Palo Alto Networks Certified Network Security Administrator (PCNSA)Security Policy ConfigurationEasy
A network administrator is configuring a new security policy rule on a Palo Alto Networks firewall. The requirement is to allow internal users to access a newly deployed internal web server, but only from specific source IP addresses within the internal network. Which of the following elements should be configured in the security policy rule to meet this requirement?
- ASource User, Source Zone, Destination Zone, Application, Service, Action
- BSource Zone, Destination Zone, Application, Service, Action
- CSource Zone, Source Address, Destination Zone, Destination Address, Application, Service, Action
- DSource Zone, Source Address, Destination Zone, Service, Action
Show answer & explanationAnswer & explanation
Correct answer: C. Source Zone, Source Address, Destination Zone, Destination Address, Application, Service, Action
To allow access from specific source IP addresses, the 'Source Address' field must be populated with those addresses. The other options either omit this critical field or include unnecessary ones for the specified requirement.
Why the other options are wrong
- A. This option includes 'Source User' which is not required for an IP-based restriction and omits 'Source Address'.
- B. This option omits the 'Source Address' field, which is essential for restricting access to specific source IPs.
- D. This option omits 'Application' and does not specify 'Destination Address' as a distinct element, making it incomplete for the requirement.
Security Policy Rule Elements
A security policy rule defines how traffic is handled by the firewall, based on various criteria such as source, destination, application, and service.
- Rules are processed top-down.
- Each rule has a name, source, destination, application, service, and action.
- Zones, addresses, users, and applications are key identification criteria.
Memory trick: Rules Direct Traffic: Source, Destination, What, How.