The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-62571	PANW-AG-000050	SV-77061r1_rule		Medium

Description
A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. Enclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave. Configure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave. The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.

Description

A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken. Enclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave. Configure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave. The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.

STIG	Date
Palo Alto Networks ALG Security Technical Implementation Guide	2015-11-17

Details

Check Text ( C-63375r1_chk )
Obtain the list of IP address prefixes assigned to the enclave by the DoD Network Information Center. Since there are likely to be many configured policies, ask the Administrator which security policy is the anti-spoof policy. If there is none, this is a finding. Go to Policies >> Security View the list of configured security policies. Select the policy identified as the anti-spoof policy. In the "Source" tab; if the Source Addresses for the internal zone do not match the IP address prefixes assigned to the enclave by the DoD Network Information Center, this is a finding.

Check Text ( C-63375r1_chk )

Obtain the list of IP address prefixes assigned to the enclave by the DoD Network Information Center.
Since there are likely to be many configured policies, ask the Administrator which security policy is the anti-spoof policy.
If there is none, this is a finding.

Go to Policies >> Security
View the list of configured security policies.
Select the policy identified as the anti-spoof policy.
In the "Source" tab; if the Source Addresses for the internal zone do not match the IP address prefixes assigned to the enclave by the DoD Network Information Center, this is a finding.

Fix Text (F-68491r2_fix)
Go to Policies >> Security Select "Add". In the "Security Policy Rule" window, complete the required fields. In the "Name" tab, complete the "Name" and "Description" fields. In the "Source" tab, complete the "Source Zone" and "Source Address" fields. Use the internal zone and the IP address prefix for that zone. Note: There may be more than one internal zone, so multiple policies may be necessary. In the "User" tab, leave the default settings. In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. Use the "external zone" and "Any" for the "Destination Address" field. Note: There may be more than one internal zone, so multiple policies may be necessary. In the "Applications" tab, select the "Any" check box. In the "Service/URL Category" tab, select "Any" for both service and URL Category. In the "Actions" tab, select allow as the resulting action. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

Fix Text (F-68491r2_fix)

Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields. Use the internal zone and the IP address prefix for that zone.

Note: There may be more than one internal zone, so multiple policies may be necessary.

In the "User" tab, leave the default settings.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. Use the "external zone" and "Any" for the "Destination Address" field.
Note: There may be more than one internal zone, so multiple policies may be necessary.
In the "Applications" tab, select the "Any" check box.
In the "Service/URL Category" tab, select "Any" for both service and URL Category.
In the "Actions" tab, select allow as the resulting action.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.