Palo Alto Networks ALG Security Technical Implementation Guide

V1R4 2019-01-04       U_Palo_Alto_Networks_ALG_STIG_V1R4_Manual-xccdf.xml
V1R2 2016-06-30       U_Palo_Alto_Networks_ALG_STIG_V1R2_Manual-xccdf.xml
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DoD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via e-mail to the following address: [email protected]
Comparison
All 50
No Change 40
Updated 10
Added 0
Removed 0
V-62547 No Change
Findings ID: PANW-AG-000015 Rule ID: SV-77037r1_rule Severity: medium CCI: CCI-000067

Discussion

Automated monitoring of remote access traffic allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by inspecting connection activities of remote access capabilities.

Remote access methods include both unencrypted and encrypted traffic (e.g., web portals, web content filter, TLS, and webmail). With inbound TLS inspection, the traffic must be inspected prior to being allowed on the enclave's web servers hosting TLS or HTTPS applications. With outbound traffic inspection, traffic must be inspected prior to being forwarded to destinations outside of the enclave, such as external email traffic. This requirement does not mandate the decryption and inspection of SSL/TLS; it requires that if this is performed in the device, the decrypted traffic be inspected and conform to security policies.

If SSL/TLS traffic is decrypted in the device, it must be inspected. The Palo Alto Networks security platform can be configured to decrypt and inspect SSL/TLS connections going through the device. With SSL Decryption, SSL-encrypted traffic is decrypted and App-ID and the Antivirus, Vulnerability, Anti-Spyware, URL Filtering, and File-Blocking Profiles can be applied to decrypted traffic before being re-encrypted and being forwarded. This is not limited to SSL encrypted HTTP traffic (HTTPS); other protocols "wrapped" in SSL/TLS can be decrypted and inspected.

Decryption is policy-based and can be used to decrypt, inspect, and control both inbound and outbound SSL and SSH connections. Decryption policies allow the administrator to specify traffic for decryption according to destination, source, or URL category and in order to block or restrict the specified traffic according to security settings.

Checks

If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable.

Go to Policies >> Decryption; note each configured decryption policy.
Go to Policies >> Security
View the configured security policies.

If there is a decryption policy that does not have a corresponding security policy, this is a finding.

The matching policy may not be obvious and it may be necessary for the Administrator to identify the corresponding security policy.

Fix

Note: These instructions assume that certificates have already been loaded on the device. Multiple decryption policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known. The Administrator must tailor the configuration to match the site-specific requirements.

Go to Policies >> Decryption
Select "Add".
In the "Decryption Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" or "Source User" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" or "Destination User" fields.
In the "URL Category" tab, select which categories will be decrypted.
Select "Any" to decrypt all traffic. This is used for web traffic.
In the "Option" tab, select "Decrypt" as the Action. Select the decryption profile.
In the Type field, there are three options;
Select "SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks".
Select "SSH Proxy to decrypt inbound and outbound SSH connections passing through the device".
Select "SSL Inbound Inspection to decrypt and inspect incoming SSL traffic".

Note: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device.

Decrypted traffic is blocked and restricted according to the policies configured on the firewall. For each Decryption Policy, there must be a Security Policy in order to inspect and filter the decrypted traffic. Multiple security policies can be configured; these instructions explain the steps involved but do not provide specific details since the exact local policies are not known.

Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, complete the "Source User" and "HIP Profile" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, either select the "Any" check box or add the specific applications. Configured filters and groups can be selected.
In the "Actions" tab, select the desired resulting action (allow or deny). If logging of matches on the rule is required, select the "Log forwarding" profile, and select "Log at Session End".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62549 Updated
Findings ID: PANW-AG-000016 Rule ID: SV-77039r23_rule Severity: medium CCI: CCI-000068

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Encryption provides a means to secure the remote connection so as to prevent unauthorized access to the data traversing the remote access connection, thereby providing a degree of confidentiality. The encryption strength of the mechanism is selected based on the security categorization of the information.

Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections.

Checks

If the Palo Alto Networks security platform does not serve as an intermediary for remote access traffic (e.g., web content filter, TLS, and webmail), this is not applicable.

For PAN OS 6.1, enter the command "show fips-mode"; if the response is "off", this is a finding unless the device is in CC mode.

For PAN OS 6.1 and PAN OS 7.0.1 and later, when in CC mode, the CLI and the GUI login screen will display “CCEAL4 MODE ENABLED” and the GUI will display “CC” in the lower right hand corner. If these are present, this is not a finding.
Alternately, use the command line interface to determine if the device is operating in Common Criteria mode. Enter the command “show operational-mode”; if the response is not
Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recent release).

Ifofapsal-mf ot fi s-ccons seteso "off"
, this is a finding.

Fix

To configure the Palo Alto Networks security platform to operate in FIPS mode:

Power off the device by unplugging it from the electrical outlet.

Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.


The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.


A USB to serial adapter will be necessary if the computer does not have a serial port.

During the boot sequence, this message will appear:

"Autoboot to default partition in 5 seconds".

Enter "maint" to boot to "maint" partition.

Enter "maint" to enter maintenance mode.

Press "Enter", and the "Maintenance Recovery Ttool" menu will appear.

Select "Set FIPS Mode" from the menu; once the device has finished rebooting, it will be in FIPS mode. The procedure for enabling CC mode is similar; however, select "Set CCEAL4 Mode" from the menu.

When the mode change is complete, the device will report the status as “Success”. After this is complete, it is necessary to reboot the d
(or fips-cc for later versions) from the menu; once the device haernhihedsroboominglete,w ll beti sFIPSymrtevi

Note: This will remove all installed licenses and disable the serial port.
V-62551 Updated
Findings ID: PANW-AG-000017 Rule ID: SV-77041r23_rule Severity: medium CCI: CCI-000068

Discussion

Private key data is used to prove that the entity presenting a public key certificate is the certificate's rightful owner. Compromise of private key data allows an adversary to impersonate the key holder.

Private key data associated with software certificates is required to be generated and protected in at least a FIPS 140-2 Level 1 validated cryptographic module.

Checks

For PAN OS 6.1, enter the command "show fips-mode"; if the response is "off", this is a finding unless the device is in CC mode.

For PAN OS 6.1 and PAN OS 7.0.1 and later, when in CC mode, the CLI and the GUI login screen will display “CCEAL4 MODE ENABLED” and the GUI will display “CC” in the lower right hand corner. If these are present, this is not a finding.
Alternately, use the command line interface to determine if the device is operating in Common Criteria mode. Enter the command “show operational-mode”; if the response is
Use the command line interface to determine if the device is operating in FIPS mh cr

erotfpy- omrfcdmn ps-cdvicmnh etp"nff"
, this is a finding.

Fix

To configure the Palo Alto Networks security platform to operate in FIPS mode:

Power off the device by unplugging it from the electrical outlet.

Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.


The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.


A USB to serial adapter will be necessary if the computer does not have a serial port.

During the boot sequence, this message will appear:

"Autoboot to default partition in 5 seconds".

Enter "maint" to boot to "maint" partition.

Enter "maint" to enter maintenance mode.

Press "Enter", and the "Maintenance Recovery Ttool" menu will appear.

Select "Set FIPS Mode" from the menu; once the device has finished rebooting, it will be in FIPS mode. The procedure for enabling CC mode is similar; however, select "Set CCEAL4 Mode" from the menu.

When the mode change is complete, the device will report the status as “Success”. After this is complete, it is necessary to reboot the d
(or fips-cc for later versions) from the menu; once the device haernhihedsroboominglete,w ll beti sFIPSymrtevi

Note: This will remove all installed licenses and disable the serial port.
V-62553 Updated
Findings ID: PANW-AG-000020 Rule ID: SV-77043r23_rule Severity: medium CCI: CCI-001453

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).

Checks

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.

For PAN OS 6.1, enter the command "show fips-mode"; if the response is "off", this is a finding unless the device is in CC mode.

For PAN OS 6.1 and PAN OS 7.0.1 and later, when in CC mode, the CLI and the GUI login screen will display “CCEAL4 MODE ENABLED” and the GUI will display “CC” in the lower right hand corner. If these are present, this is not a finding.
Alternately, use the command line interface to determine if the device is operating in Common Criteria mode. Enter the command “show operational-mode”; if the response is not “CC”, this is a
Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "show fips-mode" or the command show fips-cc (for more recoi telhasp,).

Fix

To configureIf the Palo Alto Networks security platform to operate in FIPS mode:is used as a TLS gateway/decryption point or VPN concentrator, it must use NIST FIPS-validated cryptography.

Power off the device by unplugging it from the electrical outlet.


Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.


The serial parameters are 9600 baud, 8 data bits, no parity, and 1 stop bit.


A USB to serial adapter will be necessary if the computer does not have a serial port.

During the boot sequence, this message will appear:
"Autoboot to default partition in 5 seconds".

Enter "maint" to boot to "maint" partition.

Enter "maint" to enter maintenance mode.

Press "Enter", and the "Maintenance Recovery Ttool" menu will appear.

Select "Set FIPS Mode" from the menu; once the device has finished rebooting, it will be in FIPS mode. The procedure for enabling CC mode is similar; however, select "Set CCEAL4 Mode" from the menu.

When the mode change is complete, the device will report the status as “Success”. After this is complete, it is necessary to reboot the d
(or select fips-cc for more recent versions) from the menu; once the device haernhihedsroboominglete,w ll beti sFIPSymrtevice.

Note: This will remove all installed licenses and disable the serial p
o
V-62555 No Change
Findings ID: PANW-AG-000024 Rule ID: SV-77045r1_rule Severity: low CCI: CCI-000133

Discussion

Without establishing the source of the event, it is impossible to establish, correlate, and investigate the events leading up to an outage or attack. In order to compile an accurate risk assessment and provide forensic analysis, security personnel need to know the source of the event. In addition to logging where sources of events such as IP addresses, processes, and node or device names, it is important to log the name or identifier of each specific policy or rule that is violated.

In the Palo Alto Networks security platform, traffic logs record information about each traffic flow, and threat logs record the threats or problems with the network traffic, such as virus or spyware detection. Note that the antivirus, anti-spyware, and vulnerability protection profiles associated with each rule determine which threats are logged (locally or remotely).

Checks

Go to Policies >> Security
View the configured security policies.

For any Security Policy where the "Action" column shows "deny", view the "Options" column; if there are no icons in the column, this is a finding.

Note: The "Action" column and the "Option" column are usually near the right edge; it may be necessary to use the slide to view them.

Fix

Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
In the "Actions" tab, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries.

Note: Traffic and Security Logs are required to be forwarded to syslog servers.

In the "Log Forwarding" field, select a configured log forwarding profile.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62557 No Change
Findings ID: PANW-AG-000035 Rule ID: SV-77047r1_rule Severity: medium CCI: CCI-000381

Discussion

User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall. WMI probing is a Microsoft feature that collects user information from Windows hosts and contains a username and encrypted password hash of a Domain Administrator account.

If User-ID and WMI probing are enabled on an external untrusted zone (such as the Internet), probes could be sent outside the protected network, resulting in an information disclosure of the User-ID Agent service account name, domain name, and encrypted password hash. This information has the potential to be cracked and exploited by an attacker to gain unauthorized access to protected resources. For this important reason, User-ID should never be enabled on an untrusted zone.

Checks

To verify that Windows Management Instrumentation (WMI) probing is unchecked for all untrusted zones:

Go to Network >> Zones, view each zone.
If the Zone is untrusted and if the UserID Enabled column is checked, this is a finding.

Go to Network >> Network Profiles >> Interface Mgmt
View the configured Interface Management Profiles.
Note which Interface Management Profiles have the "User-ID" field enabled (checked).
Go Network >> Interfaces
Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel. Each type can have an Interface Management Profile applied to it.

View each interface that is in an untrusted security zone; if each one has no Interface Management Profile applied, this is not a finding.

If each interface in an untrusted security zone has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled; if it does, this is a finding.

Fix

To deny User-ID on untrusted zones:
Go to Network >> Zones, select the name of the zone.
If the Zone is untrusted, In the Zone window, deselect (uncheck) the Enable User Identification check box.
Select "OK".
Go to Network >> Network Profiles >> Interface Mgmt
Select "Add" to create a new profile or select the name of a profile to edit it.
In the "Interface Management Profile" window, deselect the "User-ID" check box if it is selected.
Select "OK".

Note: This action precludes that particular Interface Management Profile from supporting User-ID.

