Allowing outbound internet traffic based on IP addresses, ports, or even App-ID alone is not enough to protect an enterprise network. Malicious files, drive-by downloads, command-and-control (C2) beacons, and phishing sites frequently hide inside standard HTTP and HTTPS sessions. To secure internet access, you must apply layer-7 content inspection to permitted traffic.<\/p>\n
This technical tutorial demonstrates how to configure and attach Palo Alto security profiles<\/strong> to internet access security policies. You will learn how individual security profiles function, how to group them efficiently using Security Profile Groups, and how to verify deep packet inspection in production.<\/p>\n Acme Corp has an active Security Policy rule allowing internal users in the The business requirement is to implement full content inspection without creating duplicate security rules. To achieve this, we will build custom security profiles for Antivirus, Anti-Spyware, Vulnerability Protection, URL Filtering, File Blocking, and WildFire. We will then combine these profiles into a single Security Profile Group and attach it to the existing internet access policy.<\/p>\n The following diagram outlines the enterprise topology used in this configuration guide:<\/p>\n The lab setup uses the following sample IP addresses, zones, and profile naming conventions. Adapt these values to match your enterprise naming standards.<\/p>\n Before applying security profiles to an active security policy, ensure the following requirements are met:<\/p>\n Applying threat inspection requires two main phases: creating or customizing individual security profiles, and attaching them to your security rules. Using Security Profile Groups simplifies management by allowing you to attach a single object to multiple rules.<\/p>\n Navigate to Navigate to Navigate to Navigate to Navigate to Navigate to Navigate to Combining individual profiles into a Security Profile Group prevents configuration administrative overhead and ensures consistency across multiple rules.<\/p>\n Now attach the completed group object to your existing internet outbound security policy rule.<\/p>\n Network engineers who prefer using the command-line interface can verify and review profile structures using operational commands.<\/p>\n To view the detailed contents of the newly configured Security Profile Group, run:<\/p>\n To inspect how profiles are attached to active security rules in the running configuration, use the following operational command:<\/p>\n To check threat engine status and ensure dynamic content signatures are loaded properly in system memory, run:<\/p>\n To monitor dynamic file submission status to the WildFire cloud via CLI, execute:<\/p>\n Understanding PAN-OS Single-Pass Parallel Processing (SP3) helps clarify how Palo Alto security profiles<\/strong> inspect traffic without adding high latency.<\/p>\n After committing your changes, perform real-world checks to confirm security enforcement is operating correctly.<\/p>\n From an internal client, attempt to download the standard synthetic EICAR test file over plain HTTP:<\/p>\n Expected Result:<\/em> The firewall blocks the download connection or returns an HTTP reset. In the web interface, navigate to Open a web browser on an internal host and navigate to a known test domain provided by Palo Alto Networks:<\/p>\n Expected Result:<\/em> The browser presents a Palo Alto Networks URL block page. Check Open When security profiles fail to inspect or block traffic as expected, review the following troubleshooting matrix:<\/p>\nReal-Life Scenario<\/h2>\n
