The Palo Alto Networks security platform must only allow incoming communications from organization-defined authorized sources forwarded to organization-defined authorized destinations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-228862	PANW-AG-000107	SV-228862r997601_rule		Medium

Description
Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate. Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following: Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application. Pre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports. Any - Use this service to deny applications. Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.

Description

Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources. Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate. Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following: Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application. Pre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports. Any - Use this service to deny applications. Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.

STIG	Date
Palo Alto Networks ALG Security Technical Implementation Guide	2024-06-17

Details

Check Text ( C-31097r997599_chk )
Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification or Accreditation Package. Go to Policies >> Security; review each of the configured security policies in turn. If any of the policies allows traffic that is not part of the authorized sources and destinations list, this is a finding.

Fix Text (F-31074r997600_fix)
To create or edit a Security Policy: Go to Policies >> Security. Select "Add" to create a new security policy, or select the name of the security policy to edit it. Configure the specific parameters of the policy by completing the required information in the fields of each tab. Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

Fix Text (F-31074r997600_fix)

To create or edit a Security Policy:
Go to Policies >> Security.
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.