An interface does not need an Interface Management Profile to operate; only to be managed on that interface.
Go Network >> Interfaces
Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel.
Each type can have an Interface Management Profile applied to it.
View each interface that is in an untrusted security zone; if it has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled.
V-62559 No Change
Findings ID: PANW-AG-000036 Rule ID: SV-77049r1_rule Severity: medium CCI: CCI-000381

Discussion

User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall. WMI probing is a Microsoft feature that collects user information from Windows hosts, and contains a username and encrypted password hash of a Domain Administrator account.

WMI probing on external/untrusted zones can result in the User-ID agent sending WMI probes to external/untrusted hosts. An attacker can capture these probes and obtain the username, domain name and encrypted password hash associated with the User-ID account. If WMI probing is not used as a method of user to IP address mapping, it must be disabled.

Checks

Ask the Administrator if User-ID uses WMI Probing; if it does, this is not a finding.

Go to Device >> User Identification
On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box. If it is selected, this is a finding.

Fix

To disable WMI probing if it is not used:
Go to Device >> User Identification
On the "User Mapping" tab, in the "Palo Alto Networks User ID Agent" pane, view the "Enable Probing" check box.
If it is selected, select the "Edit" icon in the upper-right corner of the pane.
In the "Palo Alto Networks User ID Agent Setup" window, in the "Client Probing" tab, deselect the "Enable Probing" check box.
V-62561 No Change
Findings ID: PANW-AG-000037 Rule ID: SV-77051r2_rule Severity: medium CCI: CCI-000381

Discussion

The Palo Alto Networks security platform can act as a DNS proxy and send the DNS queries on behalf of the clients. DNS queries that arrive on an interface IP address can be directed to different DNS servers based on full or partial domain names.

However, unrelated or unneeded proxy services increase the attack vector surface and add excessive complexity to securing the device.

Checks

To check if DNS Proxy is configured:
Go to Network >> DNS Proxy
If there are entries in the pane, this is a finding.

Fix

Do not configure and enable the DNS Proxy capability.

Go to Network >> DNS Proxy
If there are no entries in the pane, then this capability has not been enabled.
V-62563 No Change
Findings ID: PANW-AG-000038 Rule ID: SV-77053r1_rule Severity: medium CCI: CCI-000382

Discussion

In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types); organizations must disable or restrict unused or unnecessary physical and logical ports/protocols on information systems.

The DoD continually assesses the ports, protocols, and services that can be used for network communications. Some ports, protocols, or services have known exploits or security weaknesses. Network traffic using these ports, protocols, and services must be prohibited or restricted in accordance with DoD policy. It is the responsibility of the enclave owner to have the applications the enclave uses registered in the PPSM database.

The Palo Alto Networks security platform must be configured to prevent or restrict the use of prohibited ports, protocols, and services throughout the network by filtering the network traffic and disallowing or redirecting traffic as necessary. If the device is in a Deny-by-Default posture and what is allowed through the filter is IAW DoD Instruction 8551, and if the permit rule is explicitly defined with explicit ports and protocols allowed, then all requirements related to PPS being blocked are satisfied.

Since the enclave or system may support custom applications, it may be necessary to configure a Custom Application. This requires detailed analysis of the application traffic and requires validation testing before deployment.

Checks

Review the list of authorized applications, endpoints, services, and protocols that has been added to the PPSM database.
Go to Policies >> Security
Review each of the configured security policies in turn.
If any of the policies allows traffic that is prohibited by the PPSM CAL, this is a finding.

Fix

To configure a security policy:
Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, select "Any" or complete the "Source User" field; this is completed if the policy performs the defined actions based on an individual user or group of users. If using GlobalProtect with Host Information Profile (HIP) enabled, select the "HIP Profiles" check box, and add the HIP Object or HIP Profile.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, select the authorized applications.
In the "Service/URL Category" tab, select application-default. To add a service, select the "Service" check box, select "Add", and select a listed service or add a new service or service group.
In the "Actions" tab, select either "Deny" or "Allow" (as required) as the resulting action. Select the required Log Setting and Profile Settings as necessary.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62565 No Change
Findings ID: PANW-AG-000044 Rule ID: SV-77055r1_rule Severity: medium CCI: CCI-000185

Discussion

A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA). Certification path validation is necessary for a relying party to make an informed decision regarding acceptance of an end entity certificate.

Certification path validation includes checks such as certificate issuer trust, time validity and revocation status for each certificate in the certification path. Revocation status information for CA and subject certificates in a certification path is commonly provided via certificate revocation lists (CRLs) or online certificate status protocol (OCSP) responses.

The Palo Alto Networks security platform can be configured to use Open Certificate Status Protocol (OCSP) and/or certificate revocation lists (CRLs) to verify the revocation status of certificates and the device itself can be configured as an OCSP responder.

Checks

If the Palo Alto Networks security platform does not provide intermediary services for TLS or application protocols that use TLS (e.g., HTTPS), this is not applicable.
Go to Device >> Certificate Management >> OCSP Responder
If no OCSP Responder is configured, this is a finding.
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, if "HTTP OCSP" is not listed under "Services", this is a finding.

Fix

To configure the Palo Alto Networks security platform to use an OCSP responder:
Go to Device >> Certificate Management >> OCSP Responder
Select "Add".
In the "OCSP Responder" window, enter the host name or IP address of the OCSP responder.

Note: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services.

To enable OCSP communication on the firewall:
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, select the "Edit" icon.
In the "Management Interface Settings" box, under "Services" check HTTP OCSP to enable it.
Select "OK"

Optionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services.

Go to Network >> Network Profiles >> Interface Management
Select "Add" to create a new profile or click the name of an existing profile.
In the "Interface Management Profiles" window, under "Permitted Services", check HTTP OCSP.
Select "OK".

Go to Network >> Interfaces
Select the name of the interface that the firewall will use for OCSP services.

Note: When the device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface.

In the "Interface" window, under Other Info, in the "Management Profile" field, select the configured Management Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62567 No Change
Findings ID: PANW-AG-000047 Rule ID: SV-77057r2_rule Severity: medium CCI: CCI-001094

Discussion

DoS attacks can take multiple forms but have the common objective of overloading or blocking a network or host to deny or seriously degrade performance. If the network does not provide safeguards against DoS attack, network resources will be unavailable to users.

These attacks may use legitimate or rogue endpoints from inside the enclave. These attacks can be simple "floods" of traffic to saturate circuits or devices, malware that consumes CPU and memory on a device or causes it to crash, or a configuration issue that disables or impairs the proper function of a device. For example, an accidental or deliberate misconfiguration of a routing table can misdirect traffic for multiple networks.

It is important to set the Flood Protection parameters that are suitable for the enclave or system. The Administrator should characterize the traffic regularly (perform a traffic baseline) and tune these parameters based on that information.

Checks

Ask the Administrator if the device is using a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave.
If it is using a DoS Protection policy, perform the following;
Go to Objects >> Security Profiles >> DoS Protection
If there are no DoS Protection Profiles configured, this is a finding.
There may be more than one configured DoS Protection Profile; ask the Administrator which DoS Protection Profile is intended to protect outside networks from internally-originated DoS attacks.
If there is no such DoS Protection Profile, this is a finding.

If it is using a Zone-Based Protection policy, perform the following;
Go to Network >> Network Profiles >> Zone Protection
If there are no Zone Protection Profiles configured, this is a finding.
There may be more than one configured Zone Protection Profile; ask the Administrator which Zone Protection Profile is intended to protect outside networks from internally-originated DoS attacks.
If there is no such Zone Protection Profile, this is a finding.
Go to Network >> Zones
If the Zone Protection Profile column for the External zone is blank, this is a finding.
If it lists an incorrect Zone Protection Profile, this is also a finding.

Fix

Configure either a Zone-Based Protection policy or a DoS Protection policy to protect against DoS attacks originating from the enclave.

To configure a DoS Protection policy, perform the following:
Go to Objects >> Security Profiles >> DoS Protection
Select "Add" to create a new profile.
In the "DoS Protection Profile" window, complete the required fields.
For the "Type", select "Classified".
In the "Flood Protection" tab, "SYN Flood" sub-tab, select the "SYN Flood" check box and select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "UDP Flood" sub-tab, select the "UDP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "ICMP Flood" sub-tab, select the "ICMP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "ICMPv6 Flood" sub-tab, select the "ICMPv6 Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "Other IP Flood" sub-tab, select the "Other IP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Resources Protection" tab, leave the "Maximum Concurrent Sessions" check box unselected.
Select "OK".

Go to Policies >> DoS Protection
Select "Add" to create a new policy.
In the "DoS Rule" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Source" tab, for "Zone", select the "Internal" zone, for "Source Address", select "Any".
In the "Destination" tab, "Zone", select "External" zone, for "Destination Address", select "Any".
In the "Option/Protection" tab,
For "Service", select "Any".
For "Action", select "Protect".
Select the "Classified" check box.
In the "Profile" field, select the configured DoS Protection profile for outbound traffic.
In the "Address" field, select source-ip-only.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

To configure a Zone-Based Protection policy, perform the following:
Go to Network >> Network Profiles >> Zone Protection
Select "Add".
In the "Zone Protection Profile" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Flood Protection" tab, select the "SYN" check box, in the "Action" field, select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "ICMP" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "ICMPv6" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "Other IP" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "UDP" check box; complete the "Alert", "Activate", and "Maximum" fields.
For each of the "Alert", "Activate", and "Maximum" fields, the appropriate values depend on the expected traffic of the system.
In the "Reconnaissance Protection" tab, select the "TCP Port Scan", "Host Sweep", and "UDP Port Scan" rows. In the "Action" field, select "Block". The "Interval" and "Threshold" values can either remain as the default values or they can be changed based on the specific traffic conditions of the network (preferred).

In the "Packet Based Attack Protection" tab:
"TCP/IP Drop" sub-tab, select the "Spoofed IP address", and "Mismatched overlapping TCP segment" check boxes.
In the "IP Option Drop" section, select the "Strict Source Routing", "Loose Source Routing", "Timestamp", "Unknown", and "Malformed" check boxes.
The "Record Route", "Security", and "Stream ID" check boxes can remain unchecked.
For the "Reject Non-SYN TCP" field, select "yes".
For the "Asymmetric Path" field, select "bypass".

"ICMP Drop" sub-tab, select the "ICMP Ping ID 0", "ICMP Fragment", "ICMP Large Packet(>1024)" check boxes.
The "Discard ICMP embedded with error message", "Suppress ICMP TTL Expired Error", and "Suppress ICMP Frag Needed" boxes can remain unchecked.
Since this requirement is specifically to prevent internal systems from launching DoS attacks against other networks or endpoints, select the following from the "ICMP Drop" sub-tab: "ICMP Ping ID 0", "ICMP Fragment", "ICMP Large Packet(>1024)", "Suppress ICMP TTL Expired Error", "Suppress ICMP Frag Needed".
"IPv6 Drop" sub-tab, select the "Type 0 Routing Header", "IPv4 compatible address", "Anycast source address", "Needless fragment header", "MTU in ICMPv6 'Packet Too Big' less than 1280 bytes", "Hop-by-Hop extension", "Routing extension", "Destination extension", "Invalid IPv6 options in extension header", and "Non-zero reserved field" check boxes.
"ICMPv6" sub-tab, select the "ICMPv6 destination unreachable", "ICMPv6 packet too big", "ICMPv6 time exceeded", "ICMPv6 parameter problem", and "ICMPv6 redirect" check boxes.
Select "OK".

Apply the Zone Protection Profile to the exterior zone:
Go to Network >> Zones
Select the exterior zone.
In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62569 No Change
Findings ID: PANW-AG-000049 Rule ID: SV-77059r1_rule Severity: medium CCI: CCI-001094

Discussion

A variety of Distributed Denial of Service (DDoS) attacks and other attacks use "botnets" as an attack vector. A botnet is a collection of software agents (referred to as "bot"), residing on compromised computers. Attacks are orchestrated by a "bot herder" to command these agents to launch attacks. Part of the command and control communication between the controller and the bots is a message sent from a bot that informs the controller that it is operating. This is referred to as a "phone home" message.

On the Palo Alto Networks security platform, a security policy can include an Anti-spyware Profile for “phone home” detection (detection of traffic from installed spyware). The device has two pre-configured Anti-spyware Profiles; Default and Strict. The Default Anti-spyware Profile sends an alert for detected phone-home traffic for all severity levels except the low and informational severity threat levels, while the Strict Anti-spyware Profile blocks phone-home traffic for the critical, high, and medium severity threat levels.

