CIS Palo Alto Firewall PAN-OS 11 Benchmark

This recommendation verifies that Admin Accounts Use Strong Passwords on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to admin Accounts Use Strong Passwords may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# CLI:
show deviceconfig system password-complexity

# GUI: Device → Setup → Management → Minimum Password Complexity

set deviceconfig system password-complexity enabled yes
set deviceconfig system password-complexity minimum-length 14
set deviceconfig system password-complexity minimum-uppercase-letters 1
set deviceconfig system password-complexity minimum-lowercase-letters 1
set deviceconfig system password-complexity minimum-numeric-letters 1
set deviceconfig system password-complexity minimum-special-characters 1
commit

This setting ensures that Management Interface Access is restricted on the Palo Alto PAN-OS firewall. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Management Interface Access could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Palo Alto PAN-OS firewall is essential for defense in depth.

show deviceconfig system permitted-ip

set deviceconfig system permitted-ip 10.0.0.0/24
delete deviceconfig system permitted-ip 0.0.0.0/0
commit

This setting controls whether HTTP Access to Management is disabled on the Palo Alto PAN-OS firewall. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving HTTP Access to Management enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Palo Alto PAN-OS firewall.

show deviceconfig system service disable-http

set deviceconfig system service disable-http yes
commit

This setting controls whether Telnet Access is disabled on the Palo Alto PAN-OS firewall. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Telnet Access enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Palo Alto PAN-OS firewall.

show deviceconfig system service disable-telnet

set deviceconfig system service disable-telnet yes
commit

This recommendation addresses the proper configuration of Idle Timeout on the Palo Alto PAN-OS firewall. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Idle Timeout can lead to security gaps that may be exploited by attackers. A properly configured Palo Alto PAN-OS firewall reduces exposure to both known vulnerabilities and configuration drift.

show deviceconfig system idle-timeout

set deviceconfig system idle-timeout 10
commit

This recommendation verifies that Multi-Factor Authentication Is Enabled for Admins on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to multi-Factor Authentication Is Enabled for Admins may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# GUI: Device → Authentication Profile → verify MFA is configured
show deviceconfig system authentication-profile

# Configure RADIUS/SAML authentication profile with MFA:
set shared authentication-profile MFA-Profile method radius
set shared authentication-profile MFA-Profile multi-factor-auth mfa-enable yes
commit

This setting ensures that RADIUS/LDAP Communication uses encryption on the Palo Alto PAN-OS firewall. Encrypting data in transit and at rest protects sensitive information from interception and unauthorized disclosure.

Without encryption, RADIUS/LDAP Communication may transmit or store sensitive information in cleartext, exposing it to interception, eavesdropping, or tampering. Encryption is a critical control for data confidentiality and integrity.

show shared server-profile ldap
# Verify ssl: yes and verify-server-cert: yes

set shared server-profile ldap LDAP-Server ssl yes
set shared server-profile ldap LDAP-Server verify-server-certificate yes
commit

This recommendation verifies that Role-Based Admin Accounts Are Used on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to role-Based Admin Accounts Are Used may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show admins all

# Create role-based admin profiles:
set shared admin-role-profile SecOps role device webui
set mgt-config users auditor permissions role-based custom profile SecOps
commit

This recommendation addresses the proper configuration of Login Banner on the Palo Alto PAN-OS firewall. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Login Banner can lead to security gaps that may be exploited by attackers. A properly configured Palo Alto PAN-OS firewall reduces exposure to both known vulnerabilities and configuration drift.

show deviceconfig system login-banner

set deviceconfig system login-banner "Authorized users only. All activity is monitored and recorded."
commit

This recommendation verifies that Zone Protection Profiles Are Applied to All Zones on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to zone Protection Profiles Are Applied to All Zones may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show zone-protection zone all

set network profiles zone-protection-profile ZoneProtect flood tcp-syn enable yes
set network profiles zone-protection-profile ZoneProtect flood tcp-syn alert 1000
set network profiles zone-protection-profile ZoneProtect flood tcp-syn activate 5000
set vsys vsys1 zone untrust network zone-protection-profile ZoneProtect
commit

This setting controls whether Reconnaissance Protection is enabled on the Palo Alto PAN-OS firewall. Enabling this feature strengthens the security posture by enforcing the recommended configuration via PAN-OS CLI, Panorama, or the web management interface.

Without Reconnaissance Protection enabled, the Palo Alto PAN-OS firewall may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show network profiles zone-protection-profile ZoneProtect scan

set network profiles zone-protection-profile ZoneProtect scan tcp-port enable yes action block-ip duration 300
set network profiles zone-protection-profile ZoneProtect scan udp-port enable yes action block-ip duration 300
set network profiles zone-protection-profile ZoneProtect scan host-sweep enable yes action block-ip duration 300
commit

This setting controls whether Packet Buffer Protection is enabled on the Palo Alto PAN-OS firewall. Enabling this feature strengthens the security posture by enforcing the recommended configuration via PAN-OS CLI, Panorama, or the web management interface.

