Skip to content
ConfigProof

All controls

PAN-SEC-152LowPrisma Access

Prisma Access tunnel profile allows direct access to the local network

At a glance

Base severity

Low

Area

Remote access VPN

Platform

Prisma Access

Evidence level

Fact1.00

Benchmark reference

Reads the export, not the device

ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.

Why it matters

An endpoint on a hostile network, such as a public Wi-Fi, can reach and be reached by that network's hosts outside the tunnel while connected. Palo Alto Networks documents the setting to reduce that risk.

How to fix it

Web interface

The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.

  1. Turn on No direct access to local network in the tunnel profile, for Windows, macOS and Linux users.

Command line

Panorama CLI, Prisma Access template, vsys1

set template <template> config vsys vsys1 global-protect global-protect-gateway <gateway> remote-user-tunnel-configs <tunnel-config> split-tunneling no-direct-access-to-local-network yes

An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits or pushes. Review, commit, then push to Prisma Access yourself.

Read it back

show template <template> config vsys vsys1 global-protect global-protect-gateway <gateway> remote-user-tunnel-configs <tunnel-config>
Values to fill in3
<template>
The template that holds this setting
<gateway>
The Prisma Access GlobalProtect gateway
<tunnel-config>
The tunnel configuration to change
Before you type it4
  • Prisma Access is set in the Cloud Services plugin on Panorama: commit to Panorama, then push the change to Prisma Access from the plugin.
  • A tenant managed by Strata Cloud Manager has no command line: make the same change in Prisma Access Setup and push it.
  • Changing the split tunnel changes which traffic reaches the firewall at all.
  • This setting lives on a device or in a template. On a Panorama, name the template it belongs to.

How to confirm the fix

  • From a connected endpoint, confirm hosts on the local network are not reachable outside the tunnel.

Limits

  • A profile that does not state the setting is not judged. Printers and other local devices some users need are a decision this file cannot make.

Compliance references

No benchmark recommendation is mapped to this control in this version.

More in Remote access VPN

See it on your own firewall

One complete analysis of one firewall costs nothing. A card is required and nothing is charged.

Start a free analysis