Phone home traffic must either be blocked or intercepted by the DNS Sinkholing feature. Therefore, a custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. Note that there are specific implementation requirements for DNS Sinkholing to operate properly; refer to the Palo Alto Networks documentation for details.

Checks

Ask the Administrator which Anti-Spyware profile is used:
Go to Objects >> Security Profiles >> Anti-Spyware
Select the Anti-Spyware Profile.
In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, if either "block" or "sinkhole" is not selected, this is a finding.

Ask the Administrator which Security Policy Rule allows traffic from client hosts in the trust zone to the untrust zone:
Go to Policies >> Security
Select the identified policy rule.
View the "Security Policy Rule" window.
Select the "Actions" tab.
In the "Profile Setting" section, in the "Anti-Spyware" field, if there is no Anti-Spyware Profile or the Anti-Spyware Profile is not the correct one, this is a finding.

Fix

Go to Objects >> Security Profiles >> Anti-Spyware
Select the name of a configured Anti-Spyware Profile or select "Add" to create a new one.
In the "Anti-Spyware Profile" window, in the "DNS Signatures" tab, in the Action on "DNS queries" field, select "block" or "sinkhole".
If "sinkhole" is selected, complete the "Sinkhole IPv4" and "Sinkhole IPv6" fields.

Note: If DNS Sinkholing is used, the device and network must be configured to support it.

If this is a new Anti-Spyware Profile, complete the required fields in all tabs.
Select "OK".
Use the Anti-Spyware Profile in a Security Policy;
Edit the Security Policy Rule that allows traffic from client hosts in the trust zone to the untrust zone to include the sinkhole zone as a destination and attach the Anti-spyware Profile. Select or configure a rule that allows traffic from the client host zone to the untrust zone.

Go to Policies >> Security
Select the appropriate existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Anti-Spyware" field, select the configured Anti-Spyware Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62571 Updated
Findings ID: PANW-AG-000050 Rule ID: SV-77061r12_rule Severity: medium CCI: CCI-001094

Discussion

A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in "botnets", which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken.

Enclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave.

Configure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave. The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.

Checks

Obtain the list of IP address prefixes assigned to the enclave by the DoD Network Information Center.
Since there are likely to be many configured policies, ask the Administrator which security policy is the anti-spoof policy.
If there is none, this is a finding.

Go to Policies >> Security
View the list of configured security policies.
Select the policy identified as the anti-spoof policy.
In the "Source" tab; if the Source Addresses for the internal zone do not match the IP address prefixes assigned to the enclave by the DoD Network Information Center
Verify an anti-spoofing policy is configured for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone.

Navigate to the oZe erPtettiti n ofofil configurigura scr ecr
Select the thecetPacked Basad ttate tiote tion”ltcb thelect tre tab Drf the tSb
oIe the Addressf doI iA not che ed os eath oetkoinf r ne
, this is a finding.

Fix

Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
I
Create an anti-spoofing policy for each outgoing zone that drops any traffic when the "Ssource" tab, complete the "Source Zone" and "Source Address" fields. Use the internal zone and the IP address prefix for that zone.

Note: There may be more than one internal zone, so multiple policies may be necessary.

In the "User" tab, leave the default settings.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields. Use the "external zone" and "Any" for the "Destination Address" field.
Note: There may be more than one internal zone, so multiple policies may be necessary.
In the "Applications" tab, select the "Any" check box.
In the "Service/URL Category" tab, select "Any" for both service and URL Category.
In the "A
IP does not match the list of allowed IP ranges for each outgoing zone.

Navigate to the “Zone Protection Profile onfifiration scseen.n

elect the e cketc easeB AetaAt arkte
ctions"t tab, select allow as the resulting action.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears
telect thect t er“ t D.o
Chect the Chpoofeh Sdrofsd IP
.
V-62573 No Change
Findings ID: PANW-AG-000051 Rule ID: SV-77063r1_rule Severity: medium CCI: CCI-001109

Discussion

A deny-all, permit-by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed. As a managed boundary interface between networks, the Palo Alto Networks security platform must block all inbound and outbound network traffic unless a policy filter is installed to explicitly allow it. The allow policy filters must comply with the site's security policy. A deny-all, permit–by-exception network communications traffic policy ensures that only those connections that are essential and approved are allowed.

By default, there are two security policies on the Palo Alto Networks firewall:
Allow traffic within the same zone (intra-zone)
Deny traffic from one zone to another zone (inter-zone).

No policy that circumvents the inter-zone policy is allowed. Traffic through the device is permitted by policies developed to allow only that specific traffic that the system or enclave requires.

Checks

Go to Policies >> Security
Review each of the configured security policies in turn.
Select each policy in turn; in the "Security Policy Rule" window, if the "Source Address" has "Any" selected, the "Destination Address" has "Any" selected, the "Application" has "Any" selected, and the "Action" Setting is "Allow", this is a finding.

If any Security Policy is too broad (allowing all traffic either inbound or outbound), this is also a finding.

Fix

Do not configure any policies or rules that violate a deny-all, permit-by-exception policy.
Configure policies that allow traffic through the device based only on the mission and system requirements.
V-62575 No Change
Findings ID: PANW-AG-000052 Rule ID: SV-77065r1_rule Severity: medium CCI: CCI-001133

Discussion

Idle sessions can accumulate, leading to an exhaustion of memory in network elements processing traffic flows.
Note that the 15 minute period is a maximum value; Administrators can choose shorter timeout values to account for system- or network-specific requirements.

On a Palo Alto Networks security platform, a session is defined by two uni-directional flows, each uniquely identified by a 6-tuple key: source-address, destination-address, source-port, destination-port, protocol, and security-zone. Besides the six attributes that identify a session, each session has few more notable identifiers: end hosts - the source IP and destination IP which will be marked as client(source IP) and server(destination IP) and flow direction - each session is bi-directional and is identified by a two uni-directional flows, the first flow is client-to-server(c2s) and the returning flow is server-to-client(s2c).

Sessions between endpoints are kept active by either normal traffic or by keepalive messages (also sometimes referred to as heartbeat messages). On the Palo Alto Networks security platform, the session timeout period is the time (seconds) required for the application to time out due to inactivity. Session timeouts are configured globally and on a per-application basis. When configured, timeouts for an application override the global TCP or UDP session timeouts.

Checks

To check global values:
Go to Device >> Setup >> Session
In the "Session Timeouts" pane, if the TCP field has a value of greater than "900", this is a finding.

Obtain the list of authorized applications for the system or network.
To check application-specific values:
Go to Objects >> Applications
Select, in turn, each authorized application.
In the "Application" window, in the "Options" pane, view the "TCP" and "UDP Timeout" fields, if the value is greater than "900", this is a finding.

Many applications will not have one of these two fields.

Fix

To configure the global values:
Go to Device >> Setup >> Session
In the "Session Timeouts" pane, select the "Edit" icon (the gear symbol in the upper-right corner of the pane).
In the "TCP" field, enter "900".
Select "OK".

To configure application-specific values:
Go to Objects >> Applications
Select an application name to view additional details about the application.
To search for a specific application, enter the "application name" or "description" in the "Search" field.
In the "Application" window, in the "Options" pane, in the "TCP Timeout" field, select "Customize".
In the Application specific window, in the "TCP" and "UDP Timeout" fields, enter "900" if the existing value is greater than "900". Many applications will not have one of these two fields.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62577 No Change
Findings ID: PANW-AG-000060 Rule ID: SV-77067r2_rule Severity: medium CCI: CCI-001240

Discussion

In order to minimize any potential negative impact to the organization caused by malicious code, malicious code must be identified and eradicated. Malicious code includes viruses, worms, Trojan horses, and Spyware.

Checks

Check if the device is using the most current protection mechanisms and signature definitions.
If the device has authorized connectivity to the Palo Alto site, the automated process can be used.
Go to Device >> Dynamic Updates
View the list of updates, and note the date of the most recent one.
Select "Check Now" at the bottom of the page; if new updates appear, this is a finding.
If the device does not have connectivity to the Palo Alto site, a manual process must be used.
Log on to the Palo Alto Support site (registration required).
Select the “Dynamic Updates” hyperlink.
Check for the most current update (the version and release date of each update is listed).
Go to Device >> Dynamic Updates
View the list of updates and note the date of the most recent one.
If the device does not have the most current updates installed, this is a finding.

Fix

If the device has authorized connectivity to the Palo Alto site, automatic updates can be used.

To schedule automatic updates:
Go to Device >> Dynamic Updates
Select the text to the right of Schedule.
In the "Applications and Threat Updates Schedule" Window; complete the required information.
In the "Recurrence" field, select the desired frequency. If the update frequency is Weekly, select which day of the week.
In the "Time" field, enter the time at which you want the device to check for updates.
For the Action, select "Download and Install".
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

To retrieve the latest signatures:
Go to Device >> Dynamic Updates
Select "Check Now" at the bottom of the page.

If the device does not have authorized connectivity to the Palo Alto site, a manual process must be used. If manual updates are used, an Administrator must obtain updates from the Palo Alto Networks website and upload them from a workstation or server to the device.
Go to Device >> Dynamic Updates
Select "Upload" (at the bottom of the pane).
In the Select "Package Type" for the "Upload" window in the "Package Type" field, select "anti-virus".
Browse to and select the appropriate file.
Select "OK".
Select "Install From File" (at the bottom of the pane).
In the "Select Package Type for Installation" window, select "antivirus".
Select "OK".
In the "Install Application and Threats From File" window, select the previously uploaded file.
Select "OK".
V-62579 Updated
Findings ID: PANW-AG-000062 Rule ID: SV-77069r23_rule Severity: medium CCI: CCI-001243

Discussion

Malicious code is designed to compromise information systems; therefore, it must be prevented from being transferred to uninfected hosts.

The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while blocking for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks

Go to Objects >> Security Profiles >> Antivirus
If there are no Antivirus Profiles configured other than the default, this is a finding.

View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the "Action" is anything other than
block“drop , this is a finding.

Go to Policies >> Security
ty
Review each of the configured security policies in turn.
For any Security Policy that allows traffic between Zones (interzone), view the "Profile" column.n
If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix

To create an Antivirus Profile:
Go to Objects >> Security Profiles >> Antivirus
.

Select "Add".

In the "Antivirus Profile" window, complete the required fields.

Complete the "Name" and "Description" fields.

In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the "Action" to block.“drop .
Select "OK".

Use the Antivirus Profile in a Security Policy:
Go to Policies >> Security
.

Select an existing policy rule or select "Add" to create a new one.

In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.

In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.

Select "OK".

Commit changes by selecting "Commit" in the upper-right corner of the screen.

Select "OK" when the confirmation dialog appears.
V-62581 Updated
Findings ID: PANW-AG-000063 Rule ID: SV-77071r12_rule Severity: medium CCI: CCI-001243

Discussion

Taking an appropriate action based on local organizational incident handling procedures minimizes the impact of this code on the network. This requirement is limited to ALGs web content filters and packet inspection firewalls that perform malicious code detection as part of their functionality.

The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones. Antivirus, anti-spyware, and vulnerability protection features require a specific license.

There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while
blockdenying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Inspection is done through stream-based analysis, which means files are not cached or stored in their entirety on the firewall, but analyzed in real-time as they pass through the firewall. Therefore, any detected virus will automatically be deleted when detected.

Checks

Go to Objects >> Security Profiles >> Antivirus

If there are no Antivirus Profiles configured other than the default, this is a finding.

View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB), if the "Action" is anything other than block“deny, this is a finding.g.
Go to Policies >> Security
t
Review each of the configured security policies in turn.
For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.n.
If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix

To create an Antivirus Profile:
Go to Objects >> Security Profiles >> Antivirus

Select "Add".

In the "Antivirus Profile" window, complete the required fields.

Complete the "Name" and "Description" fields.

In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the "Action" to
block“deny”. This will blockdeny the data stream and create a log record.

Select "OK".

Use the Profile in a Security Policy:
Go to Policies >> Security

Select an existing policy rule or select "Add" to create a new one.

In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles".
The window will change to display the different categories of Profiles.

In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.
Select "OK".

Commit changes by selecting "Commit" in the upper-right corner of the screen.

