{"id":29980,"date":"2019-10-31T21:32:59","date_gmt":"2019-10-31T18:32:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw\/"},"modified":"2019-10-31T21:32:59","modified_gmt":"2019-10-31T18:32:59","slug":"optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/optimizator-politik-bezopasnosti-palo-alto-networks-ngfw","title":{"rendered":"Palo Alto Networks NGFW Security Policy Optimizer","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

How to evaluate the effectiveness of NGFW configuration<\/h1>\n

\nThe most common task is to check how effectively your firewall is configured. There are free tools and services offered by companies specializing in NGFW. <\/p>\n

For example, it can be seen below that Palo Alto Networks provides the ability directly from the support portal<\/a><\/noindex> to launch an analysis of firewall statistics \u2014 SLR reporting or best practices compliance analysis \u2014 BPA reporting. These are free online tools that can be used without installing anything.
\n\"Palo <\/a><\/noindex><\/p>\n

CONTENTS<\/h3>\n

\nExpedition (Migration Tool)<\/a><\/noindex>
\nPolicy Optimizer<\/a><\/noindex>
\nZero Trust<\/a><\/noindex>
\nClick on Unused<\/a><\/noindex>
\nClick on Unused App<\/a><\/noindex>
\nClick on No Apps Specified<\/a><\/noindex>
\nBut what about Machine Learning<\/a><\/noindex>
\nUTD<\/a><\/noindex><\/p>\n

<\/a><\/noindex><\/p>\n

Expedition (Migration Tool)<\/h2>\n

\n\"Palo
\n
\nA more complex method to check your settings is to download the free utility Expedition<\/a><\/noindex> (formerly Migration Tool). It is downloaded as a Virtual Appliance for VMware, no additional configuration is required \u2014 just download the image and deploy it on the VMware hypervisor, start it, and access the web interface. This utility deserves a separate discussion, as the course on it takes 5 days due to the many functions available now, including Machine Learning and migration of various policy configurations, NAT, and objects for different Firewall manufacturers. I will write more about Machine Learning later in the text.<\/p>\n

<\/a><\/noindex><\/p>\n

Policy Optimizer<\/h2>\n

\nAnd the most convenient option (IMHO), which I will detail today \u2014 the policy optimizer built into the Palo Alto Networks interface itself. To demonstrate it, I installed a firewall at my home and wrote a simple rule: permit any to any. In fact, I sometimes see such rules even in corporate networks. Naturally, I enabled all NGFW security profiles, as shown in the screenshot:
\n\"Palo
\n
\nThe screenshot below shows an example of my home unmanaged firewall, where almost all connections fall into the last rule: AllowAll, as indicated by the statistics in the Hit Count column.
\n\"Palo
\n
\n<\/a><\/noindex><\/p>\n

Zero Trust<\/h2>\n

\nThere is an approach to security called Zero Trust<\/a><\/noindex>. What this means is that we should allow people inside the network only the connections they need and block everything else. That is, we need to add clear rules regarding applications, users, URL categories, file types; enable all IPS and antivirus signatures, turn on sandboxing, DNS protection, and utilize IOC from available Threat Intelligence databases. Overall, there are quite a few tasks in configuring a firewall. <\/p>\n

By the way, the minimum set of necessary configurations for Palo Alto Networks NGFW is described in one of the SANS documents: Palo Alto Networks Security Configuration Benchmark<\/a><\/noindex> \u2014 I recommend starting with it. Of course, there is also a set of best practices for configuring the firewall from the manufacturer: Best Practice<\/a><\/noindex>.<\/p>\n

So, I have had a firewall sitting at home for a week. Let's take a look at the traffic in my network:
\n\"Palo
\n
\nIf sorted by the number of sessions, the most are created by bittorrent, then SSL, followed by QUIC. This is combined statistics for both incoming and outgoing traffic: a lot of external scans on my router. There are 150 different applications in my network. <\/p>\n

So, all of this was passed with a single rule. Now let's see what the Policy Optimizer has to say about this. If you looked above at the screenshot of the security rules interface, you would have seen a small window at the bottom left hinting that there are rules that can be optimized. Let\u2019s click on that.<\/p>\n

What the Policy Optimizer shows:<\/p>\n