I85PREP
⌘ K
Palo Alto NetSec Architect study materials
Palo Alto NetSec Architect study resources

Palo Alto NetSec Architect: Security Policy and Configuration

Palo Alto NetSec Architect · Work through your exam, one topic at a time.

All guide sections

Security Policy and Configuration

Security Policy and Configuration

This domain tests the PAN-OS policy model: ordered security rules, App-ID, User-ID, Content-ID, NAT, decryption, profiles, and policy inheritance through Panorama. The exam focuses on least privilege and on rules that remain readable as they scale.

Core rules

  • Security policy is top-down; the first matching rule wins, and an implicit deny-all follows. Put specific rules above broad rules and use the policy optimizer to find shadows.
  • Identify traffic by application, user, and content, not just port. App-ID identifies the application even on nonstandard ports; User-ID maps IP address to user; Content-ID profiles inspect files and threats.
  • Attach a security profile group to every allow rule that carries risk. Profiles cover antivirus, anti-spyware, vulnerability protection, URL filtering, file blocking, and WildFire.
  • Decryption policy is separate from security policy. SSL forward proxy decrypts outbound traffic so App-ID and threat inspection can see inside TLS; no-decrypt rules protect privacy and breakage-prone sites.
  • NAT rules are evaluated separately and before security policy. Use source NAT for egress and destination NAT for inbound services; use bidirectional NAT only when required and document the return path.

Worked example

Users must reach a SaaS file-sharing app but not upload executables. Create a rule allowing the SaaS application for a specific user group, attach a file-blocking profile that blocks PE and archive uploads, and enable SSL forward proxy for that category so the firewall sees the upload. Do not block by TCP 443 alone: the app may use multiple ports, and port-based blocking cannot distinguish upload from download. Place the rule above a broad internet allow. Reason: App-ID provides application context; decryption provides visibility; file blocking enforces the upload restriction.

Traps

Any/any allow rules; port-based rules that miss App-ID; security profiles attached to deny rules; forgetting the implicit deny; breaking applications with decryption without no-decrypt exceptions; and editing a pre-rule in the wrong device group.