Security zone on Palo Alto Networks devices does not have an associated Zone Protection Profile misc

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_14
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	LOW
Framework	Ansible

Impact

This rule detects whether all security zones in Palo Alto Networks devices have an associated Zone Protection Profile. Zone Protection Profiles provide a set of countermeasures against various flood, reconnaissance, and packet-based attacks, enforcing essential protections at the zone level, bolstering the overall security posture.

How to Fix

Resource: panos_security_rule

• Attribute: service

To mitigate this issue, define specific services in security rules to enforce the intended access controls and enhance the overall security posture. Specify the service attribute in your panos_security_rule resources with exact service definitions, avoiding the use of any.

Secure Code Example:

In this example, defining the service attribute with precise values instead of 'any' ensures more granular and secure control of the network traffic. [source,go]

• name: Example ... tasks:

  • name: Example paloaltonetworks.panos.panos_security_rule: ... application: ['ssl']
•    service: ['any'] # Service is any

•    service: ['http', 'https']

---