topic Re: Switching to Autonomous Policy from Custom in Firewall & Security Management

Switching to Autonomous Policy from Custom

Tony_Graham — Wed, 07 Dec 2022 20:16:42 GMT

All,

We have been running Custom Polices for IPS and Threat Prevention since it was first introduced. Now that Autonomous 'curated' policies are available, we would like to investigate that. What is the path to move from Custom Policies to Autonomous. When one is enabled is the other disabled or do existing policies need to be removed and then Autonomous enabled? Also are there any 'gotchas' where certain blades are required where we may not have licenses when using Autonomous policies.

Thanks.

Re: Switching to Autonomous Policy from Custom

PhoneBoy — Wed, 07 Dec 2022 20:46:12 GMT

I don't believe your existing configuration needs to be removed, Autonomous Threat Prevention simply needs to be enabled in the relevant gateway object(s).
Note that the "perimeter" setting in ATP is roughly equivalent to the Optimized policy.

In terms of licensing, ATP will use the licenses you have.

Re: Switching to Autonomous Policy from Custom

Tony_Graham — Wed, 07 Dec 2022 20:55:15 GMT

Excellent,

Thanks Dameon.

Re: Switching to Autonomous Policy from Custom

Timothy_Hall — Wed, 07 Dec 2022 23:05:07 GMT

When ATP is enabled, all your Custom configurations (profiles, policies, etc.) will still be there and available if you switch ATP back off. The biggest thing for enabling ATP is to make sure all your exceptions are GLOBAL and not attached to rules as the latter will suddenly stop working when ATP is enabled which can be a rude shock.

Here are the pages from my IPS/AV/ABOT Immersion class covering this tip and some other gotchas, only update to this would be the new SK covering how to customize UserChecks while ATP is enabled: sk178764: How to use a custom UserCheck object for Threat Extraction in the Autonomous Threat Prevention policy

Re: Switching to Autonomous Policy from Custom

Tony_Graham — Thu, 08 Dec 2022 21:48:52 GMT

Thanks Tim.