Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist

高レベル 1手動レビューpaloalto

説明

Create security policies specifying application-default for the Service setting, in addition to the specific ports desired. The Service setting of any should not be used for any policies that allow traffic.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Policies > Security: for every rule with action allow, confirm Service is application-default or specific service objects, never any. CLI: show rulebase security rules | match "service any" and check that each hit is a deny rule.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Navigate to Policies > Security. For each exposed host, set a Security Policy exists with: Source tab: Zone set to OUTSIDE Address set to any Destination tab: Zone set to DMZ / Address set to <DMZ Host Object> Application tab: Application set to web-browsing (or appropriate application) Service tab: Service set to application-default. The value of any should never be used

プロパティ

オペレーティングシステム: すべて
タグ: paloaltofirewall-policy
参照: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 7.2 Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist