104
•
Panorama
6.1
Administrator’s
Guide
©
Palo
Alto
Networks,
Inc.
Use
Case:
Configure
Firewalls
Using
Panorama
Manage
Firewalls
2.
Create
a
shared
pre
‐
rule
to
allow
DNS
and
SNMP
services.
a.
Create
a
shared
application
group
for
the
DNS
and
SNMP
services.
–
Select
Objects > Application Group
and
click
Add
.
–
Enter
a
name
and
select
the
Shared
check
box
to
create
a
shared
Application
Group
object.
–
Click
Add
,
type
DNS
,
and
select
dns
from
the
list.
Repeat
for
SNMP
and
select
snmp
,
snmp-trap
.
–
Click
OK
to
create
the
application
group.
b.
Create
the
shared
policy.
–
Select
the
Policies
tab
and,
in
the
Device Group
drop
‐
down,
select
Shared
.
–
Select
the
Security > Pre-Rules
policies
rulebase.
–
Click
Add
and
enter
a
Name
for
the
security
policy
rule.
–
In
the
Source
and
Destination
tabs
for
the
rule,
click
Add
and
enter
a
Source Zone
and
a
Destination Zone
for
the
traffic.
–
In
the
Applications
tab,
click
Add
,
type
the
name
of
the
applications
group
object
you
just
created,
and
select
it
from
the
drop
‐
down.
–
In
the
Actions
tab,
set
the
Action
to
Allow
,
then
click
OK
.
3.
Define
the
corporate
acceptable
use
policy
for
all
offices.
In
this
example,
create
a
shared
policy
that
restricts
access
to
some
URL
categories
and
denies
access
to
peer
‐
to
‐
peer
traffic
that
is
of
risk
level
3,
4,
or
5.
a.
Select
the
Policies
tab
and,
in
the
Device Group
drop
‐
down,
select
Shared
.
b.
Select
Security > Pre-Rules
,
click
Add
,
and
in
the
General
tab
enter
a
Name
for
the
security
policy
rule.
c.
In
the
Source
and
Destination
tabs,
click
Add
and
select
any
for
the
traffic
Source Zone
and
Destination Zone
.
d.
Define
the
application
filter
in
the
Application
tab—Click
Add
and
click
New
Application Filter
in
the
footer
of
the
drop
‐
down.
Enter
a
Name
,
and
select
the
Shared
check
box.
In
the
Risk
column,
select
levels
3
,
4
,
and
5
.
In
the
Technology
column,
select
peer-to-peer
.
Click
OK
to
save
the
new
filter.
e.
In
the
Service/URL Category
tab,
URL
Category
section,
click
Add
and
select
the
categories
you
want
to
block
(for
example,
streaming-media
,
dating
,
and
online-personal-storage
).
f.
You
can
also
attach
the
default
URL
filtering
profile—In
the
Actions
tab,
Profile
Setting
section,
select
the
Profile Type
option
Profiles
,
and
select
the
URL Filtering
option
default
.
g.
Click
OK
to
save
the
security
pre
‐
rule.
Use
Device
Groups
to
Push
Policies
(Continued)
