STIGQter: STIG Summary: Palo Alto Networks ALG Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Palo Alto Networks security platform that provides intermediary services for TLS must validate certificates used for TLS functions by performing RFC 5280-compliant certification path validation.

DISA Rule

SV-228841r557387_rule

Vulnerability Number

V-228841

Group Title

SRG-NET-000164-ALG-000100

Rule Version

PANW-AG-000044

Severity

CAT II

CCI(s)

• CCI-000185 - The information system, for PKI-based authentication, validates certifications by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.

Weight

10

Fix Recommendation

To configure the Palo Alto Networks security platform to use an OCSP responder:
Go to Device >> Certificate Management >> OCSP Responder
Select "Add".
In the "OCSP Responder" window, enter the host name or IP address of the OCSP responder.

Note: If the firewall itself is configured as an OCSP responder, the host name must resolve to an IP address in the interface that the firewall uses for OCSP services.

To enable OCSP communication on the firewall:
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, select the "Edit" icon.
In the "Management Interface Settings" box, under "Services" check HTTP OCSP to enable it.
Select "OK"

Optionally, to configure the device itself as an OCSP responder, add an Interface Management Profile to the interface used for OCSP services.

Go to Network >> Network Profiles >> Interface Management
Select "Add" to create a new profile or click the name of an existing profile.
In the "Interface Management Profiles" window, under "Permitted Services", check HTTP OCSP.
Select "OK".

Go to Network >> Interfaces
Select the name of the interface that the firewall will use for OCSP services.

Note: When the device itself as an OCSP responder, the OCSP Host Name must resolve to an IP address in this interface.

In the "Interface" window, under Other Info, in the "Management Profile" field, select the configured Management Profile.
Select "OK".
Commit changes by selecting "Commit" in the upper-right corner of the screen.
Select "OK" when the confirmation dialog appears.

Check Contents

If the Palo Alto Networks security platform does not provide intermediary services for TLS or application protocols that use TLS (e.g., HTTPS), this is not applicable.
Go to Device >> Certificate Management >> OCSP Responder
If no OCSP Responder is configured, this is a finding.
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, if "HTTP OCSP" is not listed under "Services", this is a finding.

Vulnerability Number

V-228841

Documentable

False

Rule Version

PANW-AG-000044

Severity Override Guidance

If the Palo Alto Networks security platform does not provide intermediary services for TLS or application protocols that use TLS (e.g., HTTPS), this is not applicable.
Go to Device >> Certificate Management >> OCSP Responder
If no OCSP Responder is configured, this is a finding.
Go to Device >> Setup >> Management
In the "Management Interface Settings" pane, if "HTTP OCSP" is not listed under "Services", this is a finding.

Check Content Reference

M

Target Key

4233

Comments