Without Packet Buffer Protection enabled, the Palo Alto PAN-OS firewall may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show network profiles zone-protection-profile ZoneProtect packet-buffer-protection

set network profiles zone-protection-profile ZoneProtect packet-buffer-protection enable yes
commit

This setting controls whether Unused Interfaces is disabled on the Palo Alto PAN-OS firewall. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Unused Interfaces enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Palo Alto PAN-OS firewall.

show interface all | match "down\|unconnected"

# Disable unused interfaces:
set network interface ethernet ethernet1/8 comment "Disabled - Unused"
set network interface ethernet ethernet1/8 link-state down
commit

This recommendation verifies that Management Profile Does Not Allow Unnecessary Services on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to management Profile Does Not Allow Unnecessary Services may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show network profiles interface-management-profile

# Only allow required services:
set network profiles interface-management-profile DataPlane-Mgmt ping yes
set network profiles interface-management-profile DataPlane-Mgmt https no
set network profiles interface-management-profile DataPlane-Mgmt ssh no
set network profiles interface-management-profile DataPlane-Mgmt http no
commit

This recommendation verifies that Default Deny Rule is present on the Palo Alto PAN-OS firewall. Having this configuration in place is essential for maintaining the expected security baseline defined by the CIS benchmark.

The absence of Default Deny Rule leaves the Palo Alto PAN-OS firewall without an important security control. Verifying its presence ensures the system meets the minimum security baseline required by the CIS benchmark.

show running security-policy | match "deny-all"

set rulebase security rules deny-all from any to any source any destination any application any service any action deny log-end yes
move rulebase security rules deny-all bottom
commit

This recommendation verifies that No Rules Use "any" for Both Source and Destination on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no Rules Use "any" for Both Source and Destination may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy
# Review for overly permissive any/any rules with action allow

# Replace broad "any" rules with specific source/destination zones and addresses

This recommendation verifies that All Rules Have Logging at Session End Enabled on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to all Rules Have Logging at Session End Enabled may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "log-end"

set rulebase security rules <rule-name> log-end yes
commit

This recommendation verifies that App-ID Is Used Instead of Port-Based Rules on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to app-ID Is Used Instead of Port-Based Rules may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy
# Verify rules use specific application names, not "any"

# Replace service-based rules with App-ID:
set rulebase security rules web-allow application web-browsing ssl
set rulebase security rules web-allow service application-default
commit

This recommendation verifies that Antivirus Profile Is Applied to All Allowed Rules on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to antivirus Profile Is Applied to All Allowed Rules may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "virus"

set profiles virus AV-Strict decoder http action reset-both
set profiles virus AV-Strict decoder smtp action reset-both
set rulebase security rules <rule-name> profile-setting profiles virus AV-Strict
commit

This recommendation verifies that Anti-Spyware Profile Is Applied on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to anti-Spyware Profile Is Applied may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "spyware"

set profiles spyware Strict-Spyware botnet-domains lists default-paloalto-dns action sinkhole
set profiles spyware Strict-Spyware rules simple-critical action reset-both severity critical
set rulebase security rules <rule-name> profile-setting profiles spyware Strict-Spyware
commit

This recommendation verifies that Vulnerability Protection Profile Is Applied on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to vulnerability Protection Profile Is Applied may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "vulnerability"

set profiles vulnerability Strict-VP rules critical action reset-both severity critical
set profiles vulnerability Strict-VP rules high action reset-both severity high
set rulebase security rules <rule-name> profile-setting profiles vulnerability Strict-VP
commit

This recommendation verifies that URL Filtering Profile Is Applied on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to uRL Filtering Profile Is Applied may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "url-filtering"

set profiles url-filtering Strict-URL credential-enforcement mode ip-user
set profiles url-filtering Strict-URL credential-enforcement log-severity high
set rulebase security rules <rule-name> profile-setting profiles url-filtering Strict-URL
commit

This recommendation verifies that WildFire Analysis Profile Is Applied on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to wildFire Analysis Profile Is Applied may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running security-policy | match "wildfire"

set profiles wildfire-analysis WildFire-Strict rules all-files application any file-type any direction both analysis public-cloud
set rulebase security rules <rule-name> profile-setting profiles wildfire-analysis WildFire-Strict
commit

This recommendation verifies that Minimum TLS Version Is 1.2 on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to minimum TLS Version Is 1.2 may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show shared ssl-tls-service-profile

set shared ssl-tls-service-profile Management-TLS protocol-settings min-version tls1-2
set shared ssl-tls-service-profile Management-TLS protocol-settings max-version max
commit

