Next generation.
Firewalls are more than just a list of access control entries.
They look deeper into traffic to find additional threats
on a Palo Alto firewall.
A key component to this is the security profile
We use a security profile to match traffic based on conditions like source
destination, user application and so on.
If the conditions match and if the action allows traffic.
Then we can apply a security policy.
This looks for additional threats within this traffic.
These threats include viruses, malware vulnerabilities,
risky file types, and DOS attacks.
We can also use these profiles for data
loss prevention and for wildfire.
For example, we may have a security policy
that allows some web browsing traffic and blocks others.
We wouldn't apply any security profiles to the rule that drops traffic.
However, on the rule that allows traffic
we might apply antivirus, anti-spyware, and you are filtering profiles.
While the rule allows web browsing.
These profiles
look at things like whether you are really safe and suitable for work
and whether any files that are downloaded are malicious.
If there's a threat, the security profile can drop the traffic
Wildfire is Palo Alto.
Secure cloud based sandbox environment that's used to check
unknown files and email links for threats
These files and links are sent to the cloud to be scanned.
A result of malicious GRE where benign
or phishing is then sent back to the firewall
Signatures are created for malicious and phishing traffic.
So other firewalls can block these files quickly.
I have another video on wildfire if you'd like to know more about how that works.
The default
wildfire security profile is suitable in most cases.
However, sometimes you might want to configure additional profiles
to better handle traffic between trusted zones.
An antivirus profile protects endpoints within your network
from virus related threats from outside the network.
It does this using a stream based malware prevention engine.
This basically means that the firewall looks at a stream of traffic
and uses a decoder to understand the traffic type
and check it for viruses, Trojans, worms and so on.
These decoders can look at FTP HTP, HDP, two,
IMAP, POP3, SMB, and SMTP.
I'd like to stress that while this aims to stop viruses
before they reach the endpoint, this is not a replacement
for installing anti-virus software on your endpoints.
There are other ways viruses can slip through
within the profile settings.
We can change the action per decoder.
This could be allow alert, drop and reset
The default profile is good, but you might consider
creating a custom profile to minimize effort on the firewall side
when traffic is passing between trusted zones
or to maximize protection from an untrusted zone.
Additional protection is available through wildfire,
which enables the decoders to use signatures to check for well known threats
as well as evasive and emerging threats.
anti-Spyware profiles
are kind of the reverse to an antivirus profile.
They look for clients within the network that appear to be compromised.
Why is this important Because compromise
clients will try to connect to command and control servers
where a malicious person or bot will try to take over.
This profile detects this type of traffic and blocks it.
There are two
built in profiles named default and strict.
The default profile will use the default action
for each signature as defined by Palo Alto.
The strict profile overrides this and blocks all critical,
high and medium threats and will alert on low and informational traffic.
Each profile contains a set of rules.
Each rule contains a threat name, which is a filter to match signatures
a category which is a type threat like a keylogger or command
and control, an action and a severity level.
In addition to the regular actions like allow alert and drop,
we have default, which is the Palo Alto recommended action.
We have block IP, which temporarily blocks
traffic from this source IP and DNS sinkhole.
DNS sinkhole is where the firewall forges a DNS response
to clients that access a malicious domain.
This makes it easier for us to identify compromised hosts
Vulnerability
Protection goes hand in hand with anti-spyware,
while anti-spyware looks at traffic leaving the network.
Vulnerability Protection looks at traffic entering the network.
In particular, it looks at traffic that is known to exploit security flaws.
For example, it will detect traffic that tries to gain access to systems,
overflow buffers, execute code and things like this.
This also contains a set of rules like the name, which is a signature
filter, an action the host type category
C, V, vendor ID and severity.
It's nice that you can filter by the CVC
number or vendor if you want to get specific.
You could even do this to create exceptions if you want.
As with anti-spyware,
there are two default profiles that you can use strict and default
URL filtering is easy to understand.
It's simply a way to monitor and control how users access the web.
Websites assorted into categories like adult hacking news and so on.
There are a lot of different categories.
The default profile blocks, malicious sites and adult content
When you create a security policy, you will allow web traffic.
A URL filtering profile can then be attached to further
refine the web filtering.
File.
Blocking is a simple profile that stops certain types of files
from being transferred.
Generally, these will be files like executables
scripts and other types that are known to be risky.
This even allows us to configure a custom web page that warns the user
but gives them the opportunity to download the file anyway.
This can be done by setting the continue action,
as is often the case.
There are two out of the box profiles basic and strict
All you can create your own
data filtering profiles are quite interesting.
These are used as a type of DLP or data loss prevention.
The idea is to prevent sensitive information from leaving the network.
The profile looks for patterns in traffic that may indicate that someone
is sharing a credit card number, a Social Security or tax file number,
or some other pattern that you can figure.
In addition to looking for a regex pattern,
we can specify the file type to inspect.
For example, a word dock as well as a type of traffic such as FTP.
That's the basics of Palo Alto profiles.
Overall, wasn't too dry for you.
There's more coming up, so please stick around for the next video.