About Phoenix

BPA Release Notes v3.28   Improvements   Update on company branding logo  Updated company logo on BPA reports.   Bugs   Fixed logic error on BP Mode Summary Graph In the PDF executive report, the BP Mode Summary graph was not reflecting correctly as seen on the HMTL BPA report. This has been corrected.   ... View more

BPA Release Notes v3.27   New Feature   PAN-OS minor version release date This BPA check provides a guidance on how old is the PAN-OS minor version that is installed on the device. Software bug fixes and security advisory vulnerability updates are provided as minor version updates, and it is advisable to be in the recent minor version of the major version to benefit from the security and feature functioning fixes. View of BPA Report Indicating old Software Version     Improvements   BP check on Rule Hit Count BPA check 242 is now tracked to ensure this is enabled. This feature will start tracking each security policy if it is actively processing traffic. This helps identify policies that are not used for traffic processing for a long time and take necessary clean up or rule optimization process.   This BPA check indicates that an enabled rule hit count is needed to optimize the rulebase.   Bugs   Two Factor Authentication on GP Updated BPA check 242 to be a type Note because GlobalProtect Portal authentication can have external type of authentication that may not be visible from the configuration on firewall alone. ... View more

  BPA Release Notes v3.26   New Features   Filter option added in BPA for Pass/Fail checks With this new filter capability we can just filter for one best practice check in a particular feature and identify how many have been passed or failed. Also we can just filter for all pass checks or failed checks in that particular space so we can just focus on improving what is relevant.  This helps in reviewing the configuration easily and also measure progress quickly by looking at Pass and Fail checks.   BPA View Network Tab - Zone Protection Profile Applied to Zone   Bugs Corrected the logic for check SSH Proxy/SSH Tunnel Even though all the required configurations were in place the BPA was failing the check due to an error and that has been corrected.   ... View more

BPA Release Notes v3.25     New Features   Added Best Practices Trending We have introduced the ability to track your progress when implementing the Best Practices. In the past, we could only provide Trending on your adoption statistics, but now we have it for Best Practices too. You can monitor the progress and identify the gaps in Best Practices.   BPA view of Trending tab with Best Practice Mode selected.   Trending for High Availability devices Now, we have the ability to show Trending continuity even if you upload a tech support of secondary/Passive device or primary/active device. In the below example, when a user tries to generate BPA report for peer device, we will identify the Serial Numbers and fetch its peer's previous trending, so you do not miss the context and Trending data.   BPA Trending data with Serial highlighted.   Added previous BPA reports Passing % We have added two new columns under the Mapping Definition section for BPA, so we can track the progress for individual BPA checks. With this release, we can identify the previous BPA report passing % score and what is current Passing %, so we can review the progress and identify gaps where needed and as expected.   BPA Previous and Passing Percent Columns   Added option to generate BPA report bundle through API BPA API is available to generate raw json output that we see in the BPA report. We added the ability where a user has an option to generate a BPA .zip bundle (contains BPA html report, PDF summary report, and BPA spreadsheet) in addition to the json output for BPA results.     BPA API View with generate .zip_bundle highlighted.   Heatmap adoptions statistics added in BPA API results Grand totals adoption value is now added as shown below. BPA API view with grand totals highlighted.   Improvements   Added fields for DoS Protection Policy We made some improvements to ensure there is a separate record for each DoS policy. In addition, we have added more fields to view the details of the policy.   BPA DoS Protection with Policy highlighted.   Threat Exceptions reorganized When many exceptions were configured on a threat profile, each record was very big. This has been corrected to clearly viewing the threat exceptions and its packet capture setting. Threat Exceptions with Packet Capture highlighted.   Bugs   Updated the check for Verify Update Server When the Verify Update server was configured properly it was reported missing due to XML behavior on configuration file. This has been corrected.   Device Support updated When the support license was missing we were not printing the results and updating the message. This has been fixed.   ... View more

BPA Release Notes v3.24     New Features   Rule Hit Count  We have added PAN-OS feature Rule Hit Count in to the BPA for firewalls running PAN-OS 9.0 and later. Now in the BPA results, we can filter those rules for adoption and best practices that are only passing traffic.   This greatly helps in focusing to increase adoption and best practices on the rules that are used. We want to apply different security capabilities on rules that are actively passing traffic, and (if possible) delete rules that are not being used to tighten the security rulebase.   Read "Rule Hit Count in Best Practice Assessment (BPA) Report" to learn more about this feature and how to use it.   Improvements Display zone names in Zone Protection Profile We have added the zone names in the Zone Protection Profile cards to indicate which zones are being impacted with a specific Zone Protection Profile (ZPP). This helps to identify which ZPPs are effectively configured and passing best practice checks. It also helps identify the zones it is protecting right in the same place.   ZPP-1 template stack BPA report with Applied On Zones highlighted.   DoS Protection Policies We have added newer fields for DoS Protection rules, such as Rule Enabled, Action, Destination Address, Location, and Rule Name.   DoS Protection Rulebase BPA report with Dos Protection Rules highlighted.   Bugs   Correction in sensitive fields masking Some field values, such as "any," were corrected while masking the values.   Cell color in Mapping Definition Corrected the color from white to red for the best practices that were at 0% pass percentage.   Updated the action values for High-Risk IP Address field Updated the different action field values to ensure the check considers all the options and works consistently to pass the BPA check.   ... View more

