Palo Alto Networks
TMA-PALOALTO-1.7.1
Enabling Post-Quantum (PQ) on IKEv2 VPNs
Description
For VPN that has IKEv2 enabled, enable PQ for more secure way to exchange pre- shared secret to defend against "Harvest Now, Decrypt Later" attack technique.
How it is checked
Audit method: Manual review
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Verify that Enable Post-Quantum Pre-Shared Key (PPK) is checked. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. (Full steps: CIS 1.7.1.)
How it is fixed
Fix method: Guidance or infrastructure patch
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Check Enable Post-Quantum Pre-Shared Key (PPK) option. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. If both sides of VPN supports more than 1 PPK key ID, then multiple PPK key ID should be configured. Configuring multiple PQ PPKs is most secure because it adds a random element to PQ PPK selection.
Properties
- Operating systems
- Any
- Tags
- paloaltohardening
- Reference
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.7.1 Enabling Post-Quantum (PQ) on IKEv2 VPNs