Security profiles: file blocking, data filtering and profile groups

Calder's security policy lets depot users browse the intranet and the internet, but allowing an application isn't the same as trusting what it carries. Content-ID inspects allowed traffic through security profiles attached to allow rules. The security team asks for:

1. No Windows executables or DLLs downloaded by depot users, from anywhere.
2. A log entry (but no block) whenever someone downloads a PDF.
3. Calder project codes (CLB-SECRET- plus four digits) must never leave web01 in a file.
4. The threat profiles (antivirus, anti-spyware, vulnerability protection, WildFire) attached everywhere, ready for when the subscriptions are bought.

What this lab firewall can show. Antivirus, anti-spyware, vulnerability protection, WildFire and URL categories need a subscription and content updates. This lab firewall has none, so those profiles can be configured and attached, but they have no signatures to match. File blocking and data filtering are part of PAN-OS itself and work fully here. Check what you have with show system info | match version.

Before you start. Start all the nodes. The firewall takes 6-8 minutes to boot and comes up with this lab's starting configuration already loaded. Wait until the FW1 console shows FW1 login:, then log in as admin / Lab-Access-1. Until the management plane is ready it answers Login incorrect, even with the right password. The Linux hosts are ready within seconds.