About almargaris

The Best Practice Assessment is a powerful tool that enables you to maintain visibility and control of your NGFW and Panorama deployments. However, in order to utilize this tool, you must first understand how to generate a report.    Step 1: Generate and Download Your Tech Support File (TSF)    Within your instance of an NGFW or Panorama, navigate to the Device tab, then select Support from the side navigation panel. Then Click on “Generate Tech Support File” to begin the process. Once the Tech Support File has been Generated, click the prompt to download your TSF (.tgz format). * Note: Generation times may vary depending on the amount of data present in the configuration   Figure 1: How to Generate a Tech Support File   Step 2: Upload your TSF to either the Customer Support Portal or Customer Success Portal   Within the Customer Support Portal, navigate to the Tools tab and select Best Practice Assessment and click on the “ + Generate New BPA ” button. Similarly, to upload a TSF to the Customer Success Portal, navigate to Best Practice Assessment and click on the “ Generate New BPA” button.   In both cases, simply upload your TSF onto the web page and proceed to Step 3.    Figure 2: How to Upload the TSF to the Customer Support Portal   Figure 3: How to Upload the TSF to the Customer Success Portal Step 3: Configure and Download the Report Note that this step is the same for both the Customer Support Portal as well as the Customer Success Portal.    Once you upload your Tech Support File, simply complete the Architecture Classification page, select your industry, and generate your report. A zip file containing a detailed .html file, a .xlsx spreadsheet, and an executive summary will be automatically downloaded once the generation process is completed.    ... View more

BPA Release Notes v5.10.1   Bugs Unexpected Error when Uploading Tech Support File Addressed an error that occasionally occurs when uploading a Tech Support File to the Customer Support Portal and Customer Success Portal, preventing the completion of the BPA generation process Improvements Refinement of Best Practice Checks for NGFW’s Managed by Panorama For a BPA generated from a NGFW managed by a Panorama the checks under Dynamic Updates will no longer fail. Instead it will be marked as “Note” since these can be configured at the Panorama level.   New Features New Best Practice Check for ‘Dynamic Filtering’ in ‘URL Filtering Profiles’ Under Objects > Security Profiles > URL Filtering , any Engine under the Dynamic Classification tab of a URL Filtering Profile must be set to “Block” in order to pass the Best Practice Check “URL Profile ML Action.” Please note that this Best Practice check only applies to PAN-OS versions 10.0 and greater.        ... View more

In February, we made some adjustments to the calculation methods used to measure the adoption rates for the URL-Filtering, Credential Theft, and DNS Sinkhole capabilities. Since then, we have been fine-tuning the calculation methods and patching any bugs that occur. Over the course of the past few months, you may have seen your adoption rates vary. Let's go over what the changes mean from the perspectives of security, policy, and how you can adjust your policies to improve your adoption rates—even if you already passed the Best Practice Check for each of these three capabilities.   If you've seen your adoption numbers change recently, the current number is the most accurate number.  First, let’s go over the definitions for each of these capabilities. To see the full list of adoption definitions within the Best Practice Assessment, navigate to Adoption Heatmap > Summary > Adoption Definitions.   URL-Filtering Adoption Percent This is the percentage of enabled allow rules using a valid URL-Filtering profile, using known ports 80, 443, 8080, 8443, 9443, 10443 and Apps that are ssl/web-browsing or depend on them.   Credential Theft Adoption Percent This is the percentage of enabled rules using a valid URL-Filtering profile configured for Credential Theft, using known ports 80, 443, 8080, 8443, 9443, 10443, and apps that are ssl/web browsing or depend on them.    DNS Sinkhole Adoption Percent This is evaluated based on the percentage of enabled rules using an Anti-Spyware profile containing an action of ‘sinkhole’, apps related to and depends on DNS protocol/application, and service/ports on 53 or 5353.   In order to demonstrate how adoption percentages can be improved, we are going to take a look at a DNS Sinkhole example.  For the DNS Sinkhole Best Practice Check to Pass, ‘DNS Sinkhole’ AND ‘Packet Capture’ are enabled in the selected Anti-Spyware Profile. You can find this under Objects > Security Profiles > Anti Spyware. To learn more, watch this short video here .     Now what happens if you pass the Best Practice Check, but are still not satisfied with your adoption percentage? It should be noted that whenever trying to “increase adoption” beyond passing the Best Practice Check, it is directly related to policy configuration.    To continue based on the DNS Sinkhole adoption example, we will explore how to improve the adoption percentage in steps. Remember that not all of the following are needed to pass the Best Practice Check, but to increase adoption.   1) Within the Objects > Services tab, make sure that the service you are using has ports 53 and/or 5353 enabled. Ensure that your service is attached to the desired policy as well. - ALLOWED_PORTS = {53, 5353}     2) Within the Policies > Security section choose a policy and ensure that  Applications are set to the following: - ALLOWED_APPLICATIONS = {"any", "ssl", "web-browsing"} - DNS_CONFIGS = {"dns", "dns-over-https", "dns-over-tls"}     Be sure to read the PAN-OS Administrator’s Guide for DNS Sinkholing if you want to take a deep dive into learning about managing your configurations. ... View more

