What changed in Palo Alto Networks IDPS STIG V3R2V3R2 changes

Check text

AskVerify thea Administrator if any security policy allows ICMP from an internal zone orprotection DMZprofile to an outside zone. If there is none,configured thisfor iseach notoutgoing azone finding. If there is a security policy that allowsdrops ICMPall from an internal zone or DMZ to an outside zone, then a policy must be configured to deny outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages. Go1. toNavigate Objects >> Applications; if there are not three custom Applications to identifythe ICMP"Zone TypeProtection 3,Profile" 5,configuration and 18, this is a findingscreen. Go2. toSelect Policiesthe >>"Packet Security;Based ifAttack thereProtection" istab. 3. noSelect Security Policy using these three custom Applications with the resulting"ICMP action of Drop"deny", this is a findingtab. ThisIf Securitythe Policy"Discard mustICMP appearembedded abovewith anyerror Securitymessage" Policybox thatis allowsnot ICMPchecked fromfor aneach internal zone or DMZ to an outside zone; if it does not, this is a finding.

Fix text

Note:Create The interzone-default rule action is deny, so unless ICMP is specifically allowed by a policy, it will be denied. If there is an explicit security policy configured allowing ICMP from an internal zone orprotection DMZprofile tofor aneach outsideoutgoing zone, thenthat adrops policyany must be configured to deny outbound ICMP Destination Unreachable, Redirect, and Address Mask reply messages. Create1. threeNavigate custom Applications to identifythe ICMP Type 3, 5, and 18: Go to Objects >> Applications Select "Add". InZone theProtection Application window; complete the required fields In the Configuration tab, in the General section, complete the Name and Description Fields. In the Configuration tab, in the Properties section, for Category, select networking, for Subcategory, select infrastructure, and for Technology, select network-protocol. In the Advanced tab, in the Defaults section, select ICMP Type Enter Profile"3" sinceconfiguration ICMP Destination Unreachable is Type 3 Select OK Repeat this procedure two more times, using the values for ICMP Type are 5 and 18 since respectively since ICMP Redirect is Type 5 and ICMP Address Mask Reply is Type 18screen. Use these three Application filters in a Security Policy2. To configure the security policy: Go to Policies >> Security Select "Add". In the "SecurityPacket PolicyBased Rule"Attack window, complete the required fields. In the Protection"General" tab, complete the "Name" and "Description" fields. Select "interzone" for the Rule Type. In the "Source" tab, complete the "Source Zone" and "Source Address" fields3. For theSelect "Source Zone" field, select "internal". For the "SourceICMP AddressDrop" field, select "any". In the "Destination" tab, for the "Destination Address" field, select "any". Note: The "Destination Zone" window will be grayed out (unable to enter parameters)4. In theCheck "Applications" tab, select the three application filters configured above. In the "Actions"Discard tab,ICMP selectembedded "Deny"with aserror the resulting action. Select the required Log Setting and Profile Settings as necessary. Select message"OK". Commit changes by selecting "Commit" in the upper-right corner of the screenbox. Select "OK" when the confirmation dialog appears.

Discussion

Internet Control Message Protocol (ICMP) messages are used to provide feedback about problems in the network. These messages are sent back to the sender to support diagnostics. However, some messages can also provide host information and network topology that may be exploited by an attacker. ThreeReview ICMPthe messagesvendor aredocumentation commonly used by attackers for networkmore mapping:information Destinationabout Unreachable,"How Redirect,to andAllow/Block AddressICMP MaskError ReplyReporting Packets". Note Thesethat responsesthis mustsetting beis blockedonly onavailable externalin interfaces; however, blocking the DestinationZone UnreachableProtection responseprofile will prevent Path Maximum Transmission Unit Discovery (PMTUD)option, whichnot reliesin on the responseDoS "ICMPprotection Destination Unreachable--Fragmentation Needed but DF Bit Set"profile. PMTUDThus, iswhere aIDS useful function and should only be "broken" after careful consideration. An acceptable alternative to blocking all Destination Unreachable responses is topart filterof Destination Unreachable messages generated by the IDPSfunction toof allowPalo ICMP Destination Unreachable-Fragmentation Needed but DF Bit Set (Type 3Alto, Codea 4)Zone andProtection applyprofile thisis filterrequired to thecomply externalwith interfacesthis requirement.

V-207698 in V3R2

Check text

Go to Objects >> Security Profiles >> Vulnerability Protection. If there are no Vulnerability Protection Profiles configured, this is a finding.

CCIs

CCI-0023746

V-207701 in V3R2