implementing-next-generation-firewall-with-palo-alto

Create security rules that specify applications like web-browsing or office365-enterprise instead of ports, and set the service to application-default so traffic cannot ride non-standard ports. Place an explicit Deny-All rule with log-end enabled at the bottom of the rulebase.

Generate a Forward Trust CA certificate, create a decryption profile blocking expired and untrusted certificates, then apply a decryption policy with the ssl-forward-proxy action. Exclude sensitive categories like financial-services and health-and-medicine with a no-decrypt rule placed above it.

The configuration requires PAN-OS 10.2 or later on a PA-series appliance or VM-Series virtual firewall. You also need valid Threat Prevention, URL Filtering, and WildFire licenses plus an internal CA for SSL Forward Proxy.

Browsers may bypass TLS inspection by tunneling over QUIC on UDP/443, so add a rule denying the quic application. Also check for over-broad no-decrypt rules and verify the browser certificate chain resolves to your Forward Trust CA.

Run Policy Optimizer and the command show running security-policy to identify shadowed or unused rules where a permissive early rule overrides stricter ones below it. Reorder or tighten rules so specific policies match before broad ones.