Palo Alto Networks
Policy Written In Applications
And People, Not Ports
Palo Alto's original argument was that a rule permitting traffic on port 443 permits almost everything, and therefore says almost nothing. Its firewalls identify the actual application and the actual user, so a policy can state what is allowed in terms a business would recognise.
Traffic is classified by what the application actually is rather than by the port it happens to use, which is what makes a meaningful allow rule possible.
Policy is written against directory identities rather than addresses, so a rule survives a change of desk, device or IP allocation.
The same policy model applies to physical appliances, virtualised firewalls and cloud-delivered enforcement for remote staff.
Port Based Policy Stopped Describing Reality Years Ago
An organization's firewall rule set is frequently its least understood document, and the reason is structural rather than clerical.
Everything Uses The Same Port
Business applications, file sharing services, remote access tools and command channels all travel over the same encrypted web port. A rule permitting it permits the lot, which means the firewall is expressing an intention it cannot enforce.
Rules Outlive Their Reason
Exceptions accumulate. Each was justified when it was made, none is documented, and nobody will remove one for fear of breaking something. The set grows in only one direction.
Addresses Are Not People
A rule tied to an IP address describes a machine at a moment. When someone moves, works from home or changes device, the policy either fails to apply or applies to the wrong person entirely.
Enforcement That Follows The Work
The capabilities below matter because staff and workloads no longer sit behind one perimeter.
Application Aware Policy
Rules permit a named application to a named group, which makes the policy readable by somebody who does not work in networking. It also makes review possible, because a rule that cannot be explained can be removed.
Threat Prevention Inline
Intrusion prevention, malware analysis and filtering apply to traffic the policy allows, on the basis that the dangerous traffic is invariably the traffic you deliberately permitted.
Remote Enforcement
Cloud-delivered enforcement applies the organization's policy to staff working anywhere, which closes the gap created when the perimeter stopped containing most of the workforce.
Central Management
Device groups and templates push a common policy to every enforcement point, with local exceptions where genuinely needed rather than by accident.
A Policy You Could Show An Auditor
The practical outcome is a rule set somebody can read. When a rule says that the finance group may use a named accounting application, its purpose is self-evident, and so is the case for deleting it when finance stops using that application.
That has consequences beyond tidiness. It makes periodic firewall review a real exercise rather than a formality, it shortens the answer to an auditor's question about segregation, and it stops the rule set growing indefinitely because nobody dares touch it.
Who This Is Built For
| Situation | Assessment | Verdict |
|---|---|---|
| Regulated, segmentation required | Readable policy is the deliverable | Strong fit |
| Hybrid workforce and cloud workloads | Consistent enforcement everywhere | Strong fit |
| Dedicated network or security staff | Depth is usable rather than wasted | Strong fit |
| Single site, generalist IT team | Capability will exceed the need | Consider simpler |
| Lowest capital cost is the priority | Rarely the cheapest option | Look elsewhere |
Try Reading Your Current Rule Set Aloud
If the rules cannot be explained in business terms, they cannot be reviewed, and a policy nobody reviews only ever grows more permissive.
Review Your Firewall PolicyGet in touch with Your Company
Questions about this solution? Reach us directly.