Prisma Access tunnel profile excludes a route broader than an included one
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
Palo Alto Networks states that excluded routes should be more specific than included routes, otherwise more traffic is excluded than intended: the included destination leaves the tunnel and is not inspected.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Narrow the exclude route so it no longer contains the included destination, or remove it.
Command line
Panorama CLI, Prisma Access template, vsys1
delete template <template> config vsys vsys1 global-protect global-protect-gateway <gateway> remote-user-tunnel-configs <tunnel-config> split-tunneling exclude-access-route <prefix>An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits or pushes. Review, commit, then push to Prisma Access yourself.
Read it back
show template <template> config vsys vsys1 global-protect global-protect-gateway <gateway> remote-user-tunnel-configs <tunnel-config>Values to fill in4
- <template>
- The template that holds this setting
- <gateway>
- The Prisma Access GlobalProtect gateway
- <tunnel-config>
- The tunnel configuration to change
- <prefix>
- The address prefix
Before you type it4
- Prisma Access is set in the Cloud Services plugin on Panorama: commit to Panorama, then push the change to Prisma Access from the plugin.
- A tenant managed by Strata Cloud Manager has no command line: make the same change in Prisma Access Setup and push it.
- Changing the split tunnel changes which traffic reaches the firewall at all.
- This setting lives on a device or in a template. On a Panorama, name the template it belongs to.
How to confirm the fix
- From a connected endpoint, confirm traffic to the included destination goes through the tunnel.
Limits
- No limitation is recorded for this control beyond the one that applies to all of them: it reads a configuration export.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Remote access VPN
- PAN-SEC-139Prisma Access mobile user IP pool overlaps another network
- PAN-SEC-140Prisma Access mobile user IP pool is smaller than a /23
- PAN-SEC-151Prisma Access agent profile does not collect HIP data
- PAN-SEC-152Prisma Access tunnel profile allows direct access to the local network
- PAN-SEC-153Prisma Access agent connects only on demand
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.