🚫 “Allow Any Any” is not the real problem.

Not knowing why traffic is allowed is.

In many enterprise firewalls, I still see rules like:
➡️ Source: Any
➡️ Destination: Any
➡️ Service: Any
And surprisingly, the firewall isn’t the issue here.
The real issue is lack of traffic intent.

As an architect, I ask only 3 questions before approving any rule:
1️⃣ Which zone → which zone?
If zones are vague, security is already weak.

2️⃣ What is the exact application or business flow?
“Internet access” is not a flow.
“O365 outbound via proxy” is.

3️⃣ Is this rule temporary or permanent?
Temporary rules without expiry become permanent risks.

🔐 On Palo Alto firewalls, the power is not in the rule count —
it’s in App-ID + Zones + Logging.

👉 If you can clearly explain why a rule exists,
you’re thinking like an architect — not just configuring like an engineer.