CNSE 4.1 Exam Preparation GuideV3.pptx - Palo Alto Networks

Security Policy Operation
• All traffic flowing from one security zone to another security zone requires a policy to
allow the traffic
• The policy list is evaluated from the top down
• The first rule that matches the traffic is used
• No further rules are evaluated after the match
• When configuring a security to allow an application through the firewall, the service field
should be set to “application-default” for inbound services. That will restrict the
application to only use its standard ports (example: DNS will be restricted to only use port
53). It is a best practice to configure application-default or an explicit port(s) for increased
control of the communication on the network
• Note that intra-zone traffic is allowed by default
• If you create a rule at the end of the list that says to deny (and log) all traffic, that will
block intra-zone traffic (which may not be your intention)
Page 18 |