Security teams managing their organization’s security can be thought of as a small crew working to plug an infinite number of holes on a ship. It is challenging to gather the resources necessary to prevent all water from entering the boat. It's crucial to understand how to prioritize resources, so that the holes posing the greatest threat to the ship can be plugged.   This analogy aligns with the need for organizations to maintain a Zero Trust Architecture . As organizations adopt new technologies, their attack surface increases exponentially. But to get themselves up and running, they will often implement a bare minimum of security controls. This creates exposure to their established zero trust “protect surface,” and makes it more challenging for them to monitor and maintain their networks to ensure they can maximize their protection.   “Palo Alto Network’s Best Practice Assessment (BPA) measures your usage of our Next-Generation Firewall and Panorama™ security management capabilities across your deployment, enabling you to make adjustments that maximize your return on investment and strengthen security.”   Let's explore how using the Best Practice Assessment will help you monitor and maintain a Zero Trust architecture with Visibility , Control , and Enforcement across your organization. Visibility One of the crucial pillars of Zero Trust, defined by John Kindervag , is the continuous inspection of traffic flows across your network along with an ongoing assessment of your security controls. The Palo Alto Networks Best Practice Assessment helps increase the effectiveness of validating policy configurations with comprehensive security health checks that ensure Zero Trust policies are maintained as networks evolve and change. The Best Practice Assessment Summary Dashboards provide high level snapshots of your configurations, while heatmaps help paint a more comprehensive picture.          Control The Best Practice Assessment can provide an evaluation of your adoption of Zero Trust policies across identified protect surfaces within your networks, and also your compliance with security configuration best practices as defined by various industry frameworks. This allows you to make informed decisions regarding the implementation of new security capabilities and adjustments to current policies and controls. To have this level of control is to simplify the process of staying up-to-date with security best practices (and your teams can focus on business initiatives).   Enforcement Another key pillar of Zero Trust is the enforcement of access controls that ensures users can access only what they need to. The best Practice Assessment Helps you assess the current adoption of APP-ID, User-ID, and Content-ID across your organization so you can evaluate gaps in policy controls that may need to be closed to comply with your Zero Trust framework.   ... View more

BPA Release Notes v5.9.0   Bugs Skip the Best Practice checks for “Failed Attempts” and “Lockout Time” on SAML Authentication Profiles and Authentication Sequences BP Checks for only SAML Authentication Profiles. When a user selected a SAML Authentication Profile under the Device tab, they were not given an option in GUI to configure “Lockout Time” and “Failed Attempts.”  “Lockout Time” and “Failed Attempts” Best Practice checks for SAML Authentication Profiles will now be skipped. If multiple types of Authentication Profiles exist in addition to SAML, then all Authentication types will be processed except for SAML.     Inaccurately calculating the adoption of DNS Sinkhole and URL Filtering in the Heatmap section. When a user has a URL Filtering and DNS Sinkhole configured in a Security policy, adoptions were being miscalculated and the Rule Detail tab in the Best Practice Assessment shows them as disabled. Application Filters and Application Groups that were previously ignored are now accounted for.  ... View more