Getting Started with Palo Alto Networks (bSecure)

What is Palo Alto Networks?

Palo Alto Networks provides the security infrastructure hosting the bSecure suite of services. These services include the Data Center and Departmental Firewall Services, Site-to-Site VPN, and GlobalProtect Remote Access.

• End Users: Most familiar with the GlobalProtect Remote Access VPN, which provides secure access to campus networks and library resources.
• Technical Staff: Often work within Panorama, the "single pane of glass" used to manage, monitor, and generate reports from all bSecure systems and services.

Recommended Training Modules for VSYS Administrators

The following training modules are recommended for VSYS (Virtual System/Firewall) administrators. To access these, log in to the Palo Alto Networks Training Portal and navigate to Digital Learning > Next-Generation Firewall.

The following subsections are the most relevant for campus administrators:

• Security Profiles and Security Policies
• App-ID and User-ID
• Zone Security, Security and NAT Policies
• Threat and Traffic Information
• Security Rule Tuning and Policy Optimization

---

Key Highlights: App-ID

A primary difference between legacy port-based firewalls and the Palo Alto Networks Next Generation Firewall (NGFW) is App-ID. This feature classifies and identifies applications traversing the network irrespective of the port or protocol used.

Comparison: Legacy vs. App-ID Rules

Traditional Port-Based Rule (Broad)	Palo Alto App-ID Rule (Specific)
Action: Allow Source: 192.168.1.1 Destination: 192.168.2.1 Port: 80 Protocol: TCP Effect: Allows all traffic on port 80, including potential exploits.	Action: Allow Source: 192.168.1.1 Destination: 192.168.2.1 Port: 80 Protocol: TCP App-ID: sharepoint-base Effect: Permits only legitimate SharePoint traffic; all other traffic (even on port 80) is blocked.

By specifying sharepoint-base, App-ID gives you fine-grained control. All other SharePoint functions (like sharepoint-admin or sharepoint-calendar) and exploits are blocked because they do not match the specific application signature.

Key Highlights: Security Zones

Security zones group physical and virtual interfaces to segment network traffic. Initially, your VSYS will be configured with one security zone per network subnet.

• Inter-zone traffic: Traffic moving between two zones is denied by default. You must define a policy to allow this.
• Intra-zone traffic: Traffic moving between hosts within the same zone is allowed by default.

Note: Zone and interface configurations are performed by the Network Operations and Services (NOS) team.

Key Highlights: Security Profiles

Security profiles scan network content for threats like malware, spyware, and exploits. Profiles must be attached to an existing security policy (firewall rule) to take effect.

• Anti-Virus: Protects against viruses, worms, and trojans.
• Anti-Spyware: Blocks "phone-home" beacons to command-and-control servers.
• Vulnerability Protection: Stops attempts to exploit system flaws.
• URL Filtering: Monitors and controls web access over HTTP/HTTPS.
• File Blocking: Prevents specific file types from being transferred.
• WildFire Analysis: Forwards unknown files to the WildFire cloud for sandbox analysis.

A Security Profile Group is a collection of these profiles that can be applied to rules as a single unit. ISO provides a default security profile group that is automatically attached to any new rule you create. You are encouraged to use these defaults and only customize them for specific troubleshooting needs.

---

Questions & Comments

For general questions about security within the bSecure deployment, email security-firewall@berkeley.edu.

• Request New Service: To request a new firewall or modify an existing service in the Data Center, visit the Telecommunications Catalog.
• Technical Support: Support for existing firewall services is available via the IT Service Hub.