Palo Alto Firewall Security Configuration Benchmark

Security configuration benchmarks provide invaluable guidance when auditing, evaluating, or configuring network infrastructure devices. Contributions by CIS (Center for Internet Security), DISA (Defense Information Systems Agency), the NSA, NIST, and SANS provide benchmark guides for a variety of network devices, operating systems, and other IT equipment. It is also common for technology companies themselves to provide these guides for their products, such as Microsoft's Security Baselines.Although best practice recommendations are found in abundance on the Palo Alto Networks website, a single security configuration benchmark does not currently exist for Palo Alto firewalls. This paper will combine best practice guidance from Palo Alto, other reputable sources, and real-world experience to provide a comprehensive security benchmark for auditing a Palo Alto firewall running PAN-OS 6.1 software.The intention of this paper is to produce a version 1 draft from which to start a living CIS project--the CIS Palo Alto Firewall Benchmark. Through a formal CIS benchmark project, many other experts will join in to provide input, scrutinize proposals, discuss, and ultimately settle on sound benchmark recommendations useful for a wide variety of organizations interested in securing and/or auditing their Palo Alto firewalls. Once published, the CIS Palo Alto Firewall Benchmark will supersede the recommendations in this paper.