implementing-next-generation-firewall-with-palo-alto

使用 Palo Alto 实施下一代防火墙

概述

Palo Alto Networks 下一代防火墙 (NGFW) 超越了传统的基于端口的规则执行，转向应用感知、身份驱动的安全策略。通过利用 App-ID 进行流量分类、User-ID 进行基于身份的执行、Content-ID 进行威胁检查，以及 SSL 解密实现加密流量可见性，组织可以获得对网络流量的全面控制。本技能涵盖从初始配置到高级威胁防护配置文件的端到端部署。

何时使用

• 在您的环境中部署或配置使用 Palo Alto 实施下一代防火墙能力时
• 在建立符合合规要求的安全控制时
• 在为该领域构建或改进安全架构时
• 在进行需要此实施的安全评估时

前置条件

• Palo Alto Networks PA 系列设备或 VM 系列虚拟防火墙
• PAN-OS 10.2 或更高版本
• 有效的 Threat Prevention、URL Filtering 和 WildFire 许可证
• 包含区域定义的网络拓扑文档
• 用于 User-ID 的 LDAP/Active Directory 集成凭据
• 用于 SSL Forward Proxy 解密的内部 CA 证书

核心概念

App-ID 技术

App-ID 按应用程序对网络流量进行分类，无论端口、协议或加密如何。分类引擎按顺序使用多种识别技术：

1. 应用程序签名 - 针对已知应用程序签名进行模式匹配
2. SSL/TLS 解密 - 解密流量以识别隐藏在加密隧道中的应用程序
3. 应用程序协议解码 - 解码协议以发现其中隧道传输的应用程序
4. 启发式分析 - 对规避其他方法的应用程序进行行为分析

Policy Optimizer 工具通过分析流量日志并推荐特定于应用程序的替代方案，帮助从传统的基于端口的规则迁移到 App-ID 规则。

User-ID 集成

User-ID 通过多种方法将 IP 地址映射到用户身份：

• 服务器监控 - 解析 Windows 安全事件日志（事件 ID 4624、4768、4769）
• Syslog 监听 - 从 RADIUS、802.1X、代理接收认证事件
• GlobalProtect - 自动映射 VPN 用户
• Captive Portal - 面向未知用户的基于 Web 的认证
• XML API - 从自定义来源进行程序化用户映射

基于区域的架构

区域代表网络的逻辑分段。安全策略控制区域之间（区域间）和区域内部（区域内）的流量：

区域	用途	信任级别
Trust	内部企业 LAN	高
Untrust	面向互联网	无
DMZ	面向公众的服务器	中
Guest	访客无线	低
DataCenter	服务器基础设施	高

工作流

步骤 1：初始系统配置

配置管理接口、DNS、NTP 和系统设置：

set deviceconfig system hostname PA-FW01
set deviceconfig system domain corp.example.com
set deviceconfig system dns-setting servers primary 10.0.1.10
set deviceconfig system dns-setting servers secondary 10.0.1.11
set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.pool.ntp.org
set deviceconfig system timezone US/Eastern
set deviceconfig system login-banner "Authorized access only. All activity is monitored."

步骤 2：配置网络区域和接口

定义安全区域并分配接口：

set zone Trust network layer3 ethernet1/1
set zone Untrust network layer3 ethernet1/2
set zone DMZ network layer3 ethernet1/3
set zone Guest network layer3 ethernet1/4

set network interface ethernet ethernet1/1 layer3 ip 10.10.0.1/24
set network interface ethernet ethernet1/1 layer3 interface-management-profile allow-ping
set network interface ethernet ethernet1/2 layer3 dhcp-client

set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 ethernet1/4 ]

步骤 3：配置区域保护配置文件

在区域级别防范侦察和 DoS 攻击：

set network profiles zone-protection-profile Strict-ZP flood tcp-syn enable yes
set network profiles zone-protection-profile Strict-ZP flood tcp-syn alert-rate 100
set network profiles zone-protection-profile Strict-ZP flood tcp-syn activate-rate 500
set network profiles zone-protection-profile Strict-ZP flood tcp-syn maximal-rate 2000
set network profiles zone-protection-profile Strict-ZP flood tcp-syn syn-cookies enable yes

set network profiles zone-protection-profile Strict-ZP flood udp enable yes
set network profiles zone-protection-profile Strict-ZP flood icmp enable yes

set network profiles zone-protection-profile Strict-ZP scan 8003 action block-ip
set network profiles zone-protection-profile Strict-ZP scan 8003 interval 2
set network profiles zone-protection-profile Strict-ZP scan 8003 threshold 100

步骤 4：配置威胁防护配置文件

创建 Anti-Virus、Anti-Spyware、Vulnerability Protection 和 URL Filtering 配置文件：

# Anti-Spyware Profile
set profiles spyware Strict-AS botnet-domains lists default-paloalto-dns packet-capture single-packet
set profiles spyware Strict-AS botnet-domains sinkhole ipv4-address pan-sinkhole-default-ip
set profiles spyware Strict-AS rules Block-Critical severity critical action block-ip

# Vulnerability Protection Profile
set profiles vulnerability Strict-VP rules Block-Critical-High vendor-id any severity [ critical high ] action block-ip

# URL Filtering Profile
set profiles url-filtering Strict-URL credential-enforcement mode ip-user
set profiles url-filtering Strict-URL block [ command-and-control malware phishing ]
set profiles url-filtering Strict-URL alert [ hacking proxy-avoidance-and-anonymizers ]

