Include ACL (Access Control List) not defined for a security zone in Palo Alto Networks devices with
Rule Details
Cortex AppSec Rule ID
APPSEC_PAN_15
Category - Subcategory
Public Exposure - Ingress Controls
Provider
OTHER
Severity
LOW
Framework
Ansible
Impact
This rule detects whether an 'Include ACL' (Access Control List) is defined when User-ID is enabled on a security zone in Palo Alto Networks devices. User-ID is a feature that maps IP addresses to users, allowing for policy enforcement based on user identity. When User-ID is enabled, the 'Include ACL' specifies which traffic should be included for user mapping. If the 'Include ACL' property is not defined, User-ID might incorrectly process or exclude important traffic.
How to Fix
Resource: panos_security_rule
Attributes: source_ip, destination_ip
To mitigate this risk, ensure that either the source_ip or destination_ip (or both) attributes in your panos_security_rule resources are configured with specific IP addresses or ranges instead of using any. This approach helps define precise and secure network traffic rules.
Secure Code Example:
In this example, specifying exact IP addresses or ranges for source_ip and destination_ip ensures that the security rule does not unintentionally permit all traffic. [source,go]
name: Example tasks:
name: Example paloaltonetworks.panos.panos_security_rule: name: "example-rule"
Last updated
Was this helpful?