An application override rule is configured to bypass App-ID
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
Traffic an override matches is named by the rule rather than identified by App-ID, and Palo Alto Networks documents that it is not inspected for threats by Content-ID. A rule wider than the service it was written for takes other traffic out of inspection with it.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Write a custom application with signatures for the traffic the override was written for, which keeps content inspection, then disable or delete the override.
- If the override has to stay, narrow it to the source, destination and port of the one service it is for, and record why it is kept.
Command line
PAN-OS CLI, standalone firewall, vsys1
set vsys vsys1 rulebase application-override rules <object-name> disabled yesAn example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show vsys vsys1 rulebase application-override rules <object-name>Values to fill in1
- <object-name>
- The object's name, as it appears on your firewall
Before you type it1
- Write a custom application with signatures for this traffic before disabling the override, so the traffic is identified and inspected rather than dropped by the rules that allowed it under the override's name.
How to confirm the fix
- Confirm the traffic is identified as expected after the override is removed or narrowed.
Limits
- No limitation is recorded for this control beyond the one that applies to all of them: it reads a configuration export.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Security Policies
- PAN-SEC-094Enabled rule names a zone only a disabled tunnel feeds
- PAN-SEC-095Rules can be merged without changing what they permit
- PAN-SEC-104Built-in interzone default rule does not log
- PAN-SEC-110No deny rule names the Palo Alto Networks threat IP lists
- PAN-SEC-170Enabled rule with no hit in the counted window
- ISE-SEC-001Authorization rule grants open access with no condition
- ISE-SEC-002Default authorization rule grants open access
- ISE-SEC-003MAB rule grants open access
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.