Palo Alto Networks
TMA-PALOALTO-2.1
Ensure that IP addresses are mapped to usernames
Опис
Configure appropriate settings to map IP addresses to usernames. Mapping userids to IP addresses is what permits the firewall to create rules based on userids and groups rather than IP addresses and subnets, as well as log events by userids rather than IP addresses or DNS names. The specifics of how to achieve IP-to-username mapping is highly dependent on the environment. It can be enabled by integrating the firewall with a domain controller, Exchange server, captive portal, Terminal Server, User-ID Agent, XML API, or syslog data from a variety of devices. PASS requires at least one zone with enable-user-identification yes (the PDF also checks that trusted-zone traffic logs show Source User). Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.
Како се проверава
Метод провере: Образац конфигурације
- Образац
(?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?zone (?:"[^"\n]*"|\S+) enable-user-identification yes[ \t]*$
Како се исправља
Метод исправке: Смерница или закрпа инфраструктуре
configure set zone <trusted-zone> enable-user-identification yes commit # CIS guidance: To Set User-ID Agents: Navigate to Device > User Identification > User-ID Agents Set the Name, IP Address and Port of the User-ID Agent' Enable User Identification for each monitored zone that will have user accounts: Navigate to Network > Zone, for each relevant zone enable User Identification To Set Terminal Services Agents: Navigate to Device > Terminal Services Agents Set the Name, IP Address and Port of the Terminal Services Agent Enable User Identification for each monitored zone that will have Terminal Servers: Navigate to Network > Zone, enable User Identification
Својства
- Оперативни системи
- Било који
- Ознаке
- paloaltoauthentication
- Референца
- CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 2.1 Ensure that IP addresses are mapped to usernames
Проверите овај рачунар
Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.
tmaegis scan --target paloalto --level 2