Ensure 'Verify Update Server Identity' is enabled

VisokaNivo 1Automatskapaloalto

Opis

This setting determines whether or not the identity of the update server must be verified before performing an update session. Note that if an SSL Forward Proxy is configured to intercept the update session, this option may need to be disabled (because the SSL Certificate will not match). PASS requires deviceconfig system server-verification yes. Audited against the PAN-OS running configuration in set format: run 'set cli config-output-format set', then 'configure' and 'show' (or 'show config running') and save the full output.

Kako se proverava

Metod provere: Obrazac konfiguracije

Obrazac: (?m)^set (?:template \S+ config )?deviceconfig system server-verification yes[ \t]*$

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

configure set deviceconfig system server-verification yes commit # CIS guidance: Navigate to Device > Setup > Services > Services. Set the Verify Update Server Identity box to checked.

Svojstva

Operativni sistemi: Bilo koji
Oznake: paloaltoupdates
Referenca: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 1.6.1 Ensure 'Verify Update Server Identity' is enabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target paloalto