How to narrow the scope of a Threat Exception using cloned Security Policy rules and Security Profiles

• Palo Alto Firewall
• PAN-OS

1. Identify the existing Security Policy rule and associated Security Profile you want to apply the threat exception.

2. Clone the existing Security Policy rule. Rename the cloned Security Policy rule and placed right above the existing policy rule.

3. Narrow the scope of the cloned Security Policy rule to the traffic desired.

4. Clone and rename the associated Security Profile.

5. Create the desired Threat Exceptions to the cloned Security Profile.

6. Associate the cloned Security Profile to the cloned Security Policy rule.

7. Commit your changes.

Following these steps will allow the desired traffic to hit the new cloned policy rule and new Security Profile with the exception while the other traffic not in the scope will still hit the existing rule without the exception.

For more details, please see these additional articles on creating threat exceptions: 

How to Use Anti-Spyware, Vulnerability and Antivirus Exceptions to Block or Allow Threats

Create Threat Exceptions