BPA Release Notes v3.21   Bugs Updated File blocking profile check This update is helpful in a scenario where a profile with all applications and all file types are set with action block was being failed. This has been updated and it would be a pass.   Updated Intrazone rule check This helped in a scenario where a Intrazone rule was configured to block the check was failing it. This has been updated to ensure this scenario is excluded from calculation as this check now processes for permitting traffic over Intrazone.   Xpath evaluation error For a particular tech support file, there was a xpath evaluation error which has been corrected. ... View more

  BPA Release Notes V3.22 New Features   Added new URL category Grayware part of blocked categories New URL category Grayware was introduced in content version 8206. This category, as a best practice, should be set to be blocked as an action. This has been added to the check URL profile known bad categories.   View of URL Filtering BPA check results   Added check for DNS Security License If a feature license is active on a device and if that feature is not configured, this BPA check highlights it. Also, the check provides details on license duration to ensure the feature functions at optimal levels.   View of DNS Security License check   Bugs: License info now parsing accurately In the BPA report in a particular condition, we were not reporting licenses on the device even when they were active. There was a problem in parsing that data and now that is corrected. We will report the licenses and run the check accordingly. In addition, we were not displaying WildFire and GlobalProtect gateway license and its checks; that has been corrected with this release.     ... View more

BPA Release Notes v3.23     New Features   Added Managed devices count on Panorama report With this addition, we can find how many firewalls are being managed by Panorama. Also, we can find how many device groups are configured with security policies. This is seen in the Device Info section as shown in the image below.   View of Device Info tab in BPA   Added Forwarding Decryption Certificate check This check ensures that we do not configure the same server certificate as Forward Trust and Forward Untrust. When a client's traffic is going through forward decryption, they would see a forward trust if the server's CA certificate is part of CA list on the firewall.   View of Heat Map Certification Management Tab for Best Practice Check Results.   Bug:   Permitted IP address BP check now parses Template Variable When a template variable was assigned for Permitted IP address list, it was not being processed and check was failing. This has been corrected and updated. ... View more

  New Features   Number of Managed Devices on Panorama Now we can start tracking how many firewalls are being managed by the Panorama. At times, our adoption percentage values may change due to addition/removal of firewalls, and having the ability to know a change in the managed devices helps explain the change in adoption values.   BPA tracking columns for firewalls managed by Panorama.   New link added in CIS Critical Security Controls The second link that is added helps map CIS Critical Security Controls to other security controls and frameworks.   CIS Critical Security Controls 7.0 Summary with a highlighted section for a link to frameworks and standards information.   Class Summary Documentation Added the Class Summary reference to Control Category   Class Summary reference in Control Category   Bug Fixes Wildfire Profile File Types: Fixed a bug on Wildfire profile if customer defined specific file types then validate if all the relevant file types are defined to ensure all zero-day file types are inspected in sandbox.   Failed Attempts: Fixed a bug where Admin user login failed attempt was passing when the value was set at 0. Failed attempt for admin users should be a fixed value in the range 1 - 5   Idle Timeout: Fixed a bug where Admin user Idle timeout was passing when the value was set at 0. Idle timeout for admin users should be a fixed value in the range 1 - 10   Included Networks: Fixed a bug for Included Networks check where it needed an update on the error message and that is updated now.   Interface Management Profile: Fixed a bug where the protocols enabled for Interface management profile are correctly parsed on a Template configuration.   Mapping Definitions Control Category: Fixes a calculation error for Risk Assessment control category under Mapping Definitions   ... View more

Read BPA Report: Methodology and Training Links for Security Posture to learn about resources to use from the BPA report. See how the BPA report can guide you towards an improved security posture through best practice recommendations. Got Questions? Get Answers on LIVEcommunity.   The BPA tool has added web links right in the report, so you can easily access specific documents that relate to a specific tab in the BPA report.   The links added specifically help users evaluate their security policy capability adoption, evaluate their best practice configuration, suggest how to prioritize best practices, and suggest how to implement the same. The links also provide a guided approach so you can move from your current state of posture to a more secure posture that is defined as a goal.   Please note that the same links will not be in each tab. Only documents links that apply to that specific tab will be shown. For example, if you are in the "Trending" tab, you get different links from the "Device Group" tab. This helps to provide the right guidance and moves you towards the next steps in security adoption.   Some of the links you see are as follows:   Transition to Best Practices https://docs.paloaltonetworks.com/best-practices/transition-to-best-practices   Videos explaining how to use Heatmap, BPA and explaining all the components https://paloaltonetworks.com/bpatraining NOTE: You will need to register for a Learning Center account to view the BPA Training.   Below is a sample of a Security Profile Adoption Summary. In this page, on the top right, we added links that are relevant to this tab.  Security Profile Adoption Summary In the left navigation, we added a new section for "Learn More" that provides all the links that are necessary as you transition to best practices, videos to learn the heatmap and BPA, and more.  BPA Report Learn More Reference Links   See Also: Getting Started with Best Practices Evaluate Security Policy Capability Adoption Prioritize Best Practice Changes Transition to Best Practices ... View more