Does a security configuration benchmark/checklist exist for Palo Alto firewalls?

[RyanF]

There's a ton of fantastic best practices guides on this site in addition to the admin guides. I was wondering if a best practices security configuration benchmark or checklist exists for PA firewalls.

Something I can hand an IT auditor, similar to this:

http://goo.gl/JgmTTc

[HULK]

Hello RyanF,

Since PAN firewall is having multiple options ( based on available licenses) for a deeper packet inspection, hence PAN does not have any recommended security settings. But, you may refer below mentioned documents for individual security features.

What are the Data Filtering Best Practices?

Amsterdam Oct 2014 - AppID best practices config example  >>>>> you may need help from your PAN SE to view this doc.

URL White List for SSL Sites Best Practices

How to Configure WildFire

Understanding DoS Protection

Hope this helps.

Thanks

[jkim2]

Nessus has a very basic configuration check as well.

http://www.tenable.com/solutions/configuration-auditing

best practice is to use publically available hardening guides for other platforms.

NIST, DISA, NSA has several for other platforms that can be applied / referenced.

[Painyc]

Yes Palo Alto Configuration benchmark was recently released by SANS

http://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benc...

YMMV, but it is very comprehensive.