TMAegisBeta
de
Weitere Regeln für paloalto

Palo Alto Networks

TMA-PALOALTO-1.6.3

Ensure that the Certificate Securing Remote Access VPNs is Valid

MittelStufe 2Manuelle Prüfungpaloalto

Beschreibung

The Certificate used to secure Remote Access VPNs should satisfy the following criteria: It should be a valid certificate from a trusted source. In almost cases this means a trusted Public Certificate Authority, as in most cases remote access VPN users will not have access to any Private Certificate Authorities for Certificate validation. The certificate should have a valid date. It should not have a "to" date in the past (it should not be expired), and should not have a "from" date in the future. The key length used to encrypt the certificate should be 2048 bits or more. The hash used to sign the certificate should be SHA-2 or better.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

Verify that the certificate being used to secure the VPN meets the criteria listed above: Navigate to Device > Certificate Management > Certificates Ensure that a valid certificate is applied to the HTTPS portal: Navigate to Network > GlobalProtect > Portals > Portal Configuration > (Select the Portal being assessed) > Authentication > SSL/TLS Profile Ensure that a valid certificate is applied to the GlobalProtect Gateway: Navigate to Network > GlobalProtect > Gateways > (Select the Gateway being Assessed) > Authentication > SSL/TLS Service Profile Ensure that ... (Full steps: CIS 1.6.3.)

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Create a CSR and install a certificate from a public CA (Certificate Authority) here: Navigate to Device > Certificate Management > Certificates Apply a valid certificate to the HTTPS portal: Navigate to Network > GlobalProtect > Portals > Portal Configuration > Authentication > SSL/TLS Profile Apply a valid certificate to the GlobalProtect Gateway: Navigate to Network > GlobalProtect > Gateways > Authentication > SSL/TLS Service Profile Configure the Service Profile to use the correct certificate Ensure that the Minimum TLS version is set to 1.1 or 1.2 (1.2 is recommended).

Eigenschaften

Betriebssysteme
Beliebig
Tags
paloaltocrypto
Referenz
CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.6.3 Ensure that the Certificate Securing Remote Access VPNs is Valid