This article written by Saad Khan.
No network security system is secure if you don’t lock down administrative access to network devices. This is especially true for firewalls and security management devices such as Panorama because they are the gatekeepers and protectors of your network. Attackers who gain administrative access to these devices can reconfigure them in order to permit malicious access to your network remotely, facilitate the distribution of malware to endpoints, and even lock you out of your network.
Even with modern authentication methods applied, leaving the management exposed to the internet can expose the firewall to web-based attacks, including new zero-day vulnerabilities, brute force attacks, and operationally impacting DDoS attacks. It is crucial to follow best practices and secure your firewall management interface in order to reduce the attack surface and protect your NGFW firewall and Panorama.
Watch this demo for securing your firewall management interface, which details best practices for securing your management interface, creating a secure admin account with restricted Role-Based access following best practices for account creation, and replacing the default master key to ensure all password hashes are encrypted with a unique master key.
This blog is a consolidated guidance document that provides an overview of the methods to access the management of Palo Alto Networks NGFWs securely. For detailed best practices, please review Deploy Administrative Access Best Practices.
Palo Alto Networks detects public-facing customer NGFW internet management interfaces through routine, nonintrusive internet scanning. We analyze these results using proprietary indicators to attribute device attributes (such as firewall model) with a high degree of accuracy. Based on detected IP addresses, we are able to associate an internet-exposed firewall with the appropriate customer by cross-referencing the IP address to the serial number stored in our internal records.
We listed the firewalls that were discovered recently in the last few days in the Remediation Required list under the Assets section of the Customer Support Portal (Products → Assets → All Assets → Remediation Required). Devices have a last seen date to help identify the time of exposure detection. Devices no longer seen after a few days, drop off from the Remediation Required list. This list may not be complete, so make sure to verify that all of your firewalls are properly secured.
Please refer to this KB article on How to Manage Unremediated Devices.
Options 1 to 3 below apply for secure management access to a single firewall. For securing management access to multiple firewalls, see options 4 and 5.
Follow the document here for guidelines on reducing exposure to your management interface when directly using the MGMT port of the firewall. Ensure that inbound traffic comes only from a list of permitted IP addresses, not open to anyone from the Internet.
Follow the document here and refer to the section “Dataplane of the NGFW configured with an Interface Management Profile” when using the dataplane of an interface to allow management access. Ensure that inbound traffic comes only from a list of permitted IP addresses, not the open Internet.
When using the dataplane of NGFW to access management, it is possible to inspect and log the management traffic by enabling inbound decryption with a security profile. Below is an outline of the steps required. Ensure that inbound traffic comes only from a list of permitted IP addresses, not the open Internet.
This method can be used to access the management of the firewall hosting the GlobalProtect gateway or other firewalls inside the network behind the GlobalProtect gateway.
Note: When setting up a GlobalProtect Gateway or Portal, do not attach an interface management profile that allows HTTP, HTTPS, Telnet, or SSH on the interface where you have configured a GlobalProtect portal or gateway because this enables access to your management interface from the open Internet on port 4443.
To access management of multiple firewalls, in addition to using option 4 above for GlobalProtect, you can set up the dataplane of another firewall to receive all inbound management traffic (similar to options 2 and 3 above) and then send that traffic to the management interface of other firewalls.
