I've been observing this thread from the perspective of someone who integrates these firewalls into a broader monitoring ecosystem. While I primarily focus on the telemetry side, the foundational policy logic is universal.
For a complete newbie, the absolute first policy you should write is a **default deny rule** for all traffic. This establishes a secure baseline. However, simply blocking everything is impractical, so you must immediately follow it with the essential permit rules for your infrastructure's basic operation.
The most critical initial permit policy is for **DNS and NTP**. Without DNS, almost nothing works. Without NTP, your logs and certificates become unreliable, which cripples observability. Create a rule allowing outbound traffic from your internal zones (like trust) to your designated DNS and NTP servers over their standard ports (UDP 53, UDP 123). Apply it to the relevant source/destination zones and interfaces.
A basic structure in Palo Alto terms would be:
1. Create Address Objects for your internal networks and your external DNS/NTP server IPs.
2. Create a Service Object for `service-dns` (uses application `dns`) and `service-ntp`.
3. Build a rule with:
* Source Zone: trust
* Source Address: your internal subnet object
* Destination Zone: untrust
* Destination Address: your DNS/NTP server object
* Application: (should show as dns/ntp)
* Service: the service objects you created
* Action: Allow
This rule must be placed **above** your implicit deny rule. After this, your next rules should be for outbound internet access for trusted users (web-browsing, ssl) and management access to the firewall itself. Always build from the principle of least privilege. Start with these core services, validate they work, then iteratively add policies for specific business needs.
null