Ensure that a Zone Protection Profile with an enabled SYN Flood Action of SYN Cookies is attached to all untrusted zones

보통레벨 1자동paloalto

설명

Enable the SYN Flood Action of SYN Cookies for all untrusted zones. The Alert, Activate, and Maximum settings for SYN Flood Protection depend highly on the environment and device used. Perform traffic analysis on the specific environment and firewall to determine accurate thresholds. Do not rely on default values to be appropriate for an environment. Setting these values for all interfaces is an approach that should be considered by many organizations, as traffic floods can result from internal testing or malware as well. As a rough ballpark for most environments, an Activate value of 50% of the firewall's maximum "New sessions per second"/CPS is a conservative setting. PASS requires a zone protection profile with tcp-syn syn-cookies and at least one zone using a zone protection profile; confirm every untrusted zone has it. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)(?:^set (?:template \S+ config )?network profiles zone-protection-profile (?:"[^"\n]*"|\S+) flood tcp-syn syn-cookies \S(?s:.*?)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?zone (?:"[^"\n]*"|\S+) network zone-protection-profile \S+|^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?zone (?:"[^"\n]*"|\S+) network zone-protection-profile \S+(?s:.*?)^set (?:template \S+ config )?network profiles zone-protection-profile (?:"[^"\n]*"|\S+) flood tcp-syn syn-cookies \S)

조치 방법

조치 방식: 가이드 또는 인프라 패치

configure set network profiles zone-protection-profile ZPP flood tcp-syn enable yes set network profiles zone-protection-profile ZPP flood tcp-syn syn-cookies alarm-rate 20000 activate-rate 25000 maximal-rate 1000000 set zone <untrust> network zone-protection-profile ZPP commit # CIS guidance: From GUI: Navigate to Network > Network Profiles > Zone Protection > Zone Protection Profile > Flood Protection tab. Check the SYN box. Set the Action dropdown to SYN Cookies Set Alert to 20000 (or appropriate for org). Set Activate to 25000 (50% of maximum for firewall model). Set Maximum to 1000000 (or appropriate for org) Navigate to Network > Zones. Open the zone facing any untrusted network, if one does not exist create it. Set Zone Protection to the Zone Protection Profile created.

속성

운영 체제: 모두
태그: paloaltofirewall-policy
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 6.15 Ensure that a Zone Protection Profile with an enabled SYN Flood Action of SYN Cookies is attached to all untrusted zones

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target paloalto