Select "OK" when the confirmation dialog appears.
V-62583 No Change
Findings ID: PANW-AG-000065 Rule ID: SV-77073r1_rule Severity: medium CCI: CCI-001247

Discussion

Remote access is access to DoD nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).

Checks

Go to Device >> Dynamic Updates
If no entries for Applications and Threats are present, this is a finding.
If the Applications and Threats entry states Download Only, this is a finding.

This can be downgraded if a manual process is used. If a manual process is used, compare the Applications and Threats database for the most recent version.
Go to Dashboard >> General Information, if the application, threat, and URL filtering definition versions are not the most current ones listed on the vendor support site, this is a finding.

Fix

Go to Device >> Dynamic Updates; select "Check Now" at the bottom of the page to retrieve the latest signatures.
To schedule automatic signature updates. Note: The steps provided below do not account for local change management policies.
Go to Device >> Dynamic Updates; select the text to the right of Schedule.
In the "Applications and Threat Updates Schedule" window; complete the required information.
In the "Recurrence" field, select Daily.
In the "Time" field, enter the time at which you want the device to check for updates.
For the Action, select "Download and Install".
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen. Select "OK" when the confirmation dialog appears.

If using Dynamic Updates is not possible due to mission requirements, implement a manual process.
V-62585 Updated
Findings ID: PANW-AG-000073 Rule ID: SV-77075r12_rule Severity: medium CCI: CCI-001695

Discussion

Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.

This applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.

The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones.
Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while blockdenying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks

GGo to Objects >> Security Profiles >> Antivirus

If there are no Antivirus Profiles configured other than the default, this is a finding.

View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB)
,; if the "Action" is anything other than block“deny”, this is a finding.

Go to Policies >> Security

Review each of the configured security policies in turn.
For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix

To create an Antivirus Profile:
Go to Objects >> Security Profiles >> Antivirus

Select "Add".

In the "Antivirus Profile" window, complete the required fields.

Complete the "Name" and "Description" fields.


In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the "Action" to
block.“den.
Select "OK".

Use the Profile in a Security Policy:
Go to Policies >> Security

Select an existing policy rule or select "Add" to create a new one.

In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.

In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.

Select "OK".

Commit changes by selecting "Commit" in the upper-right corner of the screen.

Select "OK" when the confirmation dialog appears.
V-62587 Updated
Findings ID: PANW-AG-000074 Rule ID: SV-77077r12_rule Severity: medium CCI: CCI-001169

Discussion

MMobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.

This applies to mobile code that may originate either internal to or external from the enclave. Mobile code is defined as software modules obtained from remote systems, transferred across a network, and then downloaded and executed on a local system without explicit installation or execution by the recipient.

The Palo Alto Networks security platform allows customized profiles to be used to perform antivirus inspection for traffic between zones.
Antivirus, anti-spyware, and vulnerability protection features require a specific license. There is a default Antivirus Profile; the profile inspects all of the listed protocol decoders for viruses, and generates alerts for SMTP, IMAP, and POP3 protocols while blockdenying for FTP, HTTP, and SMB protocols. However, these default actions cannot be edited and the values for the FTP, HTTP, and SMB protocols do not meet the requirement, so customized profiles must be used.

Checks

Go to Objects >> Security Profiles >> Antivirus

If there are no Antivirus Profiles configured other than the default, this is a finding.

View the configured Antivirus Profiles; for each protocol decoder (SMTP, IMAP, POP3, FTP, HTTP, SMB),
; if the "Action" is anything other than block“deny”, this is a finding.

Go to Policies >> Security

Review each of the configured security policies in turn.

For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.


If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

Fix

To create an Antivirus Profile:
Go to Objects >> Security Profiles >> Antivirus

Select "Add".

In the "Antivirus Profile" window, complete the required fields.

Complete the "Name" and "Description" fields.

In the "Antivirus" tab, for all Decoders (SMTP, IMAP, POP3, FTP, HTTP, SMB protocols), set the "Action" to block“deny..
Select "OK".

Use the Profile in a Security Policy:
Go to Policies >> Security

Select an existing policy rule or select "Add" to create a new one.

In the "Actions" tab in the "Profile Setting" section; , in the "Profile Type" field, select Profiles. The window will change to display the different categories of Profiles.

In the "Actions" tab
, in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.

Select "OK".

Commit changes by selecting "Commit" in the upper-right corner of the screen.

Select "OK" when the confirmation dialog appears.
V-62589 No Change
Findings ID: PANW-AG-000078 Rule ID: SV-77079r1_rule Severity: medium CCI: CCI-002314

Discussion

Remote access devices, such as those providing remote access to network devices and information systems, which lack automated control capabilities, increase risk and makes remote user access management difficult at best.

Remote access is access to DoD-nonpublic information systems by an authorized user (or an information system) communicating through an external, non-organization-controlled network. Remote access methods include broadband and wireless connections. Remote access methods include, for example, proxied remote encrypted traffic (e.g., TLS gateways, web content filters, and webmail proxies).

If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to inspect and filter decrypted traffic. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered. For example, HTTPS traffic that is decrypted must have the HTTP traffic inspected and filtered.

Checks

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.

Go to Policies >> Decryption
Note each configured decryption policy.
Go to Policies >> Security
View the configured security policies.

If there is a decryption policy that does not have a corresponding security policy, this is a finding.
The matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy.

Fix

These instructions explain the steps involved, but do not provide specific details since the exact policies and expected traffic are not known.

Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
Configure the Security Policy in accordance with the policy for the resulting decrypted traffic.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62591 No Change
Findings ID: PANW-AG-000079 Rule ID: SV-77081r1_rule Severity: medium CCI: CCI-002322

Discussion

Without the ability to immediately disconnect or disable remote access, an attack or other compromise taking place would not be immediately stopped.

Remote access functionality must have the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The remote access functionality may implement features such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.

If the Palo Alto Networks security platform is used as a TLS gateway/decryption point or VPN concentrator, configure the device to deny decrypted traffic that violates the enclave or system policies. For each type of SSL/TLS traffic that is decrypted, the resulting traffic must be inspected and filtered.

Checks

If the Palo Alto Networks security platform is not used as a TLS gateway/decryption point or VPN concentrator, this is not applicable.

Go to Policies >> Decryption
Note each configured decryption policy.
Go to Policies >> Security
View the configured security policies.
If there is a decryption policy that does not have a corresponding security policy, this is a finding.

The matching policy may not be obvious, and it may be necessary for the Administrator to identify the corresponding security policy.
Select the Security Policy Rules applied to the decrypted traffic. If it allows traffic that is prohibited, this is a finding.

Fix

These instructions explain the steps involved but do not provide specific details since the exact policies and expected traffic are not known.

Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
Configure the Security Policy in accordance with the enclave's or system's policy for the resulting decrypted traffic.
For any traffic that violates the enclave policy, configure the Security Policy rule to deny the traffic.
In the "Security Policy Rule" window, in the "Actions" tab, in the "Action Setting" section, select "deny".
For any traffic that is allowed, configure the Security Policy Rule to allow the traffic and apply Antivirus and Vulnerability Protection Profiles.
In the "Security Policy Rule" window, in the "Actions" tab, in the "Action Setting" section, select "allow".
In the "Security Policy Rule" window, in the "Actions" tab, in the "Profiles Setting" section, select the necessary Profiles.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62593 No Change
Findings ID: PANW-AG-000080 Rule ID: SV-77083r2_rule Severity: medium CCI: CCI-002346

Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.

Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. Web applications frequently access databases to store, retrieve, and update information. An attacker can construct inputs that the database will execute. This is most commonly referred to as a code injection attack. This type of attack includes XPath and LDAP injections.

Checks

Go to Objects >> Security Profiles >> Vulnerability Protection
If there are no Vulnerability Protection Profiles configured, this is a finding.

Ask the Administrator which Vulnerability Protection Profile is used to protect database assets by blocking and alerting on attacks.
View the configured Vulnerability Protection Profile
Check the "Severity" and "Action" columns.
If the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding.

If the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding.

Ask the Administrator which Security Policy is used to protect database assets:
Go to Policies >> Security
View the configured Security Policy.
View the "Profile" column.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Moving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied.

If the specific Vulnerability Protection Profile is not listed, this is a finding.

Fix

Create and apply a Vulnerability Protection Profile to protect database assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats.

Go to Objects >> Security Profiles >> Vulnerability Protection
Select "Add".
In the "Vulnerability Protection Profile" window, complete the required fields.
In the "Name" field, enter the name of the Vulnerability Protection Profile.
In the "Description" field, enter the description of the Vulnerability Protection Profile.
In the "Rules" tab, select "Add".
In the "Vulnerability Protection Rule" window,
In the "Rule Name" field, enter the Rule name,
In the "Threat Name" field, select "any",
In the "Action" field, select "block".
In the "Host type" field, select "server".
Select the check boxes above the "CVE" and "Vendor ID" boxes.
In the "Severity" section, select the "critical", "high", and "medium" check boxes.
Select "OK".
In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK".

Add a second rule that alerts on low and informational threats.
Apply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the databases.
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62595 No Change
Findings ID: PANW-AG-000081 Rule ID: SV-77085r2_rule Severity: medium CCI: CCI-002346

Discussion

Data mining is the analysis of large quantities of data to discover patterns and is used in intelligence gathering. Failure to prevent attacks launched against organizational information from unauthorized data mining may result in the compromise of information.

Injection attacks allow an attacker to inject code into a program or query or inject malware onto a computer to execute remote commands that can read or modify a database or change data on a website. These attacks include buffer overrun, XML, JavaScript, and HTML injections.

Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks

Go to Objects >> Security Profiles >> Vulnerability Protection
If there are no Vulnerability Protection Profiles configured, this is a finding.

Ask the Administrator which Vulnerability Protection Profile is used to protect application assets by blocking and alerting on attacks.
View the configured Vulnerability Protection Profile; check the "Severity" and "Action" columns.
If the Vulnerability Protection Profile used for database protection does not block all critical, high, and medium threats, this is a finding.

If the Vulnerability Protection Profile used for database protection does not alert on low and informational threats, this is a finding.

Ask the Administrator which Security Policy is used to protect application assets:
Go to Policies >> Security
View the configured Security Policy; view the "Profile" column.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Moving the cursor over the symbol will list the exact Vulnerability Protection Profiles applied.

If the specific Vulnerability Protection Profile is not listed, this is a finding.

Fix

Create and apply a Vulnerability Protection Profile to protect application assets by blocking and alerting on attacks. This profile has two rules; the first blocks critical, high, and medium threats, and the second alerts on low and informational threats.
Go to Objects >> Security Profiles >> Vulnerability Protection
Select "Add".
In the "Vulnerability Protection Profile" window, complete the required fields.
In the "Name" field, enter the name of the Vulnerability Protection Profile.
In the "Description" field, enter the description of the Vulnerability Protection Profile.
In the "Rules" tab, select "Add".
In the "Vulnerability Protection Rule" window,
In the "Rule Name" field, enter the Rule name,
In the "Threat Name" field, select "any",
In the "Action" field, select "block".
In the "Host type" field, select "server".
Select the check boxes above the "CVE" and "Vendor ID" boxes.
In the "Severity" section, select the "critical", "high", and "medium" check boxes.
Select "OK".
In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK".
Add a second rule that alerts on low and informational threats.
Apply the Vulnerability Protection Profile to the Security Policy Rules permitting traffic to the applications.
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62597 No Change
Findings ID: PANW-AG-000094 Rule ID: SV-77087r2_rule Severity: medium CCI: CCI-001851

Discussion

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Off-loading is a common process in information systems with limited audit storage capacity.

This does not apply to audit logs generated on behalf of the device itself (management).

Checks

To view a syslog server profile:
Go to Device >> Server Profiles >> Syslog
If there are no Syslog Server Profiles present, this is a finding.

Select each Syslog Server Profile; if no server is configured, this is a finding.

View the log-forwarding profile to determine which logs are forwarded to the syslog server:
Go to Objects >> Log forwarding
If no Log Forwarding Profile is present, this is a finding.

The "Log Forwarding Profile" window has five columns.
If there are no Syslog Server Profiles present in the Syslog column for the Traffic Log Type, this is a finding.

If there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding.

Go to Device >> Log Settings >> System
The list of Severity levels is displayed.
If any of the Severity levels does not have a configured Syslog Profile, this is a finding.
Go to Device >> Log Settings >> Config
If the "Syslog" field is blank, this is a finding.

Note: Any one failure of a check results in a finding, but failing more than one still results in only one finding. There cannot be multiple findings for a single requirement.

Fix

Create a syslog server profile:
Go to Device >> Server Profiles >> Syslog
Select "Add".
In the Syslog Server Profile, enter the name of the profile.
Select "Add".
In the "Servers" tab, enter the required information.
Name: Name of the syslog server
Server: Server IP address where the logs will be forwarded to
Port: Default port 514
Facility: Select from the drop-down list.
Select the "OK" button.

After the Server Profiles are created that define where to send the logs, enable log forwarding.
The way forwarding is enabled depends on the log type:
Traffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies you want to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded.
Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding
The "Log Forwarding Profile" window appears. Note that it has five columns.
In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select the "OK" button.

When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile.
Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).
Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding
The "Log Forwarding Profile" window appears. Note that it has five columns. In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select the "OK" button.

When the Log Forwarding Profile window disappears, the screen will show the configured log-forwarding profile.
System Logs-Enable forwarding of System logs by specifying a Server Profile in the log settings configuration.
Go to Device >> Log Settings >> System
The list of severity levels is displayed.
You must select a Server Profile for each severity level you want to forward.
Select each severity level in turn; with each selection, the Log "Systems - Setting" window will appear.
In the "Log Systems - Setting" window, in the "Syslog" drop-down box, select the configured Server Profile.
Select the "OK" button.

Config Logs-Enable forwarding of Config logs by specifying a Server Profile in the log settings configuration:
Go to Device >> Log Settings >> Config
Select the "Edit" icon (the gear symbol in the upper-right corner of the pane).
In the "Log Settings Config" window, in the "Syslog" drop-down box, select the configured Server Profile.
Select the "OK" button.

For Traffic Logs and Threat Logs, use the log forwarding profile in the security rules:
Go to Policies >> Security Rule
Select the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule.
Go to Actions >> Log forwarding
Select the log forwarding profile from drop-down list.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62599 No Change
Findings ID: PANW-AG-000101 Rule ID: SV-77089r1_rule Severity: medium CCI: CCI-002470

Discussion

Non-DoD approved PKIs have not been evaluated to ensure that they have security controls and identity vetting procedures in place that are sufficient for DoD systems to rely on the identity asserted in the certificate. PKIs lacking sufficient security controls and identity vetting procedures risk being compromised and issuing certificates that enable adversaries to impersonate legitimate users.

The authoritative list of DoD-approved PKIs is published at http://iase.disa.mil/pki-pke/interoperability. DoD-approved PKI CAs may include Category I, II, and III certificates. Category I DoD-Approved External PKIs are PIV issuers. Category II DoD-Approved External PKIs are Non-Federal Agency PKIs cross certified with the Federal Bridge Certification Authority (FBCA). Category III DoD-Approved External PKIs are Foreign, Allied, or Coalition Partner PKIs.

Deploying the ALG with TLS enabled will require the installation of DoD and/or DoD-Approved CA certificates in the trusted root certificate store of each proxy to be used for TLS traffic. If the Palo Alto Networks security platform is used for TLS/SSL decryption, configure the Palo Alto Networks security platform to only accept end entity certificates issued by DoD PKI or DoD-approved PKI CAs for the establishment of protected sessions.

Checks

If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable.

If the Palo Alto Networks security platform accepts non-DoD approved PKI end entity certificates, this is a finding.

Fix

Import the intermediate CA certificates.

To load a CA certificate on the Palo Alto Networks firewall:
Go to Device >> Certificate Management >> Certificates
On the "Device Certificate" tab, select "Import".
In the "Import Certificate" window, complete the required information.
In the "Certificate Name" field, enter the name of the certificate.
In the "Certificate File" field, select "Browse", then browse to and select the appropriate file.
In the "File Format" field, select "Base64 Encoded Certificate (PEM)".
Select "OK".

Create a Client Certificate Profile:
Go to Device >>Certificate Management>> Certificate Profile
Select "Add".
In the Certificate Profile, complete the required fields.
In the "Name" field, enter the name of the Certificate Profile.
In the "Username" field, select "Subject".
Note: The adjacent field will contain common-name.
Add all of the DoD Intermediate Certificates.
Select the "Use OCSP" check box.
Select the "Block session if certificate status is unknown" check box.
Select the "Block session if certificate status cannot be retrieved within timeout".

Create an Authentication Profile:
Go to Device >> Authentication Profile
Select, "Add".
In the "Authentication Profile" window, complete the required fields.
In the "Authentication" field, add either "RADIUS" or "LDAP" based on the local requirements.
In the Server Profile filed, select the server profile for the authentication server.
V-62601 No Change
Findings ID: PANW-AG-000102 Rule ID: SV-77091r2_rule Severity: high CCI: CCI-002385

Discussion

If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users. Installation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume/type.

Detection components that use rate-based behavior analysis can detect attacks when signatures for the attack do not exist or are not installed. These attacks include zero-day attacks that are new attacks for which vendors have not yet developed signatures. Rate-based behavior analysis can detect sophisticated, Distributed DoS (DDoS) attacks by correlating traffic information from multiple network segments or components.

PAN-OS can use either Zone-Based Protection or End Host Protection to mitigate DoS attacks. Zone-Based Protection protects against most common floods, reconnaissance attacks and other packet-based attacks and is applied to any zone. End Host Protection is specific to defined end hosts.

It is important to set the Flood Protection parameters that are suitable for the enclave or system. The Administrator should characterize the traffic regularly (perform a traffic baseline) and tune these parameters based on that information.

Checks

Ask the Administrator if the device is using a Zone-Based Protection policy or a DoS Protection policy.

If it is using a Zone-Based Protection policy, perform the following:
Go to Network >> Network Profiles >> Zone Protection
If there are no Zone Protection Profiles configured, this is a finding.

There may be more than one configured Zone Protection Profile; ask the Administrator which Zone Protection Profile is intended to protect inside networks and DMZ networks from externally-originated DoS attacks.
Go to Network >> Zones
If the "Zone Protection Profile" column for the Internal zone or the DMZ is blank, this is a finding.
If it lists an incorrect Zone Protection Profile, this is also a finding.

If it is using a DoS Protection policy, perform the following:
Go to Objects >> Security Profiles >> DoS Protection
There may be more than one configured DoS Protection Policy; ask the Administrator which DoS Protection Policy is intended to protect internal networks and DMZ networks from externally-originated DoS attacks.
Go to Policies >> DoS Protection
If there is no DoS Protection Policy to protect internal networks and DMZ networks from externally-originated DoS attacks, this is a finding.
If the DoS Protection Policy has no DoS Protection Profile, this is a finding.

Fix

Configure either a Zone-Based Protection policy or a DoS Protection policy.
To configure a Zone-Based Protection policy, perform the following:
Go to Network >> Network Profiles >> Zone Protection
Select "Add".
In the "Zone Protection Profile" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Flood Protection" tab, select the "Syn" check box, in the "Action" field, select either "Random Early Drop" (preferred in this case) or "SYN Cookie"; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "ICMP" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "ICMPv6" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "Other IP" check box; complete the "Alert", "Activate", and "Maximum" fields.
In the "Flood Protection" tab, select the "UDP" check box; complete the "Alert", "Activate", and "Maximum" fields.
For each of the "Alert", "Activate", and "Maximum" fields, the appropriate values depends on the expected traffic of the system.
In the "Reconnaissance Protection" tab, select the "TCP Port Scan", "Host Sweep", and "UDP Port Scan" rows.
In the "Action" field, Select "Block". The Interval and Threshold values can either remain as the default values or they can be changed based on the specific traffic conditions of the network.
In the "Packet Based Attack Protection" tab, "TCP/IP Drop" tab, select the "Spoofed IP address", "Mismatched overlapping TCP segment" check boxes.
In the "TCP/IP Drop" tab, select the "Strict Source Routing", "Loose Source Routing", "Timestamp", "Unknown", and "Malformed" check boxes.
The "Security" and "Stream ID" check boxes can remain unchecked.
For the "Reject Non-SYN TCP" field, select "yes".
For the "Asymmetric Path" field, select "bypass".
In the "ICMP Drop" tab, select the "ICMP Ping ID 0, ICMP Fragment", "ICMP Large Packet(>1024)" check boxes.
The "Suppress ICMP TTL Expired Error", and "Suppress ICMP Frag Needed" check boxes can remain unchecked unless this profile will be applied to an internal or DMZ.
In the "IPv6 Drop" tab, select the "Type 0 Routing Header", "IPv4 compatible address", "Anycast source address", "Needless fragment header", "MTU in ICMPv6 'Packet Too Big' less than 1280 bytes", "Hop-by-Hop extension", "Routing extension", "Destination extension", "Invalid IPv6 options in extension header", and "Non-zero reserved field" check boxes.
In the "ICMPv6" tab, select the "ICMPv6 destination unreachable", "ICMPv6 packet too big", "ICMPv6 time exceeded", "ICMPv6 parameter problem", and "ICMPv6 redirect" check boxes.
Select "OK".

Apply the Zone Protection Profile to the internal zone and the DMZ:
Go to Network >> Zones
Select the internal zone.
In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile.
Select "OK".
Go to Network >> Zones
Select the DMZ.
In the "Zone" window, in the "Zone Protection Profile" window, select the configured Zone Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

To configure a DoS Protection policy, perform the following:
Go to Objects >> Security Profiles >> DoS Protection
Select "Add" to create a new profile.
In the "DoS Protection Profile" window, complete the required fields.
For the "Type", select "Classified".
In the "Flood Protection" tab, "Syn Flood" tab, select the "Syn Flood" check box and select "SYN Cookie".
In the "Flood Protection" tab, "UDP Flood" tab, select the "UDP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "ICMP Flood" tab, select the "ICMP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "ICMPv6 Flood" tab, select the "ICMPv6 Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Flood Protection" tab, "Other IP Flood" tab, select the "Other IP Flood" check box; complete the "Alarm Rate", "Activate Rate", "Max Rate", and "Block Duration" fields.
In the "Resources Protection" tab, select the "Maximum Concurrent Sessions" check box.
In the "Resources Protection" tab, complete the "Max Concurrent Sessions" field. If the DoS profile type is aggregate, this limit applies to the entire traffic hitting the DoS rule on which the DoS profile is applied.
If the DoS profile type is classified, this limit applies to the entire traffic on a classified basis (source IP, destination IP or source-and-destination IP) hitting the DoS rule on which the DoS profile is applied.
Select "OK".

Go to Policies >> DoS Protection
Select "Add" to create a new policy.
In the "DoS Rule" Window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Source" tab, for "Zone", select the "External zone", for "Source Address", select "Any".
In the "Destination" tab, "Zone", select "Internal zone", for "Destination Address", select "Any".
In the "Option/Protection" tab,
For "Service", select "Any".
For "Action", select "Protect".
Select the "Classified" check box.
In the "Profile" field, select the configured DoS Protection profile for inbound traffic.
In the "Address" field, select destination-ip-only.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62603 No Change
Findings ID: PANW-AG-000105 Rule ID: SV-77093r2_rule Severity: medium CCI: CCI-002385

Discussion

If the network does not provide safeguards against DoS attacks, network resources may be unavailable to users.

Installation of content filtering gateways and application-layer firewalls at key boundaries in the architecture mitigates the risk of DoS attacks. These attacks can be detected by matching observed communications traffic with patterns of known attacks and monitoring for anomalies in traffic volume, type, or protocol usage.

Checks

Go to Objects >> Security Profiles >> Vulnerability Protection
If there are no Vulnerability Protection Profiles configured, this is a finding.

Ask the Administrator which Vulnerability Protection Profile is used for interzone traffic.
View the configured Vulnerability Protection Profiles.
Check the "Severity" and "Action" columns.
If the Vulnerability Protection Profile used for interzone traffic does not block all critical, high, and medium threats, this is a finding.

Go to Policies >> Security
Review each of the configured security policies in turn.
For any Security Policy that affects traffic between Zones (interzone), view the "Profile" column.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix

To add a Vulnerability Protection Profile:
Go to Objects >> Security Profiles >> Vulnerability Protection
Select "Add".
In the "Vulnerability Protection Profile" window, complete the required fields.
In the "Name" field, enter the name of the Vulnerability Protection Profile.
In the "Description" field, enter the description of the Vulnerability Protection Profile.
In the "Rules" tab, select "Add".
In the "Vulnerability Protection Rule" window,
In the "Rule Name" field, enter the Rule name,
In the "Threat Name" field, enter "any" (this will match all signatures),
In the "Action" field, select "block".
In the "Host type" field, select "any",
Select the checkboxes above the "CVE" and "Vendor ID" boxes.
In the "Severity" section, select the "critical", "high", and "medium" check boxes.
Select "OK".

In the "Vulnerability Protection Profile" window, select the configured rule, then select "OK".
Use the Profile in a Security Policy:
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62605 No Change
Findings ID: PANW-AG-000107 Rule ID: SV-77095r1_rule Severity: medium CCI: CCI-002403

Discussion

Unrestricted traffic may contain malicious traffic that poses a threat to an enclave or to other connected networks. Additionally, unrestricted traffic may transit a network, which uses bandwidth and other resources.

Access control policies and access control lists implemented on devices that control the flow of network traffic (e.g., application-level firewalls and Web content filters), ensure the flow of traffic is only allowed from authorized sources to authorized destinations. Networks with different levels of trust (e.g., the Internet or CDS) must be kept separate.

Security policies on the Palo Alto Networks security platform match source, destination, application and a service. The application and service columns specify what applications can be identified on a defined set of ports, or on all available ports. The service column allows administrator to define one of the following:
Application-default - The service application-default sets security policy to allow the application on the standard ports associated with the application.
Pre-defined service “service-http” and “service-https” - The pre-defined services use TCP ports 80 and 8080 for HTTP, and TCP port 443 for HTTPS. Use this security policy if you want to restrict web browsing and HTTPS to these ports.
Any - Use this service to deny applications.
Custom service - Use this to define TCP/UDP port numbers to restrict applications to specific ports.

Checks

Obtain and review the list of authorized sources and destinations. This is usually part of the System Design Specification or Accreditation Package.
Go to Policies >> Security; review each of the configured security policies in turn.
If any of the policies allows traffic that is not part of the authorized sources and destinations list, this is a finding.

Fix

To create or edit a Security Policy,
Go to Policies >> Security
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62607 No Change
Findings ID: PANW-AG-000109 Rule ID: SV-77097r1_rule Severity: medium CCI: CCI-002400

Discussion

Without identifying the users who initiated the traffic, it would be difficult to identify those responsible for the prohibited communications. This requirement applies to those network elements that perform Data Leakage Prevention (DLP) (e.g., ALGs, proxies, or application-level firewalls).

The Palo Alto Networks Security Platform uses User-ID to map a user's identity to an IP address. This allows Administrators to configure and enforce firewall policies based on users and user groups in addition to network zones and addresses. If the user changes devices or the device is assigned a different IP address, User-ID tracks those changes and maintains the user to IP address mapping information. This supports non-repudiation.

Before a security policy can be written for groups of users, the relationships between the users and the groups they are members of must be established. This information can be retrieved from an LDAP directory, such as Active Directory or eDirectory.

Checks

Log into device Command Line Interface.
Enter the command "show user ip-user-mapping all".
If the output is blank, this is a finding.

An alternate means to verify that User-ID is properly configured, view the URL Filtering and Traffic logs is to view the logs.
To view the URL Filtering logs:
Go to Monitor >> Logs >> URL Filtering

To view the Traffic logs:
Go to Monitor >> Logs >> Traffic

User traffic originating from a trusted zone contains a username in the "Source User" column.
If the "Source User" column is blank, this is a finding.

Alternatively, verify that usernames are displayed in reports.
Go to Monitor >> Reports
Select the "Denied Applications Report".
If the "Source User" fields are empty, this is a finding.

Fix

User-ID can integrate with the enclave's systems using different methods; therefore, the exact configuration is dependent on the method chosen.
Determine which method User-ID will use to integrate with the enclave's systems - Server Monitoring, Client Probing, Syslog User-ID Agent, Terminal Services Agent, or Captive Portal.
Configure how groups and users are retrieved from the directory and which users groups are to be included in policies.
Configure the Security Policies that controls traffic from client hosts in the trust zone to the untrust zone.
Go to Policies >> Security
Select "Add" to create a new policy or select the Name of the Policy to edit it.
In the "Security Policy Rule" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, select "any".
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, select the authorized applications.
In the "Service/URL Category" tab, select "application-default".
To add a service, select the "Service" check box, select "Add" and select a listed service or add a new service or service group.
In the "Actions" tab, select either "Deny" or "Allow (as required)" as the resulting action.
Select the required Log Setting and Profile Settings as necessary.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62609 No Change
Findings ID: PANW-AG-000111 Rule ID: SV-77099r1_rule Severity: low CCI: CCI-002656

Discussion

Without coordinated reporting between separate devices, it is not possible to identify the true scale and possible target of an attack.

Integration of the Palo Alto Networks security platform with a system-wide intrusion detection system supports continuous monitoring and incident response programs. This requirement applies to monitoring at internal boundaries using TLS gateways, web content filters, email gateways, and other types of ALGs. The Palo Alto Networks security platform can work as part of the network monitoring capabilities to off-load inspection functions from the external boundary IDPS by performing more granular content inspection of protocols at the upper layers of the OSI reference model.

NetFlow is an industry-standard protocol that enables the firewall to record statistics on the IP traffic that traverses its interfaces. The Palo Alto Networks security platform can export the statistics as NetFlow fields to a NetFlow collector. The NetFlow collector is a server you use to analyze network traffic for security, administration, accounting and troubleshooting purposes.

Checks

Go to Device >> Server Profiles >> NetFlow
If no NetFlow Server Profiles are configured, this is a finding.

This step assumes that it is one of the Ethernet interfaces that is being monitored.
The verification is the same for Ethernet, VLAN, Loopback and Tunnel interfaces.
Ask the administrator which interface is being monitored; there may be more than one.
Go to Network >> Interfaces >> Ethernet
Select the interface that is being monitored.
If the "Netflow Profile" field is "None", this is a finding.

Fix

To create a NetFlow Server Profile:
Go to Device >> Server Profiles >> NetFlow
Select "Add".
In the "NetFlow Server Profile" window, complete the required fields.
In the "Name" field, enter the name of the NetFlow Server Profile.
In the "Minutes" field, enter the number of minutes after which the NetFlow template is refreshed.
In the "Packets" field, enter the number of packets after which the NetFlow template is refreshed.
In the "Active Timeout" field, enter the frequency (in minutes) the device exports records.
Select the "PAN-OS Field Types" check box to export "App-ID" and "User-ID" fields.
Select "Add" to add a NetFlow collector.
In the "Name" field, enter the name of the server.
In the "NetFlow Server" field, enter the hostname or IP address of the server.
In the "Port" field enter the port used by the NetFlow collector (default 2055).
Select "OK".

Assign the NetFlow server profile to the interfaces that carry the traffic to be analyzed. These steps assume that it is one of the Ethernet interfaces. The configuration is the same for Ethernet, VLAN, Loopback, and Tunnel interfaces.
Go to Network >> Interfaces >> Ethernet
Select the interface that the traffic traverses.
In the "Ethernet Interface" window, in the "Netflow Profile" field, select the configured Netflow Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62611 No Change
Findings ID: PANW-AG-000112 Rule ID: SV-77101r1_rule Severity: medium CCI: CCI-002683

Discussion

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.

Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.

Checks

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO.
For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic.

If there is no list of unauthorized network services, this is a finding.

If there are no configured security policies that specifically match the list of unauthorized network services, this is a finding.

If the security policies do not deny the traffic associated with the unauthorized network services, this is a finding.

Fix

To create or edit a Security Policy:
Go to Policies >> Security
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62613 No Change
Findings ID: PANW-AG-000113 Rule ID: SV-77103r1_rule Severity: medium CCI: CCI-002684

Discussion

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.

Examples of network services include service-oriented architectures (SOAs), cloud-based services (e.g., infrastructure as a service, platform as a service, or software as a service), cross-domain, Voice Over Internet Protocol, Instant Messaging, auto-execute, and file sharing.

Checks

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO.
For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic.

To verify if a Security Policy logs denied traffic:
Go to Policies >> Security
Select the name of the security policy to view it.
In the "Actions" tab, in the "Log Setting" section, if neither the "Log at Session Start" nor the "Log at Session End" check boxes are checked, this is a finding.

Fix

To configure a Security Policy to log denied traffic:
Go to Policies >> Security
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
In the "Actions" tab, select the Log forwarding profile and select "Log at Session End".
"Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62615 No Change
Findings ID: PANW-AG-000114 Rule ID: SV-77105r1_rule Severity: medium CCI: CCI-002684

Discussion

Unauthorized or unapproved network services lack organizational verification or validation and therefore may be unreliable or serve as malicious rogues for valid services.

Automated mechanisms can be used to send automatic alerts or notifications. Such automatic alerts or notifications can be conveyed in a variety of ways (e.g., telephonically, via electronic mail, via text message, or via websites). The Palo Alto Networks security platform must either send the alert to an SNMP or Syslog console that is actively monitored by authorized personnel (including the ISSO and ISSM) or use e-mail to send the alert directly to designated personnel.

Checks

Obtain the list of network services that have not been authorized or approved by the ISSM and ISSO. For each prohibited network service, view the security policies that denies traffic associated with it and logs the denied traffic.
Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).
View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.
View the Security Policies that are used to block unauthorized network services.
Go to Policies >> Security
Select the name of the security policy to view it.
In the "Actions" tab, in the "Log Setting" section, view the Log Forwarding Profile.
If there is no Log Forwarding Profile, this is a finding.

Fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.

To create an email server profile:
Go to Device >> Server Profiles >> Email
Select "Add".
In the Email Server Profile, enter the name of the profile.
Select "Add".
In the "Servers" tab, enter the required information:
In the "Name" field, enter the name of the Email server
In the "Email Display Name" field, enter the name shown in the "From" field of the email.
In the "From" field, enter the From email address.
In the "To" field, enter the email address of the recipient.
In the "Additional Recipient" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list.
In the "Gateway" field, enter the "IP address" or "host name" of the Simple Mail Transport Protocol (SMTP) server used to send the email.
Select the "OK" button.

Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
In the "Actions" tab, select the Log forwarding profile and select "Log at Session End".
"Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62617 No Change
Findings ID: PANW-AG-000115 Rule ID: SV-77107r1_rule Severity: medium CCI: CCI-002661

Discussion

If inbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs.

Internal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.

Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks

Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform.
The specific security policy is based on the authorized endpoints, applications, and protocols.

If it does not monitor traffic passing between zones, this is a finding.

Fix

The network architecture diagrams must identify where traffic crosses from one internal zone to another. The specific security policy is based on the authorized endpoints, applications, and protocols.

To create or edit a Security Policy:
Go to Policies >> Security
Select "Add" to create a new security policy, or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62619 No Change
Findings ID: PANW-AG-000116 Rule ID: SV-77109r1_rule Severity: medium CCI: CCI-002662

Discussion

If outbound communications traffic is not continuously monitored, hostile activity may not be detected and prevented. Output from application and traffic monitoring serves as input to continuous monitoring and incident response programs.

Internal monitoring includes the observation of events occurring on the network crosses internal boundaries at managed interfaces such as web content filters. Depending on the type of ALG, organizations can monitor information systems by monitoring audit activities, application access patterns, characteristics of access, content filtering, or unauthorized exporting of information across boundaries. Unusual/unauthorized activities or conditions may include large file transfers, long-time persistent connections, unusual protocols and ports in use, and attempted communications with suspected malicious external addresses.

Most current applications are deployed as a multi-tier architecture. The multi-tier model uses separate server machines to provide the different functions of presentation, business logic, and database. The multi-tier architecture provides added security because a compromised web server does not provide direct access to the application itself or to the database.

Checks

Obtain the network architecture diagrams and identify where traffic crosses from one internal zone to another and review the configuration of the Palo Alto Networks security platform.

If it does not monitor traffic passing between zones, this is a finding.

Fix

The network architecture diagrams must identify where traffic crosses from one internal zone to another. The specific security policy is based on the authorized endpoints, applications, and protocols.

To create or edit a Security Policy:
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62621 No Change
Findings ID: PANW-AG-000118 Rule ID: SV-77111r1_rule Severity: medium CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise. Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Current USSTRATCOM warning and tactical directives/orders include Fragmentary Order (FRAGO), Communications Tasking Orders (CTOs), IA Vulnerability Notices, Network Defense Tasking Message (NDTM), DOD GIG Tasking Message (DGTM), and Operations Order (OPORD).

