Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured

높음레벨 1자동paloalto

설명

Configure SSL Forward Proxy for all traffic destined to the Internet. In most organizations, including all categories except financial-services, government and health-and-medicine is recommended. PASS requires a decryption rule of type ssl-forward-proxy; confirm it covers internal sources to the untrusted zone with the documented category exclusions. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

점검 방법

감사 방식: 구성 패턴

패턴: (?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase decryption rules (?:"[^"\n]*"|\S+) type ssl-forward-proxy\b

조치 방법

조치 방식: 가이드 또는 인프라 패치

configure set rulebase decryption rules outbound-decrypt from trust to untrust source any destination any category any action decrypt type ssl-forward-proxy commit # CIS guidance: Navigate to Policies > Decryption. Create a Policy for all traffic destined to the Internet. This Policy should include: Source tab: The Source Zone and/or Source Address should include all target internal networks. Source User should include all target internal users Destination tab: The Destination Zone should include the untrusted target zone (usually the internet). Destination Address is typically Any for an internet destination. Service/URL Category tab: all URL Category entries should be included except financial-services, government and health-and-medicine (this list may vary depending on your organization and its policies). Options tab: Type set to SSL Forward Proxy

속성

운영 체제: 모두
태그: paloaltocrypto
참고 자료: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 8.1 Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target paloalto