Security rules apply to all zones on Palo Alto Networks devices misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_17
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	MEDIUM
Framework	Ansible

Impact

This rule detects whether security rules on Palo Alto Networks devices indiscriminately apply to all zones due to configuration of both 'source_zone' and 'destination_zone' to 'any'. This configuration can potentially lead to overly permissive rules and unintended access across network segments.

How to Fix

Resource: panos_security_rule

• Attribute: log_setting

To mitigate this issue, ensure that the log_setting attribute in your panos_security_rule resources is defined, and points to an existing Log Forwarding Profile. This setup ensures that activity logs for each rule are captured and forwarded correctly, facilitating effective monitoring and analysis.

Secure Code Example:

In this example, configuring the log_setting attribute with a valid Log Forwarding Profile name for each security rule ensures that logging is properly implemented for security monitoring and analysis. [source,go]

• name: Example tasks:

  • name: Example paloaltonetworks.panos.panos_security_rule: ...
•    log_setting: 'default'

---