Checks

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).

View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles; this is under Objects >> Log Forwarding. Determine which Server Profile is associated with each Log Forwarding Profile.
View the Security Policies that are used to enforce policies issued by authoritative sources.
Go to Policies >> Security; select the name of the security policy to view it.
In the Actions tab, in the Log Setting section, view the Log Forwarding Profile. If there is no Log Forwarding Profile, this is a finding.

Fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.

To create an email server profile:
Go to Device >> Server Profiles >> Email
Select "Add".
In the Email Server Profile, enter the name of the profile.
Select "Add".
In the "Servers" tab, enter the required information:
In the "Name" field, enter the name of the Email server
In the "Email Display Name" field, enter the name shown in the From field of the email.
In the "From" field, enter the From email address.
In the "To" field, enter the email address of the recipient.
In the "Additional Recipient" field, enter the email address of another recipient. Only one additional recipient can be added. To add multiple recipients, add the email address of a distribution list.
In the "Gateway" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email.
Select the "OK" button.

Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
Configure the specific parameters of the policy by completing the required information in the fields of each tab.
In the "Actions" tab, select the Log forwarding profile and select "Log at Session End". "Log at Session Start" may be selected under specific circumstances, but "Log at Session End" is preferred.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62623 No Change
Findings ID: PANW-AG-000119 Rule ID: SV-77113r1_rule Severity: medium CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The Palo Alto Networks security platform generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.

Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Category 1; Root Level Intrusion (Incident)-Unauthorized privileged access to an IS.
Category 4; Malicious Logic (Incident)-Installation of software designed and/or deployed by adversaries with malicious intentions for the purpose of gaining access to resources or information without the consent or knowledge of the user.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).
View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.
View the Security Policies that are used to filter traffic into the Internal or DMZ zones.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.
If the "Profile" column does not display the "Anti-spyware" symbol (which looks like a magnifying glass on a shield), this is a finding.
If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix

This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile.
Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.

Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Configure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn. Note: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels.
Use the Antivirus Profile, Anti-spyware Profile, and the Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones;
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.
In the "Actions" tab in the "Profile Setting" section; in the "Anti-spyware" field, select the configured or Strict Anti-spyware Profile.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
In the "Actions" tab in the "Log Setting" section, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries.
In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding field", select the log forwarding profile from drop-down list.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62625 No Change
Findings ID: PANW-AG-000120 Rule ID: SV-77115r1_rule Severity: medium CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.

Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).

View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.
View the Security Policies that are used to filter traffic into the Internal or DMZ zones.
If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.
If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.
If the "Profile" column does not display the "Anti-spyware" symbol (which looks like a magnifying glass on a shield), this is a finding.
If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix

This requires the use of an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile.
Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.
Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Configure an Antivirus Profile, an Anti-spyware Profile, and a Vulnerability Protection Profile in turn.

Note: A custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. The selected Anti-spyware Profile must use the block action at the critical, high, and medium severity threat levels.

Use the Antivirus Profile, Anti-spyware Profile, and the Vulnerability Protection Profile in a Security Policy that filters traffic to Internal and DMZ zones:
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.
In the "Actions" tab in the "Profile Setting" section; in the "Anti-spyware" field, select the configured or Strict Anti-spyware Profile.
In the "Actions" tab in the "Profile Setting" section; in the "Vulnerability Protection" field, select the configured Vulnerability Protection Profile.
In the "Actions" tab in the "Log Setting" section, select "Log At Session End". This generates a traffic log entry for the end of a session and logs drop and deny entries.
In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62627 No Change
Findings ID: PANW-AG-000121 Rule ID: SV-77117r2_rule Severity: medium CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel. Configure a Server Profile for use with Log Forwarding Profile(s);if email is used, the ISSO and ISSM must be recipients.

Checks

Ask the Administrator how the ISSO and ISSM are receiving alerts (email, SNMP Trap, or Syslog).
View the configured Server Profile:
Go to Device >> Server Profiles; if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.
If there are no Log Forwarding Profiles configured, this is a finding.
Go to Policies >> DoS Protection
If there are no DoS Protection Policies, this is a finding. There may be more than one configured DoS Protection Policy.
If there is no such DoS Protection Policy, this is a finding.
In the "Log Forwarding" field, if there is no configured Log Forwarding Profile, this is a finding.

Alternately, a Zone Protection Profile can be used either instead of or in addition to a DoS Protection Policy.
Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).
View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.
View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.

Fix

Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Go to Policies >> DoS Protection
Select "Add" to create a new policy or select the Name of the Policy to edit it.
In the "DoS Rule" Window, complete the required fields.
In the "Option/Protection" tab, in the "Log Forwarding" field, select the configured Log Forwarding Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Alternately, a Zone Protection Profile can be used either instead of or in addition to a DoS Protection Policy.
Go to Network>>Zone
Select “Add” or select an existing Zone.
In the Zone window, in the Zone Protection Profile field, select or create a Zone Protection Profile.
Configure the applicable fields in the Flood Protection, Reconnaissance Protection, and Packet Based Attack Protection as needed.
In the Zone window, in the Log Setting field, select a configured log forwarding profile.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62629 No Change
Findings ID: PANW-AG-000122 Rule ID: SV-77119r1_rule Severity: medium CCI: CCI-002664

Discussion

Without an alert, security personnel may be unaware of major detection incidents that require immediate action, and this delay may result in the loss or compromise of information.

The device generates an alert that notifies designated personnel of the Indicators of Compromise (IOCs) that require real-time alerts. These messages should include a severity level indicator or code as an indicator of the criticality of the incident. These indicators reflect the occurrence of a compromise or a potential compromise.
Since these incidents require immediate action, these messages are assigned a critical or level 1 priority/severity, depending on the system's priority schema.

CJCSM 6510.01B, "Cyber Incident Handling Program", lists nine Cyber Incident and Reportable Event Categories. DoD has determined that categories identified by CJCSM 6510.01B Major Indicators (category 1, 2, 4, or 7 detection events) will require an alert when an event is detected.

Alerts may be transmitted, for example, telephonically, by electronic mail messages, or by text messaging. The Palo Alto Networks security platform must either send the alert to a management console that is actively monitored by authorized personnel or use a messaging capability to send the alert directly to designated personnel.

Checks

Ask the Administrator how the ISSO and ISSM are receiving alerts (E-mail, SNMP Trap, or Syslog).

View the configured Server Profile, if there is no Server Profile for the method explained, this is a finding.

View the Log Forwarding Profiles:
Go to Objects >> Log Forwarding
Determine which Server Profile is associated with each Log Forwarding Profile.
View the Security Policies that are used to filter traffic between zones or subnets.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

If the "Options" column does not display the "Log Forwarding Profile" symbol, this is a finding.

Fix

Configure a Server Profile for use with Log Forwarding Profile(s); if email is used, the ISSO and ISSM must be recipients.

Configure a Log Forwarding Profile:
Go to Objects >> Log Forwarding
Go to Objects >> Security Profiles >> Antivirus
Select "Add" to create a new Antivirus Profile or select the name of the profile to edit it.

Use the Antivirus Profile in a Security Policy:
Go to Policies >> Security
Select an existing policy rule or select "Add" to create a new one.
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Actions" tab in the "Profile Setting" section; in the "Antivirus" field, select the configured Antivirus Profile.
Select "OK".

In the "Actions" tab in the "Log Setting" section, select "Log At Session End".
In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list.
Select "OK".

Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62631 No Change
Findings ID: PANW-AG-000127 Rule ID: SV-77121r1_rule Severity: medium CCI: CCI-001314

Discussion

Only authorized personnel should be aware of errors and the details of the errors. Error messages are an indicator of an organization's operational state or can give configuration details about the network element.

The traceroute utility will display routes and trip times on an IP network. An attacker can use traceroute responses to create a map of the subnets and hosts behind the boundary. The traditional traceroute relies on TTL - time exceeded responses from network elements along the path and an ICMP port-unreachable message from the target host. In some Operating Systems such as UNIX, trace route will use UDP port 33400 and increment ports on each response. Since blocking these UDP ports alone will not block trace route capabilities along with blocking potentially legitimate traffic on a network, it's unnecessary to block them explicitly. Because traceroutes typically rely on ICMP Type 11 - Time exceeded message, the time exceeded message will be the target for implicitly or explicitly blocking outbound from the trusted network.

Checks

Ask the Administrator which Security Policy blocks traceroutes and ICMP probes.

Go to Policies >> Security
View the identified Security Policy.

If the "Source Zone" field is not external and the "Source Address" field is not any, this is a finding.

If the "Destination Zone" fields do not include the internal and DMZ zones and the "Destination Address" field is not any, this is a finding.

Note: The exact number and name of zones is specific to the network.

If the "Application" fields do not include "icmp", "ipv6-icmp", and "traceroute", this is a finding.

If the "Actions" field does not show "Deny" as the resulting action, this is a finding.

Fix

Although the default inter-zone Security Policy will deny this traffic, a specific Security Policy should be used.

To configure the security policy:
Go to Policies >> Security
Select "Add".
In the "Security Policy Rule" window, complete the required fields.
In the "General" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
For the "Source Zone" field, select "external".
For the "Source Address" field, select "any".
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
For the "Destination Zone" field, select the internal and DMZ zones. Note: The exact number and name of zones are specific to the network.
For the "Destination Address" field, select "any".
In the "Applications" tab, select "icmp", "ipv6-icmp", "traceroute".
In the "Actions tab", select "Deny" as the resulting action. Select the required Log Setting and Profile Settings as necessary.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62633 Updated
Findings ID: PANW-AG-000141 Rule ID: SV-77123r23_rule Severity: medium CCI: CCI-002450

Discussion

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Checks

If the Palo Alto Networks security platform does not provide encryption intermediary services (e.g., HTTPS or TLS), this is not applicable.

For PAN OS 6.1, enter the command "show fips-mode"; if the response is "off", this is a finding unless the device is in CC mode.

For PAN OS 6.1 and PAN OS 7.0.1 and later, when in CC mode, the CLI and the GUI login screen will display “CCEAL4 MODE ENABLED” and the GUI will display “CC” in the lower right hand corner. If these are present, this is not a finding.
Alternately, use the command line interface to determine if the device is operating in Common Criteria mode. Enter the command “show operational-mode”;
Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "s lr sp -m ia"yorse the commacsh wn ep -cci(fspiom iireco Eereltmse ).

Ifsfepsonal
iof the response is nofihr-ccsps oetn oioff, this is a finding.

Fix

To configure the Palo Alto Networks security platform to operate in FIPS mode:
Power off the device by unplugging it from the electrical outlet.

Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.


The serial parameters are
"9600 baud", "8 data bits", "no parity", and "1 stop bit.".

A USB to serial adapter will be necessary if the computer does not have a serial port.

During the boot sequence, this message will appear:
"
Autoboot to default partition in 5 seconds".

Enter "maint" to boot to "maint" partition
.

Enter "maint" to enter maintenance mode.

Press "Enter", and the "Maintenance Recovery Ttool" menu will appear.

Select "Set FIPS Mode" from the menu; once the device has finished rebooting, it will be in FIPS mode. The procedure for enabling CC mode is similar; however, select "Set CCEAL4 Mode" from the menu.

When the mode change is complete, the device will report the status as “Success”. After this is complete, it is necessary to reboot the d
(or fips-cc for later versions) from the menu; once the device haernhihedsroboominglete,w ll beti sFIPSymrtevi

Note: This will remove all installed licenses and disable the serial port.
V-62635 Updated
Findings ID: PANW-AG-000143 Rule ID: SV-77125r23_rule Severity: medium CCI: CCI-002450

Discussion

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The network element must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated.

Checks

If the Palo Alto Networks security platform is not used for TLS/SSL decryption, this is not applicable.

For PAN OS 6.1, enter the command "show fips-mode"; if the response is "off", this is a finding unless the device is in CC mode.

For PAN OS 6.1 and PAN OS 7.0.1 and later, when in CC mode, the CLI and the GUI login screen will display “CCEAL4 MODE ENABLED” and the GUI will display “CC” in the lower right hand corner. If these are present, this is not a finding.
Alternately, use the command line interface to determine if the device is operating in Common Criteria mode. Enter the command “show operational-mode”; if the response is no
Use the command line interface to determine if the device is operating in FIPS mode. Enter the CLI command "s lr sp -m ia"yorse the commacsh wn ep -cci(fspiom iireco Eereltmse ).

