Palo Alto Networks
TMA-PALOALTO-1.7.1
Enabling Post-Quantum (PQ) on IKEv2 VPNs
Descrição
For VPN that has IKEv2 enabled, enable PQ for more secure way to exchange pre- shared secret to defend against "Harvest Now, Decrypt Later" attack technique.
Como é verificado
Método de auditoria: Revisão manual
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Verify that Enable Post-Quantum Pre-Shared Key (PPK) is checked. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. (Full steps: CIS 1.7.1.)
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Check Enable Post-Quantum Pre-Shared Key (PPK) option. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. If both sides of VPN supports more than 1 PPK key ID, then multiple PPK key ID should be configured. Configuring multiple PQ PPKs is most secure because it adds a random element to PQ PPK selection.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- paloaltohardening
- Referência
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.7.1 Enabling Post-Quantum (PQ) on IKEv2 VPNs