Trust<\/code> zone to access the Untrust<\/code> zone using web-browsing<\/code> and ssl<\/code> applications. While traffic flows successfully, the security operations team has no threat visibility, content filtering, or file restrictions on these internet sessions.<\/p>\nLab Topology<\/h2>\n
\n+---------------------+ +----------------------------------+ +-------------------+\n| Internal Client | | Palo Alto Networks Firewall | | Internet Router |\n| 10.0.1.50\/24 |-----------| ethernet1\/2 ethernet1\/1 |-----------| 198.51.100.1 |\n| (Trust Zone) | | 10.0.1.1\/24 203.0.113.2\/24| | (Untrust Gateway)|\n+---------------------+ +----------------------------------+ +-------------------+\n |\n +-------------------+\n | Palo Alto Cloud \/ |\n | WildFire Cloud |\n +-------------------+\n<\/pre>\n
Example Addressing and Objects<\/h2>\n
\n\n
\n \nObject \/ Element<\/th>\n Name \/ Value<\/th>\n Description<\/th>\n<\/tr>\n<\/thead>\n \n Trust Interface<\/strong><\/td>\n ethernet1\/2<\/code> (10.0.1.1\/24)<\/td>\nInternal client gateway interface<\/td>\n<\/tr>\n \n Untrust Interface<\/strong><\/td>\n ethernet1\/1<\/code> (203.0.113.2\/24)<\/td>\nExternal egress interface to ISP router (198.51.100.1)<\/td>\n<\/tr>\n \n Client Host<\/strong><\/td>\n 10.0.1.50<\/code> (LAB_CLIENT)<\/td>\nInternal workstation generating outbound web traffic<\/td>\n<\/tr>\n \n Profile Group<\/strong><\/td>\n GRP-SEC-INTERNET-OUTBOUND<\/code><\/td>\nSecurity Profile Group container for internet access<\/td>\n<\/tr>\n \n URL Profile<\/strong><\/td>\n PROF-URL-INTERNET<\/code><\/td>\nCustom URL Filtering profile blocking dangerous categories<\/td>\n<\/tr>\n \n File Blocking Profile<\/strong><\/td>\n PROF-FB-INTERNET<\/code><\/td>\nCustom File Blocking profile restricting high-risk extensions<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n Prerequisites<\/h2>\n
\n
Device > Dynamic Updates<\/code>.<\/li>\nStep-by-Step GUI Configuration<\/h2>\n
Step 1: Review and Customize Individual Security Profiles<\/h3>\n
Objects > Security Profiles<\/code> in the web interface. While Palo Alto Networks supplies default profiles, customizing profiles for outbound internet access allows strict enforcement.<\/p>\n1. Antivirus Profile<\/h4>\n
Objects > Security Profiles > Antivirus<\/code>. Click Add<\/strong> to create a new profile named PROF-AV-INTERNET<\/code>.<\/p>\n\n
reset-both<\/code> or block<\/code> for viral signatures.<\/li>\n2. Anti-Spyware Profile<\/h4>\n
Objects > Security Profiles > Anti-Spyware<\/code>. Click Add<\/strong> to create PROF-AS-INTERNET<\/code>.<\/p>\n\n
reset-both<\/code>.<\/li>\nblock<\/code> or sinkhole<\/code>.<\/li>\n192.0.2.254<\/code>) to capture compromised host DNS queries.<\/li>\n<\/ul>\n3. Vulnerability Protection Profile<\/h4>\n
Objects > Security Profiles > Vulnerability Protection<\/code>. Click Add<\/strong> to create PROF-VP-INTERNET<\/code>.<\/p>\n\n
reset-both<\/code>.<\/li>\n<\/ul>\n4. URL Filtering Profile<\/h4>\n
Objects > Security Profiles > URL Filtering<\/code>. Click Add<\/strong> to create PROF-URL-INTERNET<\/code>.<\/p>\n\n
block<\/code>: malware<\/code>, phishing<\/code>, command-and-control<\/code>, command-and-control-agent<\/code>, and unknown<\/code>.<\/li>\nadult<\/code>, gambling<\/code>) to block<\/code> or continue<\/code> based on organizational policy.<\/li>\n5. File Blocking Profile<\/h4>\n
