PANW-AG-000050 - The Palo Alto Networks security platform must deny outbound IP packets that contain an illegitimate address in the source address field.

Information

A compromised host in an enclave can be used by a malicious actor as a platform to launch cyber attacks on third parties. This is a common practice in 'botnets', which are a collection of compromised computers using malware to attack (usually DDoS) other computers or networks. DDoS attacks frequently leverage IP source address spoofing, in which packets with false source IP addresses send traffic to multiple hosts, who then send return traffic to the hosts with the IP addresses that were forged. This can generate significant, even massive, amounts of traffic. Therefore, protection measures to counteract IP source address spoofing must be taken.

Enclaves must enforce egress filtering. In egress filtering, packets leaving the enclave are discarded if the source IP address is not part of the IP address network(s), also known as prefixes, which are assigned to the enclave. A more specific form of egress filtering is to allow only those hosts and protocols that have been identified and authorized to exit the enclave. All traffic leaving the enclave, regardless of the destination, must be filtered by the premise router's egress filter to verify that the source IP address belongs to the enclave.

Configure a security policy that allows only traffic originating from the IP address prefixes assigned to the enclave to exit the enclave. The implicit deny cross zone traffic rule will then be used, in part, to deny illegitimate source address traffic originating from an internal zone to go to another zone.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Create an anti-spoofing policy for each outgoing zone that drops any traffic when the source IP does not match the list of allowed IP ranges for each outgoing zone.

Navigate to the 'Zone Protection Profile' configuration screen.

Select the 'Packet- Based Attack Protection' tab.

Select the 'IP Drop' tab.

Check the 'Spoofed IP Address' box.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PAN_Y24M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5(1), CAT|II, CCI|CCI-001094, Rule-ID|SV-228844r557387_rule, STIG-ID|PANW-AG-000050, STIG-Legacy|SV-77061, STIG-Legacy|V-62571, Vuln-ID|V-228844

Plugin: Palo_Alto

Control ID: 1a3965d2b9862a917d30ef23f5d65ac272cc0ccf6dac27d00c6a8f2a0207feeb