Detections
Analytics

PANW-AG-000107 - The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.

Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and Web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate.

Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following:
Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application.
Pre-defined service 'service-http' and 'service-https' - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports.
Any - Use this service to deny applications.
Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To create or edit a Security Policy,
Go to Policies >> Security
Select 'Add' to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting 'Commit' in the upper-right corner of the screen.
Select 'OK' when the confirmation dialog appears.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PAN_Y22M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002403, Rule-ID|SV-228862r557387_rule, STIG-ID|PANW-AG-000107, STIG-Legacy|SV-77095, STIG-Legacy|V-62605, Vuln-ID|V-228862

Plugin: Palo_Alto

Control ID: b15fff0f5fa8866bb3419c0d98dae4473857ef48496817da322bd1e4084565dc