Security rule permits any service on Palo Alto Networks devices misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_PAN_6
Category - Subcategory	Public Exposure - Ingress Controls
Provider	OTHER
Severity	LOW
Framework	Ansible

Impact

This rule detects whether security rules in Palo Alto Networks devices use the 'any' setting for the service attribute instead of specifying a particular service. Setting the 'service' attribute to 'any' can create overly permissive rules, potentially allowing uncontrolled or blocked traffic. On the other hand, configuring a specific value results in tighter control and specificity in traffic management.

How to Fix

Palo Alto Networks

• Resource: panos_security_rule
• Attribute: service

To mitigate this issue, define specific services in security rules to enforce the intended access controls and enhance the overall security posture. Specify the service attribute in your panos_security_rule resources with exact service definitions, avoiding the use of any.

Secure Code Example:

- name: Example
  ...
  tasks:
    - name: Example
      paloaltonetworks.panos.panos_security_rule:
        ...
        application: ['ssl']
-        service: ['any'] # Service is any
+        service: ['http', 'https']

In this example, defining the service attribute with precise values instead of 'any' ensures more granular and secure control of the network traffic.