Objects > Security Profiles > File Blocking<\/code>. Click Add<\/strong> to create PROF-FB-INTERNET<\/code>.<\/p>\n\n
exe<\/code>, bat<\/code>, vbs<\/code>, dll<\/code>, hqx<\/code>, scr<\/code>) for upload<\/code> and download<\/code> directions. Set the action to block<\/code>.<\/li>\nencrypted-zip<\/code> or encrypted-rar<\/code>) by setting the action to continue<\/code> or block<\/code>.<\/li>\n<\/ul>\n6. WildFire Analysis Profile<\/h4>\n
Objects > Security Profiles > WildFire Analysis<\/code>. Click Add<\/strong> to create PROF-WF-INTERNET<\/code>.<\/p>\n\n
any<\/code>, Direction<\/strong> to both<\/code>, and Analysis<\/strong> to public-cloud<\/code>.<\/li>\n<\/ul>\nStep 2: Create a Security Profile Group<\/h3>\n
\n
Objects > Security Profile Groups<\/code>.<\/li>\nGRP-SEC-INTERNET-OUTBOUND<\/code>.<\/li>\n\n
PROF-AV-INTERNET<\/code><\/li>\nPROF-AS-INTERNET<\/code><\/li>\nPROF-VP-INTERNET<\/code><\/li>\nPROF-URL-INTERNET<\/code><\/li>\nPROF-FB-INTERNET<\/code><\/li>\nPROF-WF-INTERNET<\/code><\/li>\n<\/ul>\n<\/li>\nStep 3: Attach the Profile Group to the Security Policy<\/h3>\n
\n
Policies > Security<\/code>.<\/li>\nALLOW-TRUST-TO-UNTRUST<\/code>).<\/li>\nNone<\/code> (or Profiles<\/code>) to Group<\/code>.<\/li>\nGRP-SEC-INTERNET-OUTBOUND<\/code> from the Group Object<\/strong> drop-down list.<\/li>\nCLI Configuration and Verification Commands<\/h2>\n
admin@PA-FW> show profile-group GRP-SEC-INTERNET-OUTBOUND<\/code><\/pre>\nadmin@PA-FW> show running security-policy<\/code><\/pre>\nadmin@PA-FW> show system setting threat<\/code><\/pre>\nadmin@PA-FW> show wildfire status<\/code><\/pre>\nHow the Traffic Flows<\/h2>\n
\n
10.0.1.50<\/code> initiates an outbound HTTP\/HTTPS connection to an external site. The firewall checks ingress routing, zone evaluation, and matches the session against the security rule ALLOW-TRUST-TO-UNTRUST<\/code>.<\/li>\nweb-browsing<\/code> or ssl<\/code>).<\/li>\n\n
block<\/code> or reset<\/code>, the session is terminated immediately. A RST packet is sent to both client and server, or a custom block page is presented to the user. If all engines pass, the packet is forwarded to the gateway at 198.51.100.1<\/code>.<\/li>\n<\/ol>\nVerification<\/h2>\n
1. Testing Antivirus Profile Inspection<\/h3>\n
curl -I http:\/\/www.eicar.org\/download\/eicar.com<\/code><\/pre>\nMonitor > Logs > Threat<\/code> and verify a log entry for Eicar-Test-Signature<\/code> with an action of reset-both<\/code> or block<\/code>.<\/p>\n2. Testing URL Filtering Inspection<\/h3>\n
http:\/\/test-url.paloaltonetworks.com\/malware<\/code><\/pre>\nMonitor > Logs > URL Filtering<\/code> to confirm the entry shows category malware<\/code> and action block-url<\/code>.<\/p>\n3. Checking Log Details in the GUI<\/h3>\n
Monitor > Logs > Threat<\/code>. Click the magnifying glass icon next to a threat event to review session metadata, including:<\/p>\n\n
10.0.1.50<\/code>) and Destination IP.<\/li>\nALLOW-TRUST-TO-UNTRUST<\/code>).<\/li>\nTroubleshooting Profile Issues<\/h2>\n
\n\n
\n \nSymptom<\/th>\n Probable Root Cause<\/th>\n Recommended Action \/ Check<\/th>\n<\/tr>\n<\/thead>\n \n Threats inside HTTPS connections are ignored.<\/td>\n SSL Decryption is disabled or bypassed for that destination.<\/td>\n Verify SSL Forward Proxy policy under Policies > Decryption<\/code>. Ensure client trusts the enterprise CA certificate.<\/td>\n<\/tr>\n\n File blocking does not execute on renamed files (e.g., .exe<\/code> renamed to