Palo Alto Networks
TMA-PALOALTO-1.7.1
Enabling Post-Quantum (PQ) on IKEv2 VPNs
Опис
For VPN that has IKEv2 enabled, enable PQ for more secure way to exchange pre- shared secret to defend against "Harvest Now, Decrypt Later" attack technique.
Како се проверава
Метод провере: Ручни преглед
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Verify that Enable Post-Quantum Pre-Shared Key (PPK) is checked. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. (Full steps: CIS 1.7.1.)
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
Navigate to Network > Network Profiles > IKE Gateways. On gateways that has IKEv2 enabled, click into it and navigate to Advanced Options. On IKEv2 section, navigate to PQ PPK section. Check Enable Post-Quantum Pre-Shared Key (PPK) option. Negotiation mode should be set to Mandatory if both sides of VPN supports PQ. Negotiation mode should be set to Preferred if you don't know or don't have control over whether the peer supports RFC 8784. Preferred mode preserves backward compatibility to ensure connections fall back instead of dropping. If both sides of VPN supports more than 1 PPK key ID, then multiple PPK key ID should be configured. Configuring multiple PQ PPKs is most secure because it adds a random element to PQ PPK selection.
Својства
- Оперативни системи
- Било који
- Ознаке
- paloaltohardening
- Референца
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.7.1 Enabling Post-Quantum (PQ) on IKEv2 VPNs