topic Re: VA Scan for Generic-tcp-timestamp & ICMP timestamp response in General Topics

VA Scan for Generic-tcp-timestamp & ICMP timestamp response

Kevin_Ncs — Thu, 13 Jul 2023 00:00:40 GMT

Hi All,

We had VA Scan finding for Palo Alto’s MGMT INTERFACE IP. Please refer to below:

Generic-tcp-timestamp
ICMP timestamp response

May I know how can this be blocked for Palo Alto’s MGMT INTERFACE?

Re: VA Scan for Generic-tcp-timestamp & ICMP timestamp response

reaper — Thu, 13 Jul 2023 09:27:35 GMT

By putting the mgmt interface in a OOB network where it can only be reached by trusted hosts, or by shielding the mgmt interface with a security policy loaded with security profiles

No unauthorized person or system should be able to scan your mgmt interface