sample_paloalto.pol

################
### RULEBASE ###
################

# NOTE: makes sure zone names correspond to those specified in your firewall setup

header {
  target:: paloalto from-zone internal to-zone external
}

term ping-gdns {
  source-address:: INTERNAL
  destination-address:: GOOGLE_DNS
  protocol:: icmp
  action:: accept
}

term dns-gdns {
  source-address:: INTERNAL
  destination-address:: GOOGLE_DNS
  destination-port:: DNS
  protocol:: tcp
  action:: accept
}

term allow-web-outbound {
  source-address:: INTERNAL
  destination-port:: WEB_SERVICES
  protocol:: tcp
  action:: accept
}

header {
  target:: paloalto from-zone external to-zone internal
}

term allow-icmp {
  protocol:: icmp
  action:: accept
}

# pan-application only: service application-default
term allow-pan-app-01 {
  pan-application:: web-browsing
  action:: accept
}

# pan-application + tcp: service any-tcp
term allow-pan-app-02 {
  pan-application:: web-browsing
  protocol:: tcp
  action:: accept
}

# pan-application + ports: service custom service objects
term allow-pan-app-03 {
  pan-application:: ssl
  protocol:: tcp
  destination-port:: HTTPS IMAPS
  action:: accept
}