catch-all. Then the two defaults apply.

Concept

A template holds the network, a device group holds the policy

A manager runs many firewalls from one place. Templates hold network settings, device groups hold rules and objects, and shared holds what every group gets. There are two steps: commit saves on the manager, and push sends what is committed to the firewalls. A firewall that refuses a push keeps what it had.