Ensure 'SSL Forward Proxy Policy' for traffic destined to the Internet is configured

Cách kiểm tra

Phương pháp kiểm tra: Mẫu cấu hình

Mẫu khớp

(?m)^set (?:shared |vsys \S+ |device-group \S+ |template \S+ config (?:shared |vsys \S+ )?)?rulebase decryption rules (?:"[^"\n]*"|\S+) type ssl-forward-proxy\b

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

configure set rulebase decryption rules outbound-decrypt from trust to untrust source any destination any category any action decrypt type ssl-forward-proxy commit # CIS guidance: Navigate to Policies > Decryption. Create a Policy for all traffic destined to the Internet. This Policy should include: Source tab: The Source Zone and/or Source Address should include all target internal networks. Source User should include all target internal users Destination tab: The Destination Zone should include the untrusted target zone (usually the internet). Destination Address is typically Any for an internet destination. Service/URL Category tab: all URL Category entries should be included except financial-services, government and health-and-medicine (this list may vary depending on your organization and its policies). Options tab: Type set to SSL Forward Proxy

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target paloalto