Adding a security rule on a Palo Alto firewall

On a Palo Alto firewall nothing takes effect until it is committed, and a commit can carry every pending change with it, so a rushed commit can push a colleague's half-finished edits along with yours. 2501 adds the rule your ticket asks for, previews every commit, and stops rather than commit changes it did not make, all within limits you set.

A request to allow one flow looks like one rule. On PAN-OS it can also mean new address or service objects, the zones on each side, a place among the existing rules and, on Panorama, a push to the right group of firewalls.

What 2501 does

The PaloAlto specialty takes the request from your ticketing system and checks what already exists, reusing objects and following your naming conventions. It writes the rule with the zones on both sides and places it where the ticket says, since the first match wins. It previews each commit before making it and ties it to the ticket, then verifies the result and reports what it changed.

You stay in control

• You choose the level: investigate only, act after a person confirms, or act on its own within your rules. The level is set per specialty, not per ticket.
• Other people's edits are never committed: when a commit would include changes it did not make, it stops and hands over to a person.
• Rules stay scoped and visible: it never writes a rule from any zone to any zone, never turns logging off, and never deletes a rule or object that something depends on.
• Your rules apply: which firewalls it may change unattended and which changes need a person first, and blacklisted commands stay out of reach.

Frequently asked

Why is my new rule not working yet? It takes effect only once committed, and on Panorama once it is also pushed to the firewalls. 2501 does both as part of the ticket.

Why can a commit fail on a change that looks right? A commit validates the whole configuration, not only the new rule, so a problem elsewhere can block it. 2501 reads the error and never forces a commit past it.

Related

• PaloAlto Manager
• Setting up a site-to-site VPN on a FortiGate
• ServiceNow incidents and change requests