Built-in interzone default rule does not log
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
Traffic between zones that no rule matches falls to interzone-default. Without logging, that denied traffic leaves no record, which hides scans, misrouted applications and a rule that stopped matching after a change.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Override interzone-default in each vsys and enable log at session end, with a log forwarding profile.
- Do the same for intrazone-default if intrazone traffic should be recorded.
Command line
PAN-OS CLI, standalone firewall, vsys1
set vsys vsys1 rulebase default-security-rules rules interzone-default log-end yesAn example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show vsys vsys1 rulebase default-security-rules rules interzone-defaultHow to confirm the fix
- Confirm the override appears under the default rules with log at session end enabled.
- Confirm denied interzone sessions appear in the traffic log after the commit.
Limits
- Reads interzone-default only. intrazone-default, which the same recommendation covers, is not judged.
- Not judged on a Panorama export: the rule a managed firewall runs depends on what each device group pushes and on the firewall's own override.
Compliance references
CIS Palo Alto Firewall 11 Benchmark v1.2.0
Covers part of the recommendation
Where a control aligns with a recommendation of the CIS Palo Alto Firewall 11 Benchmark v1.2.0, that recommendation is cited as a reference. Only that version was checked. A reference is not a certification.
More in Security Policies
- PAN-SEC-041Two rules differ in one dimension and could be reviewed for consolidation
- PAN-SEC-042Duplicate rules log differently
- PAN-SEC-094Enabled rule names a zone only a disabled tunnel feeds
- PAN-SEC-095Rules can be merged without changing what they permit
- PAN-SEC-110No deny rule names the Palo Alto Networks threat IP lists
- PAN-SEC-164An application override rule is configured to bypass App-ID
- PAN-SEC-170Enabled rule with no hit in the counted window
- ISE-SEC-001Authorization rule grants open access with no condition
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.