Guideline for Securing PAN-OS Management Interface

Palo Alto Networks has observed threat activity exploiting multiple vulnerabilities via the PAN-OS management interface.  Departments with Palo Alto network devices, e.g. firewall systems, are strongly recommended to follow the guidelines below to ensure the access of PAN-OS management interface is configured correctly.

Guidelines to reduce exposure to management interface:

1. Ensure the access to the management interface is only from trusted internal IPs and not from the Internet.  NEVER enable access to your management interface from the Internet or from other untrusted zones.
2. Isolate the management interface on a dedicated management VLAN.
3. Use jump servers to access the mgt IP. Users authenticate and connect to the jump server before logging in to the firewall/Panorama.
4. Limiting the access to management interface, visit “Device > Setup > Interfaces > Management“:
   (* If you are using a data port for the management of your PA device, visit under “Network > Network Profiles > Interface Management Profile”)
   1. Under “Permitted IP Address“, limit inbound IP addresses to your management interface by adding the approved IP address only.
   2. Under “Administrative Management Services“, only permit secured communication such as SSH, HTTPS.
   3. Under “Network Services“, only allow PING for testing connectivity to the interface.

Guidelines for the administrator accounts:

1. Remove the default “admin” account from your device.
   (*Note: you can only delete the default admin account using a new superuser account)
2. Do NOT share the administrative accounts.  Create a separate account for each administrator.
3. Assign an appropriate admin role to different administrators depending on their privilege or required actions.
   (* you can use the predefined admin role or create a custom admin role under “Device > Admin Roles”)
4. Configure a strict password policy under “Device > Setup > Management > Minimum Password Complexity“.  Strong password with complex combination is recommended.
5. Review the login activities regularly.
   1. View the last login details located at the bottom left of the window and verify that the timestamp corresponds to your last login.
   2. Beware of the caution symbol at the right of the last login time information for failed login attempts.

Reference:

• Tips & Tricks: How to Secure the Management Access of Your Palo Alto Networks Device
• Use the Administrator Login Activity Indicators to Detect Account Misuse
• CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
• CVE-2024-9474 PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

Published on:  12 Nov 2024

Last update on:  19 Nov 2024