The best practice is to adopt a phased approach to avoid breaking connectivity. Creating a new, more specific rule above the existing one allows traffic matching the new criteria to be handled correctly first. The original broad rule remains as a catch-all for other traffic, ensuring no disruption. This method allows you to gradually migrate services to more secure, application-aware policies.

Palo Alto Networks firewalls are application-centric. To allow an application, especially an encrypted one like MS-SQL over SSL, the application field must contain the specific App-ID (e.g., ‘ms-sql-ssl’). The ‘application-default’ service setting is correct as it allows the application to use its standard ports. The primary control point is the application identification, not just the port/service.

Panorama’s ‘Shared’ location is specifically designed for objects and policies that need to be consistent across all managed firewalls and device groups. Objects defined in the Shared context are universally available, eliminating the need to duplicate definitions in each device group and ensuring centralized management and consistency.

Lateral movement is best prevented by strict micro-segmentation. This means defining security policies between zones (or within zones) that only allow specific, necessary application communications (e.g., web app to database on ms-sql). Simply having a zone-based model without intra-zone policies, or relying solely on threat prevention which may fail against zero-days, does not enforce the necessary network segmentation to contain a breach.

The ACC provides real-time and historical visibility into the applications, threats, and data flows consuming resources. High DP-CPU is typically caused by traffic processing load. The ACC will show which policies, applications, or threat scans are processing the most traffic and sessions, providing direct insight into the source of the data plane load. Resource monitor shows overall levels, while ACC shows the ‘why’.

For custom TCP applications (where specific App-ID may not do full decoding), the core Threat Prevention suite (Antivirus, Anti-Spyware, Vulnerability Protection) provides essential protection against exploits, malware, and command-and-control traffic. File Blocking controls risky file transfers. This combination offers robust security. WildFire is for unknown files, and Data Filtering/URL Filtering are less relevant for backend server-to-server traffic than for user-facing traffic.

The most secure and aligned with the application-centric model is to use ‘application-default’. This allows the firewall to identify the backup application via App-ID and dynamically permit the ports it uses, even if they are ephemeral. This is more secure than a static port (which might be wrong) or a broad range/any, and it ensures the policy is tied to the application’s identity, not just a port.

The Traffic Log contains entries for all traffic sessions that match security policies, including those that are allowed or denied. When a session is denied, the traffic log entry will show the action as ‘deny’ and list the specific security policy rule name that caused the denial, along with full session details (source, destination, application, etc.). Threat logs are for blocked attacks, system logs for device events.

The QoS process starts with the Classifier. It examines incoming packets based on criteria defined in QoS policy rules (like source/destination, application) and assigns them a forwarding class (e.g., ‘voice’, ‘transactional-data’, ‘best-effort’). This classification determines which internal queue the traffic will use for the remainder of its processing through the firewall.

The best practice is to adopt a phased approach to avoid breaking connectivity. Creating a new, more specific rule above the existing one allows traffic matching the new criteria to be handled correctly first. The original broad rule remains as a catch-all for other traffic, ensuring no disruption. This method allows you to gradually migrate services to more secure, application-aware policies.0