Ensure that security policies restrict User-ID Agent traffic from crossing into untrusted zones

СреднийУровень 1Ручная проверкаpaloalto

Описание

Create security policies to deny Palo Alto User-ID traffic originating from the interface configured for the UID Agent service that are destined to any untrusted zone.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Navigate to Device > Setup > Services > Services Features > Service Route Configuration > Customize. Click on the protocol in use (IPv4 and/or IPv6). Click UID Agent. Click on the address object for the UID Agent's IP address. Verify SOURCE/NAME is set to 'Deny msrpc to untrusted'. Verify SOURCE/ZONE is set to 'INSIDE'. Verify SOURCE/Address is set to the Address object for the UID Agent. Verify DESTINATION/ZONE is set to 'GUEST' and 'OUTSIDE'. Verify DESTINATION/Address is set to 'any'. Verify DESTINATION/Application is set to 'msrpc'. (Full steps: CIS 2.8.)

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

Navigate to Device > Setup > Services > Services Features > Service Route Configuration > Customize. Click on the protocol in use (IPv4 and/or IPv6). Click UID Agent. Click on the address object for the UID Agent's IP address. Set SOURCE/NAME to 'Deny msrpc to untrusted'. Set SOURCE/ZONE to 'INSIDE'. Set SOURCE/Address to the Address object for the UID Agent. Set DESTINATION/ZONE to 'GUEST' and 'OUTSIDE'. Set DESTINATION/Address to 'any'. Set DESTINATION/Application to 'msrpc'. Set DESTINATION/Service to 'application-default'. Set DESTINATION/Action to 'Block' (red circle with diagonal line).

Свойства

Операционные системы: Любая
Теги: paloaltoauthentication
Источник: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 2.8 Ensure that security policies restrict User-ID Agent traffic from crossing into untrusted zones