©
Palo
Alto
Networks,
Inc.
Panorama
6.1
Administrator’s
Guide
•
105
Manage
Firewalls
Use
Case:
Configure
Firewalls
Using
Panorama
4.
Allow
for
all
users
in
the
marketing
group
in
the
regional
offices
only.
To
enable
security
policy
based
on
user
and/or
group,
you
must
enable
User
‐
ID
for
each
zone
that
contains
users
you
want
to
identify.
You
must
have
set
up
User
Identification
on
the
firewall
(refer
to
the
)
and
have
defined
a
master
firewall
for
the
Device
Group.
The
master
firewall
is
the
only
firewall
in
the
Device
Group
that
gathers
user
and
group
mapping
information
for
policy
evaluation.
a.
Select
the
Policies
tab
and,
in
the
Device Group
drop
‐
down,
select
DG_BranchAndRegional.
b.
Select
the
Security > Pre-Rules
policies
rulebase.
c.
Click
Add
and
enter
a
Name
for
the
security
policy
rule.
d.
In
the
User
tab,
select
Select
,
click
Add
and,
in
the
Source
User
section,
select
the
marketing
user
group.
e.
In
the
Application
tab,
click
Add
,
type
,
and
then
select
it
from
the
drop
‐
down.
f.
In
the
Action
tab,
set
the
Action
to
Allow
.
g.
In
the
Target
tab,
select
the
regional
office
firewalls
and
click
OK
.
5.
Allow
access
to
the
Amazon
cloud
application
for
the
specified
hosts/servers
in
the
datacenter.
a.
Create
an
address
group
object
for
the
servers/hosts
in
the
datacenter
that
need
access
to
the
Amazon
cloud
application.
–
Select
the
Objects
tab
and,
in
the
Device Group
drop
‐
down,
select
DG_DataCenter.
–
Select
Address Groups
.
–
Click
Add
and
enter
a
Name
for
the
address
group
object.
–
Click
Add
and
select
New Address
.
–
To
define
the
address
object,
enter
a
Name
,
select
the
Type
,
and
specify
a
host
IP
address,
IP
Netmask,
IP
range,
or
FQDN.
Click
OK
.
b.
Select
the
Policies
tab
and,
in
the
Device Group
drop
‐
down,
select
DG_DataCenter.
–
Select
the
Security > Pre-Rules
policies
rulebase.
–
Click
Add
and
enter
a
Name
for
the
security
policy
rule.
–
In
the
Source
tab,
Source
Address
section,
click
Add
and
select
the
address
group
you
just
defined.
–
In
the
Application
tab,
click
Add
,
type
amazon
,
and
select
the
Amazon
applications
from
the
list.
–
In
the
Action
tab,
set
the
Action
to
Allow
.
–
Click
OK
.
6.
To
enable
logging
for
all
Internet
‐
bound
traffic
on
your
network,
create
a
rule
that
matches
trust
zone
to
untrust
zone.
a.
Select
the
Policies
tab
and,
in
the
Device Group
drop
‐
down,
select
Shared
.
b.
Select
the
Security > Pre-Rules
policies
rulebase.
c.
Click
Add
and
enter
a
Name
for
the
security
policy
rule.
d.
In
the
Source
and
Destination
tabs
for
the
rule,
click
Add
and
select
trust_zone
as
the
Source
Zone
and
untrust_zone
as
the
Destination
Zone.
e.
In
the
Action
tab,
set
the
Action
to
Deny
,
set
the
Log Setting
to
Log at Session end
,
and
click
OK
.
Use
Device
Groups
to
Push
Policies
(Continued)
