Using Application ‘ssl’ and Service ‘application-default’ is the correct approach. The ‘ssl’ application object represents all SSL/TLS traffic, which is what you want to match for decryption. Setting the Service to ‘application-default’ allows the firewall to use the default port for the identified application (e.g., TCP 443 for SSL), which is more flexible and secure than hardcoding ‘service-https’. This ensures the rule matches the traffic for decryption, after which App-ID can further identify the specific web application (like ‘web-browsing’ or ‘google-base’) within the decrypted stream for policy enforcement.

The ‘ms-office365’ application is a container application. While it represents core connectivity, many Office 365 services like ‘sharepoint-online’, ‘teams’, or ‘skype-for-business’ are separate, dependent sub-applications. A rule specifying only the parent ‘ms-office365’ application will not automatically allow traffic identified as one of its specific sub-applications. The administrator needs to either use the application group ‘office365’ (which includes all known sub-applications) or explicitly add the required sub-applications (like ‘sharepoint-online’) to the rule.

This option best implements least privilege. It restricts the source to only the development team’s IP range, the destination to the specific server subnet, and the application to ‘ssh’. Using ‘application-default’ for the service is the recommended practice as it allows the firewall to use the standard port for the identified SSH application (TCP 22) rather than being limited to a static port definition. This is more restrictive and precise than using ‘any’ for Application or a broader Destination.

Palo Alto Networks firewalls evaluate Security policy rules from top to bottom, stopping at the first match. In this scenario, the broad ‘allow any’ rule is placed above the new, specific P2P deny rule. Therefore, the P2P traffic matches the ‘allow any’ rule first, the action is applied (allow), and rule evaluation stops. The deny rule below it is never evaluated for this traffic. To fix this, the more specific deny rule must be placed above the general allow rule.

Many websites, especially those handling sensitive personal or financial data, may use techniques like Certificate Pinning or present certificates that cause errors during man-in-the-middle decryption. To prevent breakage, administrators often add such sites to a Decryption Exclusion list (by URL, category, or certificate attributes). This bypasses decryption for that site, allowing the user’s browser to communicate directly with it. This is the most common reason for a single, specific HTTPS site failing to load when decryption is otherwise working.

A rule using only Service ‘service-https’ is a port-based rule. It will allow any traffic on TCP port 443, regardless of the actual application protocol (it could be SSL, but it could also be something else using that port). A rule using Application ‘ssl’ is application-based. The firewall uses App-ID to first confirm the traffic is indeed SSL/TLS, and then ‘application-default’ uses the standard port for that identified application. This is more secure as it ensures the rule only applies to legitimate SSL traffic, aligning with the zero-trust, application-centric security model.

To achieve time-based application control, you need two main components: 1) A Schedule object to define the ‘work hours’ time window. 2) The ability to selectively target video-streaming apps. This is best done using the Application Filter feature in the Security policy rule. You can create a rule that uses an Application Filter (e.g., Category contains ‘media’ AND Subcategory equals ‘video’) to match all video-streaming apps, attach the ‘work hours’ Schedule to this rule, and set the Action to deny. A separate rule for audio-streaming (Subcategory ‘audio’) with no schedule would then allow it always.

While all options can eventually block traffic, creating a new Security policy deny rule is the most direct, immediate, and universally applicable method. You can quickly create a rule at the top of the rulebase with Source=any, Destination=[malicious-IP-object], Service/Application=any, Action=deny. This will start blocking all sessions to that IP as soon as the rule is committed. External Dynamic Lists are powerful for managing large lists, but they require configuration of an EDL feed. DoS and Zone Protection are for specific attack types (floods, scans) and not as precise for blocking all communication to a single IP.

EAP-TLS (Extensible Authentication Protocol – Transport Layer Security) is a certificate-based authentication method. It requires both the server (radius/authentication server) and the client (the laptop) to present a digital certificate. By configuring the SSID for WPA2-Enterprise with 802.1X and EAP-TLS, and setting the firewall to validate the client’s machine certificate, access is restricted only to devices that possess a valid, trusted company-issued certificate. This is stronger than password-based methods like PEAP or PSK, as it authenticates the device itself.

Using Application ‘ssl’ and Service ‘application-default’ is the correct approach. The ‘ssl’ application object represents all SSL/TLS traffic, which is what you want to match for decryption. Setting the Service to ‘application-default’ allows the firewall to use the default port for the identified application (e.g., TCP 443 for SSL), which is more flexible and secure than hardcoding ‘service-https’. This ensures the rule matches the traffic for decryption, after which App-ID can further identify the specific web application (like ‘web-browsing’ or ‘google-base’) within the decrypted stream for policy enforcement.0