This setting controls whether Weak Cipher Suites is disabled on the Palo Alto PAN-OS firewall. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving Weak Cipher Suites enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the Palo Alto PAN-OS firewall.

show shared ssl-tls-service-profile Management-TLS protocol-settings enc-algo

set shared ssl-tls-service-profile Management-TLS protocol-settings enc-algo aes-256-gcm aes-128-gcm aes-256-cbc
commit

This recommendation addresses the proper configuration of SSL Forward Proxy Decryption on the Palo Alto PAN-OS firewall. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of SSL Forward Proxy Decryption can lead to security gaps that may be exploited by attackers. A properly configured Palo Alto PAN-OS firewall reduces exposure to both known vulnerabilities and configuration drift.

show running decryption-policy

# Configure SSL Forward Proxy decryption profile:
set shared decryption-profile Strict-Decrypt ssl-forward-proxy block-expired-certificate yes
set shared decryption-profile Strict-Decrypt ssl-forward-proxy block-untrusted-issuer yes
set rulebase decryption rules Decrypt-Outbound type ssl-forward-proxy
set rulebase decryption rules Decrypt-Outbound profile Strict-Decrypt
commit

This recommendation verifies that No-Decrypt Rules Have Justification on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to no-Decrypt Rules Have Justification may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show running decryption-policy | match "no-decrypt"

# Document all no-decrypt exemptions; limit to:
# - Financial/healthcare requiring end-to-end encryption
# - Certificate-pinned applications
set rulebase decryption rules NoDecrypt-Finance description "Regulatory requirement - banking TLS"
commit

This recommendation addresses the proper configuration of Log Forwarding to External SIEM on the Palo Alto PAN-OS firewall. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Log Forwarding to External SIEM can lead to security gaps that may be exploited by attackers. A properly configured Palo Alto PAN-OS firewall reduces exposure to both known vulnerabilities and configuration drift.

show log-forwarding-profile

set shared log-settings syslog SIEM-Server server SIEM transport TCP port 514 facility LOG_USER
set shared log-settings syslog SIEM-Server server SIEM server 10.0.1.50
commit

This recommendation verifies that Traffic Logs Are Forwarded on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to traffic Logs Are Forwarded may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show shared log-settings profiles Log-All match-list

set shared log-settings profiles Log-All match-list Traffic log-type traffic send-syslog SIEM-Server
set shared log-settings profiles Log-All match-list Threat log-type threat send-syslog SIEM-Server
commit

This recommendation verifies that SNMPv3 Is Used on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to sNMPv3 Is Used may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show deviceconfig system snmp-setting

set deviceconfig system snmp-setting version v3
set deviceconfig system snmp-setting access-setting version v3 views pan-view oid 1.3.6.1
commit

This setting controls whether Configuration Change Logs is enabled on the Palo Alto PAN-OS firewall. Enabling this feature strengthens the security posture by enforcing the recommended configuration via PAN-OS CLI, Panorama, or the web management interface.

Without Configuration Change Logs enabled, the Palo Alto PAN-OS firewall may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show shared log-settings config

set shared log-settings config match-list Config-Changes send-syslog SIEM-Server
commit

This setting controls whether HA Encryption is enabled on the Palo Alto PAN-OS firewall. Enabling this feature strengthens the security posture by enforcing the recommended configuration via PAN-OS CLI, Panorama, or the web management interface.

Without HA Encryption enabled, the Palo Alto PAN-OS firewall may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

show high-availability all | match "encryption"

set deviceconfig high-availability ha-communication encryption enabled yes
commit

This recommendation addresses the proper configuration of HA Heartbeat Backup on the Palo Alto PAN-OS firewall. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of HA Heartbeat Backup can lead to security gaps that may be exploited by attackers. A properly configured Palo Alto PAN-OS firewall reduces exposure to both known vulnerabilities and configuration drift.

show high-availability all | match "heartbeat-backup"

set deviceconfig high-availability interface ha1-backup port management
commit

This recommendation verifies that Dynamic Content Updates Are Scheduled on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to dynamic Content Updates Are Scheduled may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show system software status
request content upgrade check

# GUI: Device → Dynamic Updates → Schedule
# Set Antivirus updates to download-and-install every hour
# Set Applications & Threats to download-and-install daily
# Set WildFire to download-and-install every minute

This recommendation verifies that PAN-OS Is Running a Supported Version on the Palo Alto PAN-OS firewall. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to pAN-OS Is Running a Supported Version may leave the Palo Alto PAN-OS firewall vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

show system info | match "sw-version"

# Upgrade to latest supported PAN-OS release:
request system software download version 11.1.4
request system software install version 11.1.4