! PermitANY — Palo Alto Security Zones & Policies
! Zone-based security policy configuration for Palo Alto firewalls: zones, Layer 3 interfaces, address objects, and security rules with App-ID and User-ID.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# Palo Alto Security Zones & Policies
# PA-FW-01 — vsys1
#
# Address Objects

set {{../vsys}} address Corp-LAN ip-netmask 192.168.0.0/16
set {{../vsys}} address Corp-LAN description "Corporate LAN"

#
# Interfaces

set network interface ethernet ethernet1/1 layer3 ip 192.168.1.1/24
set network interface ethernet ethernet1/1 comment "LAN interface"

set network interface ethernet ethernet1/1 layer3 interface-management-profile allow-ping


#
# Virtual Router

set network virtual-router default interface ethernet1/1

#
# Zones

set {{../vsys}} zone trust network layer3
{{#each ../interfaces}}
set {{../../vsys}} zone {{../name}} network layer3 trust



{{/each}}
#
# Security Rules

set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" from trust
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" to untrust
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" source Corp-LAN
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" destination any
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" application [web-browsing ssl]
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" service application-default
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" action allow
set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" log-end yes


set {{../vsys}} rulebase security rules "Allow-LAN-to-Internet" profile-setting group strict-profiles


#
commit