IPsec profile uses insecure authentication protocols on Palo Alto Networks devices misconfiguration

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_13
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	OTHER
Severity	MEDIUM
Framework	Ansible

Impact

This rule detects whether IPsec profiles in Palo Alto Networks devices use insecure protocols. Specifically, it emphasizes avoiding the AH (Authentication Header) protocol in IPsec configurations due to its lack of encryption and lower security compared to ESP (Encapsulating Security Payload). It promotes the use of ESP for secure IPsec tunnels.

How to Fix

Resource: panos_security_rule

• Attribute: application

To mitigate this issue, define the application attribute in your panos_security_rule resources with specific applications instead of 'any'. Specifying applications enhances security by ensuring that only traffic corresponding to the defined applications is matched by the rule.

Secure Code Example:

In this example, setting the application to specific values rather than 'any' ensures that only traffic corresponding to the defined applications is matched by the rule, thereby enhancing network security. [source,go]

• name: Ensure application is defined specifically in security rules paloaltonetworks.panos.panos_security_rule: name: "example-rule" application: ['web-browsing', 'ssl']

---