Configuration Wizard Additional Best Practice Checks Support  (Version 1.2.0)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.
L4 Transporter
No ratings

Configuration Wizard

Additional Best Practice Checks Support

 

This document provides detail on additional BPA checks that were recently added into Configuration Wizard.

 

Before we get into details we would like to provide a quick overview of Configuration Wizard. It’s a step-by-step configuration wizard that provides an intuitive, easy-to-use interface to configure firewalls to align with best practices. The Configuration Wizard takes the results of the BPA report and expedites the remediation process by outputting commands that can be easily pasted into any instance of PAN-OS and committed.  This helps to configure their firewalls using existing applications and capabilities to properly secure their network.  

 

Benefits of BPA+ include:

 

  • Improved Security Posture - Ensure expert best practices are being adhered to.
  • Quick & Easy - Deploy and implement best practices easily with the configuration wizard. 
  • Maximize Return on Investment - Get the most out of NGFW features with best-practice configurations.



Best Practice Checks that can be remediate with Configuration Wizard

 

Category

BPA Checks

Objects

WildFire Profile File Types

Antivirus Profile Decoder WildFire Inline ML Action

Device

Report Grayware Files Enabled



WildFire Profile File Types

Configure the firewall to forward files to WildFire for analysis. Through the WildFire Analysis Profile, all files being uploaded or downloaded will be sent to WildFire for analysis. The WildFire Profile File Types best practice check ensures all file types for all applications are sent to WildFire for analysis.

 

The WildFire Cloud and on-premises private cloud analyzes new files that the firewall hasn’t seen before. It sends all new files for all applications to WildFire for analysis and inspection. WildFire detects unknown threats in all file types and protects you against zero-day threats (new malware) and advanced persistent threats. 

 

Antivirus Profile Decoder Wildfire Inline ML Action

The WildFire Action setting in Antivirus profiles blocks viruses that WildFire identifies in content signature updates in the Antivirus profile. The WildFire Decoder Actions best practice check ensures the decoders are set to reset-both, drop, reset-client, or reset-server in the WildFire Action column.

 

If users have a WildFire subscription, their firewalls receive zero-day malware signatures from the WildFire cloud, as fast as under a minute after the threat is discovered. The WildFire Action setting in Antivirus profiles is based on WildFire content signature updates.

 

Report Grayware Files Enabled

Wildfire submission logs would have a log event when a file sent to the Wildfire cloud for inspection was identified and given a verdict as Grayware file. If not enabled this log is not created and is created only for malware files.

 

When the Report Grayware Files option is enabled, details such as session information, Behavioral summary, Network Activity, Host Activity and more that are helpful in analytics. As a best practice, we recommend having a check mark on the Report Grayware File box under WildFire general Settings in Device Setup.






Feedback? contact us at bpaplus@paloaltonetworks.com

Rate this article:
  • 1554 Views
  • 0 comments
  • 0 Likes
Register or Sign-in
Contributors
Article Dashboard
Version history
Last Updated:
‎06-10-2022 01:45 PM
Updated by: