Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist

高级别 1人工审核paloalto

说明

Create security policies specifying application-default for the Service setting, in addition to the specific ports desired. The Service setting of any should not be used for any policies that allow traffic.

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

Policies > Security: for every rule with action allow, confirm Service is application-default or specific service objects, never any. CLI: show rulebase security rules | match "service any" and check that each hit is a deny rule.

修复方式

修复方法: 操作指南或基础设施补丁

Navigate to Policies > Security. For each exposed host, set a Security Policy exists with: Source tab: Zone set to OUTSIDE Address set to any Destination tab: Zone set to DMZ / Address set to <DMZ Host Object> Application tab: Application set to web-browsing (or appropriate application) Service tab: Service set to application-default. The value of any should never be used

属性

操作系统: 任意
标签: paloaltofirewall-policy
参考: CIS Palo Alto Firewall 11 Benchmark v1.2.0 - 7.2 Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist