On the Palo Alto Firewall Platform, profiles are a collection of security settings that address an individual area of security (e.g., virus detection, file type restrictions, etc.) and which can be applied to rules. Information Security Office (ISO) publishes a number of profiles for use in our Palo Alto Firewalls. These profiles can be assigned individually in rules, but doing so makes it more difficult to maintain consistency across multiple similar rules. In order to mitigate this issue, it’s generally advisable to use the profiles as part of a Profile Group (a defined collection of profiles). With this in mind, ISP has put together several Profile Groups that are recommended for systems and users based on if the systems are for servers or end-users as well as if the systems are on networks that contain restricted data.
Below are the steps an administrator can take to find the individual Profiles that make up a given Profile Group and then determine the settings for each of these profiles.
NOTE: Profiles and Profile Groups that are developed by ISP are designated with the ucbsec prefix and will include a capital RD if it’s meant for Restricted Data systems/users.
ADDITIONAL NOTE: The examples and profiles here can and probably will change over time. These are here as an example only.
- Log into https://panorama.net.berkeley.edu using single sign-on
- From the tabs at the top of the window choose “Objects”
- In the column on the left chose “Security Profile Groups”
- In the main window open the profile group you wish to review. In this example, we are going to look at the settings for the “default” security group. (PLEASE NOTE: the default group will be made up of different settings depending on if it’s a high security device group as well as if it’s on campus firewalls or in the data center firewalls, in this example, it’s in the High Security device group for the Campus Users. Additionally, the settings are subject to change as features are added or problems are discovered.)
- By examining the default group, we are able to see that in this example the following profiles are used:
- Anti-Virus Profile: ucbsec-AV_standard
- Anti-Spyware Profile: ucbsec-RD_AS_all
- Vulnerability Profile: ucbsec-RD_VP_all
- URL Filtering Profile: ucbsec-url_filter
- File Blocking Profile: ucbsec-RD_FB_on-campus
- WildFire Analysis Profile: ucbsec-wildfire_cloud
(NOTE: A Data Filtering Profile is not shown because that profile is best determined at the local level.)
- Using this information it is now possible to see the settings that make up each of the security profiles using the following KB articles: