Ensure 'Verify Update Server Identity' is enabled

높음레벨 1자동paloalto

설명

This setting determines whether or not the identity of the update server must be verified before performing an update session. Note that if an SSL Forward Proxy is configured to intercept the update session, this option may need to be disabled (because the SSL Certificate will not match). PASS requires deviceconfig system server-verification yes. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^set (?:template \S+ config )?deviceconfig system server-verification yes[ \t]*$

조치 방법

조치 방식: 가이드 또는 인프라 패치

configure set deviceconfig system server-verification yes commit # CIS guidance: Navigate to Device > Setup > Services > Services. Set the Verify Update Server Identity box to checked.

속성

운영 체제: 모두
태그: paloaltoupdates
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.6.1 Ensure 'Verify Update Server Identity' is enabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target paloalto