You are configuring a Palo Alto Networks firewall for an organization. The goal is to allow inbound traffic from a trusted partner's IP range…

The configuration of a firewall to meet these requirements is based on the principle of least privilege, which dictates that only the minimum necessary access should be granted. First, a specific security rule must be created to explicitly permit the desired traffic from the trusted partner (192.168.10.0/24) to the web server on port 443. This directly addresses the "allow" requirement. Second, to ensure all other untrusted traffic is blocked, a "deny-all" rule should be configured. While Palo Alto Networks firewalls have a default inter-zone deny rule, creating an explicit deny rule is a security best practice for clarity, control, and logging purposes. This rule would be placed after the specific allow rule in the policy list.

A. This is incorrect because it allows traffic on the wrong port (80 instead of 443) and from an overly permissive source ("all external IP addresses"), violating the principle of least privilege.
D. SSL decryption is a feature for inspecting encrypted traffic content for threats, not for controlling access based on source IP and port. It is not a primary action for this access control scenario.
E. Network Address Translation (NAT) is used for IP address translation, which is a separate function from security policy rules that allow or deny traffic. While likely necessary, it does not fulfill the access control requirement.

1. Palo Alto Networks. (2021). PAN-OS® Administrator’s Guide Version 10.1.

Reference for B: In the "Security Policy" section, the guide details the creation of security policy rules. It states, "A security policy rule is a set of criteria that the firewall matches against network traffic... The criteria include the traffic’s source and destination zone, source and destination address, application, service, and user." This supports creating a specific rule to allow traffic from 192.168.10.0/24 on port 443.

Reference for C: The guide explains that rules are evaluated in order from top to bottom. It also describes the two predefined default security rules at the bottom of the rulebase, including the interzone-default rule which has a default action of deny. Creating an explicit deny rule before this default rule is a standard best practice to log and manage denied traffic effectively.

2. Scarfone, K., & Hoffman, P. (2009). NIST Special Publication 800-41 Revision 1: Guidelines on Firewalls and Firewall Policy. National Institute of Standards and Technology.

Reference for C: Section 3.2, "Firewall Policies," states: "A firewall policy should be based on a more restrictive, 'default deny' stance... This means that the firewall will block all traffic, and only specifically allowed traffic... will be permitted to pass." This foundational principle supports the combination of a specific allow rule (B) and a default deny rule (C).

3. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Communications of the ACM, 18(7), 38-42.

Reference for B & C: This seminal paper introduces the principle of "least privilege" (Design Principles, Section I.A.3). The principle states that every program and every user of the system should operate using the least set of privileges necessary to complete the job. Applying this to firewalls means creating specific allow rules for necessary traffic (B) and denying everything else (C). (DOI: https://doi.org/10.1145/361011.361062)