# File Blocking Profile
set profiles file-blocking Strict-FB rules Block-Dangerous application any file-type [ bat exe msi ps1 vbs ] direction both action block

# WildFire Analysis Profile
set profiles wildfire-analysis Strict-WF rules Forward-All application any file-type any direction both analysis public-cloud

步骤 5：配置 SSL 解密

设置 SSL Forward Proxy 以检查出站流量：

# Generate Forward Trust CA certificate
request certificate generate certificate-name SSL-FP-CA algorithm RSA digest sha256 ca yes

# Create Decryption Profile
set profiles decryption Strict-Decrypt ssl-forward-proxy block-expired-certificate yes
set profiles decryption Strict-Decrypt ssl-forward-proxy block-untrusted-issuer yes
set profiles decryption Strict-Decrypt ssl-forward-proxy block-unknown-cert yes
set profiles decryption Strict-Decrypt ssl-forward-proxy restrict-cert-exts yes

# Create Decryption Policy
set rulebase decryption rules Decrypt-Outbound from Trust to Untrust source any destination any
set rulebase decryption rules Decrypt-Outbound action decrypt type ssl-forward-proxy
set rulebase decryption rules Decrypt-Outbound profile Strict-Decrypt

# Exclude sensitive categories (financial, healthcare)
set rulebase decryption rules No-Decrypt-Sensitive from Trust to Untrust
set rulebase decryption rules No-Decrypt-Sensitive category [ financial-services health-and-medicine ]
set rulebase decryption rules No-Decrypt-Sensitive action no-decrypt

步骤 6：构建安全策略

创建具有安全配置文件的应用感知安全策略：

# Allow business applications from Trust to Internet
set rulebase security rules Allow-Business from Trust to Untrust
set rulebase security rules Allow-Business source-user any
set rulebase security rules Allow-Business application [ office365-enterprise salesforce-base slack-base zoom ]
set rulebase security rules Allow-Business service application-default
set rulebase security rules Allow-Business action allow
set rulebase security rules Allow-Business profile-setting group Strict-Security-Profiles

# Allow web browsing with URL filtering
set rulebase security rules Allow-Web from Trust to Untrust
set rulebase security rules Allow-Web application [ web-browsing ssl ]
set rulebase security rules Allow-Web action allow
set rulebase security rules Allow-Web profile-setting profiles url-filtering Strict-URL

# Block high-risk applications
set rulebase security rules Block-HighRisk from any to any
set rulebase security rules Block-HighRisk application [ bittorrent tor anonymizer ]
set rulebase security rules Block-HighRisk action deny
set rulebase security rules Block-HighRisk log-end yes

# Default deny rule (explicit)
set rulebase security rules Deny-All from any to any source any destination any
set rulebase security rules Deny-All application any service any action deny
set rulebase security rules Deny-All log-end yes

步骤 7：配置日志记录和 SIEM 集成

将日志转发到 SIEM 以进行关联：

# Configure Syslog Server Profile
set shared log-settings syslog SIEM-Server server SIEM transport UDP port 514 server 10.0.5.100
set shared log-settings syslog SIEM-Server server SIEM facility LOG_USER

# Configure Log Forwarding Profile
set shared log-settings profiles SIEM-Forward match-list Threats log-type threat
set shared log-settings profiles SIEM-Forward match-list Threats send-syslog SIEM-Server
set shared log-settings profiles SIEM-Forward match-list Traffic log-type traffic
set shared log-settings profiles SIEM-Forward match-list Traffic send-syslog SIEM-Server
set shared log-settings profiles SIEM-Forward match-list URL log-type url
set shared log-settings profiles SIEM-Forward match-list URL send-syslog SIEM-Server

验证与测试

1. 策略审计 - 使用 show running security-policy 进行检查，并查找被覆盖的规则
2. 流量验证 - 监控流量日志，检查应用识别是否准确
3. 威胁模拟 - 使用 EICAR 测试文件和已知恶意 URL 验证威胁配置文件
4. SSL 解密测试 - 在浏览器中验证证书链与 Forward Trust CA 匹配
5. 区域保护测试 - 运行受控的 SYN 洪水以验证 SYN cookie 激活
6. 策略优化器 - 运行策略优化器以识别剩余的基于端口的规则

# Verify active sessions
show session all filter application web-browsing

# Check threat log entries
show log threat direction equal backward

# Verify App-ID classification
show running application-override

# Check system resources
show system resources

最佳实践

• 最小权限 - 从全部拒绝开始，仅显式允许所需的应用
• 应用识别优先于端口 - 使用策略优化器将基于端口的规则替换为针对具体应用的规则
• 解密覆盖范围 - 在适当的隐私排除条件下，至少解密 80% 的 SSL 流量
• 安全配置文件组 - 将反病毒、反间谍软件、漏洞防护、URL 过滤、文件阻止和 WildFire 作为一组应用
• 签名更新 - 为应用和威胁启用每日自动内容更新
• HA 配置 - 在生产环境中部署为主动/被动 HA 对
• 提交验证 - 提交前始终验证配置：validate full

参考资料

• PAN-OS 管理员指南
• NGFW 部署最佳实践
• Palo Alto 防火墙最佳实践清单
• NIST SP 800-41 Rev 1 - 防火墙与策略指南