Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist

AltaNível 1Revisão manualpaloalto

Descrição

Create security policies specifying application-default for the Service setting, in addition to the specific ports desired. The Service setting of any should not be used for any policies that allow traffic.

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

Policies > Security: for every rule with action allow, confirm Service is application-default or specific service objects, never any. CLI: show rulebase security rules | match "service any" and check that each hit is a deny rule.

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Navigate to Policies > Security. For each exposed host, set a Security Policy exists with: Source tab: Zone set to OUTSIDE Address set to any Destination tab: Zone set to DMZ / Address set to <DMZ Host Object> Application tab: Application set to web-browsing (or appropriate application) Service tab: Service set to application-default. The value of any should never be used

Propriedades

Sistemas operacionais: Qualquer
Tags: paloaltofirewall-policy
Referência: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 7.2 Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist