Security rule allows any application on Palo Alto Networks devices misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_5
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	MEDIUM
Framework	Ansible

Impact

This rule detects whether security rules in Palo Alto Networks devices are defined using 'any' instead of with specific applications. Setting the 'application' attribute to 'any' in security rules can lead to overly permissive configurations, potentially allowing traffic that should be inspected or blocked.

How to Fix

Palo Alto Networks

• Resource: panos_security_rule
• Attribute: application

To mitigate this issue, define the application attribute in your panos_security_rule resources with specific applications instead of 'any'. Specifying applications enhances security by ensuring that only traffic corresponding to the defined applications is matched by the rule.

Secure Code Example:

- name: Ensure application is defined specifically in security rules
  paloaltonetworks.panos.panos_security_rule:
    name: "example-rule"
    application: ['web-browsing', 'ssl']

In this example, setting the application to specific values rather than 'any' ensures that only traffic corresponding to the defined applications is matched by the rule, thereby enhancing network security.