Palo Alto Firewall Auditing
Palo Alto Effective Access Analysis
Move beyond individual rule settings to understand the paths your firewall actually permits.
Map
Build a zone-to-zone view of permitted and blocked traffic.
Trace
Account for rule order, objects, NAT and Panorama policy.
Validate
Confirm important paths against the effective configuration and context.
A firewall rule tells you what a rule is intended to permit.
Effective access asks a different question:
What can actually communicate with what?
This distinction is one of the most important concepts in a firewall audit.
Build a zone relationship model
Start by identifying the security zones and determining which zone pairs can communicate.
For each source and destination zone pair, determine whether access is:
- allowed
- blocked
- conditionally allowed
- unrestricted
The resulting matrix provides a high-level view of the firewall's segmentation model.
Why rule-by-rule review is insufficient
Effective access depends on more than the text of a single rule.
Consider:
- rule evaluation order
- address objects
- address groups
- service objects
- application matching
- NAT
- schedules
- URL categories
- Policy Based Forwarding
- application overrides
- Panorama rule hierarchy
These can change the effective result.
NAT in particular deserves close attention — it changes where traffic goes, and inbound exposure should be traced from the NAT rule through to the security rule that ultimately permits it. Seeauditing Palo Alto security policies for the rule-level review this builds on.
Look for dangerous paths
Pay particular attention to:
- untrusted zones reaching internal networks
- guest access to sensitive zones
- broad internal access
- unexpected paths between server networks
- management networks reachable from general user networks
- paths that enable lateral movement
A path should be assessed against the organization's intended architecture.
A highly restrictive firewall is not automatically correct, and an open path is not automatically a finding. Context matters.
Panorama environments
When Panorama is involved, assess the effective configuration.
Consider:
- shared pre-rules
- device-group pre-rules
- local rules
- device-group post-rules
- shared post-rules
- inherited objects
- local overrides
Auditing Panorama alone shows intent.
Auditing only the local firewall may miss the source of that configuration.
The auditor needs to understand both.
Validate the result
Automation can make effective-access analysis practical, but automated results must be validated.
For important paths:
- Trace the path through the effective rule order.
- Confirm the relevant objects.
- Confirm the zone relationships.
- Confirm against live behaviour where appropriate and authorized.
- Consider organizational context.
The objective is a defensible audit finding, not merely a generated diagram.
Rampart's Effective Access analysis automates the mechanical work of calculating effective paths while leaving validation and judgement with the auditor.