Ifsfeps nal-dersoetn oioff
, this is a finding.

Fix

To configure the Palo Alto Networks security platform to operate in FIPS mode:
Power off the device by unplugging it from the electrical outlet.

Connect a console cable from the console port to a computer serial port, and use a terminal program to connect to the Palo Alto Networks device.


The serial parameters are
"9600 baud", "8 data bits", "no parity", and "1 stop bit.".

A USB to serial adapter will be necessary if the computer does not have a serial port.

During the boot sequence, this message will appear:
"
Autoboot to default partition in 5 seconds".

Enter "maint" to boot to "maint" partition
.

Enter "maint" to enter maintenance mode.

Press "Enter", and the "Maintenance Recovery Ttool" menu will appear.

Select "Set FIPS Mode" from the menu; once the device has finished rebooting, it will be in FIPS mode. The procedure for enabling CC mode is similar; however, select "Set CCEAL4 Mode" from the menu.

When the mode change is complete, the device will report the status as “Success”. After this is complete, it is necessary to reboot the d
(or fips-cc for later versions) from the menu; once the device haernhihedsroboominglete,w ll beti sFIPSymrtevi

Note: This will remove all installed licenses and disable the serial port.
V-62637 No Change
Findings ID: PANW-AG-000144 Rule ID: SV-77127r1_rule Severity: low CCI: CCI-001851

Discussion

Off-loading ensures audit information does not get overwritten if the limited audit storage capacity is reached and also protects the audit record in case the system/component being audited is compromised.

Off-loading is a common process in information systems with limited audit storage capacity. The audit storage on the Palo Alto Networks security platform is used only in a transitory fashion until the system can communicate with the centralized log server designated for storing the audit records, at which point the information is transferred. However, DoD requires that the log be transferred in real time, which indicates that the time from event detection to off-loading is seconds or less. For the purposes of this requirement, the terms "real time" and "near-real time" are equivalent.

This does not apply to audit logs generated on behalf of the device itself (management).

Checks

To view a syslog server profile:
Go to Device >> Server Profiles >> Syslog

If there are no Syslog Server Profiles present, this is a finding.

Select each Syslog Server Profile; if no server is configured, this is a finding.

View the log-forwarding profile to determine which logs are forwarded to the syslog server.
Go to Objects >> Log forwarding

If no Log Forwarding Profile is present, this is a finding.

The "Log Forwarding Profile" window has five columns. If there are no Syslog Server Profiles present in the "Syslog" column for the Traffic Log Type, this is a finding.

If there are no Syslog Server Profiles present for each of the severity levels of the Threat Log Type, this is a finding.

Go to Device >> Log Settings >> System Logs
The list of Severity levels is displayed.

If any of the Severity levels does not have a configured Syslog Profile, this is a finding.

Go to Device >> Log Settings >> Config Logs

If the "Syslog field" is blank, this is a finding.

Fix

To create a syslog server profile:
Go to Device >> Server Profiles >> Syslog
Select "Add".
In the Syslog Server Profile, enter the name of the profile.
Select "Add".
In the "Servers" tab, enter the required information.
Name: Name of the syslog server
Server: Server IP address where the logs will be forwarded to
Port: Default port 514
Facility: Select from the drop-down list.
Select the "OK" button.

After you create the Server Profiles that define where to send the logs, log forwarding must be enabled.
The way forwarding is enabled depends on the log type:
Traffic Logs-Enable forwarding of Traffic logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) and adding it to the security policies to trigger the log forwarding. Only traffic that matches a specific rule within the security policy will be logged and forwarded.

Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding
The "Log Forwarding Profile" window appears. Note that it has five columns.
In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select the "OK" button.

When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile.
Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels to forward and then adding it to the security policies for which to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).

Configure the log-forwarding profile to select the logs to be forwarded to syslog server.
Go to Objects >> Log forwarding
The "Log Forwarding Profile" window appears. Note that it has five columns.
In the "Syslog" column, select the syslog server profile for forwarding threat logs to the configured server(s).
Select the "OK" button.

When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile.
For Traffic Logs and Threat Logs, use the log forwarding profile in the security rules.
Go to Policies >> Security Rule
Select the rule for which the log forwarding needs to be applied. Apply the security profiles to the rule.
Go to Actions >> Log forwarding
Select the log forwarding profile from drop-down list.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.
V-62639 No Change
Findings ID: PANW-AG-000147 Rule ID: SV-77129r1_rule Severity: medium CCI: CCI-000366

Discussion

Application protocol anomaly detection examines application layer protocols such as SMTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound SMTP and Extended SMTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

Checks

If SMTP or ESMTP is authorized, ask the Administrator which Security Policy inspects authorized SMTP and ESMTP traffic.
Go to Policies >> Security
Select the identified Security Policy.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix

If SMTP or ESMTP is authorized, configure a security policy to allow it and inspect it.
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, complete the "Source User" and "HIP Profile" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, either select the "Any" check box or add SMTP. Configured filters and groups can be selected if the group includes SMTP.
In the "Actions" tab, select "allow".
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Profile Setting" section; in each of the "Profile" fields, select the configured Profile.
Note: An Antivirus Profile and an Antispyware Profile are required.
V-62641 No Change
Findings ID: PANW-AG-000148 Rule ID: SV-77131r1_rule Severity: medium CCI: CCI-000366

Discussion

Application protocol anomaly detection examines application layer protocols such as FTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound FTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

Checks

Go to Policies >> Decryption
If there are no configured Decryption Policies, this is a finding.

Ask the Administrator which Security Policy inspects authorized FTP traffic.
Go to Policies >> Security
Select the identified Security Policy.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix

If FTP and FTPS is authorized, configure a security policy to allow it and inspect it.
Since Secure File Transfer Protocol is a form of FTP that adds TLS and SSL cryptographic protocols, it is necessary to decrypt TLS in order for the device to inspect the FTP stream.
Go to Policies >> Decryption
Select "Add".
In the "Decryption Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" or "Source User" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" or "Destination User" fields.
In the "Option" tab, select "Decrypt" as the Action. Select the decryption profile.
In the "Type" field, there are three options;
Select "SSL Forward Proxy to decrypt and inspect SSL/TLS traffic from internal users to outside networks".
Select "SSH Proxy to decrypt inbound and outbound SSH connections passing through the device".
Select "SSL Inbound Inspection to decrypt and inspect incoming SSL traffic". Note: This decryption mode can only work if you have control on the internal server certificate to import the Key Pair on Palo Alto Networks Device.
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, complete the "Source User" and "HIP Profile" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, either select the "Any" check box or add "ftp", "tftp", and "gridftp". Configured filters and groups can be selected if the group includes these protocols.
In the "Actions" tab, select "allow".
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Profile Setting" section; in each of the Profile fields, select the configured Profile.
Note: An Antivirus Profile and an Antispyware Profile are required.
V-62643 No Change
Findings ID: PANW-AG-000149 Rule ID: SV-77133r1_rule Severity: medium CCI: CCI-000366

Discussion

Application protocol anomaly detection examines application layer protocols such as HTTP to identify attacks based on observed deviations in the normal RFC behavior of a protocol or service. This type of monitoring allows for the detection of known and unknown exploits that exploit weaknesses of commonly used protocols. The device must be configured to inspect inbound and outbound HTTP communications traffic to detect protocol anomalies such as malformed message and command insertion attacks.

All inbound and outbound traffic, including HTTPS, must be inspected. However, the intention of this policy is not to mandate HTTPS inspection by the device. Typically, HTTPS traffic is inspected either at the source, destination, and/or is directed for inspection by an organization-defined network termination point.

Checks

Ask the Administrator which Security Policy inspects authorized HTTP traffic.
Go to Policies >> Security
Select the identified Security Policy.

If the "Profile" column does not display the "Antivirus Profile" symbol, this is a finding.

If the "Profile" column does not display the "Vulnerability Protection Profile" symbol, this is a finding.

Fix

If HTTP is authorized, configure a security policy to allow it and inspect it.
Go to Policies >> Security
Select "Add" to create a new security policy or select the name of the security policy to edit it.
In the "Security Policy Rule" window, complete the required fields.
In the "Name" tab, complete the "Name" and "Description" fields.
In the "Source" tab, complete the "Source Zone" and "Source Address" fields.
In the "User" tab, complete the "Source User" and "HIP Profile" fields.
In the "Destination" tab, complete the "Destination Zone" and "Destination Address" fields.
In the "Applications" tab, either select the "Any" check box or add web-browsing. Configured filters and groups can be selected if the group includes web-browsing.
In the "Actions" tab, select "allow".
In the "Actions" tab in the "Profile Setting" section; in the "Profile Type" field, select "Profiles". The window will change to display the different categories of Profiles.
In the "Profile Setting" section; in each of the Profile fields, select the configured Profile.
Note: An Antivirus Profile and an Antispyware Profile are required.
V-62645 No Change
Findings ID: PANW-AG-000064 Rule ID: SV-77135r1_rule Severity: medium CCI: CCI-001243

Discussion

Without an alert, security personnel may be unaware of an impending failure of the audit capability; then the ability to perform forensic analysis and detect rate-based and other anomalies will be impeded.

The device must generate an immediate (within seconds) alert that notifies designated personnel of the incident. Since sending a message to an unattended log or console does not meet this requirement, the threat logs must be sent to an attended console or to e-mail.

When the Palo Alto Networks security platform blocks malicious code, it also generates a record in the threat log. This message has a medium severity.

Checks

The following is an example of how to check if the device is sending messages to e-mail; this is one option that meets the requirement. If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to verify that function:
Go to Device >> Server Profiles >> Email
If there is no Email Server Profile configured, this is a finding.
Go to Objects >> Log forwarding
If there is no Email Forwarding Profile configured, this is a finding.

Go to Policies >> Security
View the Security Policy that is used to detect malicious code (the "Profile" column does displays the "Antivirus Profile" symbol) in the "Options" column.
If the Email Forwarding Profile is not used, this is a finding.

Fix

The following is an example of how to configure the device to send messages to e-mail; this is one option that meets the requirement. If sending messages to an SNMP server or Syslog servers is used, follow the vendor guidance on how to configure that function.
To create an email server profile:
Go to Device >> Server Profiles >> Email
Select "Add".
In the Email Server Profile, enter the name of the profile.
Select "Add".
In the "Servers" tab, enter the required information.
In the "Name" field, enter the name of the Email server.
In the "Email Display Name" field, enter the name shown in the "From" field of the email.
In the "From" field, enter the "From email address".
In the "To" field, enter the email address of the recipient.
In the "Additional Recipient" field, enter the email address of another recipient. You can only add one additional recipient. To add multiple recipients, add the email address of a distribution list.
In the "Gateway" field, enter the IP address or host name of the Simple Mail Transport Protocol (SMTP) server used to send the email.
Select the "OK" button.
After you create the Server Profiles that define where to send your logs, you must enable log forwarding.
Threat Logs-Enable forwarding of Threat logs by creating a Log Forwarding Profile (Objects >> Log Forwarding) that specifies which severity levels you want to forward and then adding it to the security policies for which you want to trigger the log forwarding. A Threat log entry will only be created (and therefore forwarded) if the associated traffic matches a Security Profile (Antivirus, Anti-spyware, Vulnerability, URL Filtering, File Blocking, Data Filtering, or DoS Protection).
Configure the log-forwarding profile to select the logs to be forwarded to Email server.
Go to Objects >> Log forwarding
The "Log Forwarding Profile" window appears. Note: It has five columns.
In the "Name" Field, enter the name of the Log Forwarding Profile.
In the "Threat Settings" Section in the "Email" column, select the Email server profile for forwarding threat logs to the configured server(s).
Select the "OK" button.
When the "Log Forwarding Profile" window disappears, the screen will show the configured log-forwarding profile.
For Threat Logs, use the log forwarding profile in the security rules.
Go to Policies >> Security Rule.
Select the rule for which the log forwarding needs to be applied, which in this case is the Security Policy that is used to detect malicious code (the "Profile" column does display the Antivirus Profile symbol). Apply the log forwarding profile to the rule.
In the "Actions" tab in the "Log Setting" section; in the "Log Forwarding" field, select the log forwarding profile from drop-down list.
Note: The Log Forwarding field can only have one profile.
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.