implementing-next-generation-firewall-with-palo-alto

使用 Palo Alto 实施下一代防火墙

概述

Palo Alto Networks 下一代防火墙（NGFW）超越了传统的基于端口的规则执行，实现了应用感知、身份驱动的安全策略。通过利用 App-ID 进行流量分类、User-ID 进行身份驱动执行、Content-ID 进行威胁检测，以及 SSL 解密提升加密流量可见性，组织可获得对网络流量的全面控制。本技能涵盖从初始配置到高级威胁防御配置文件的端到端部署。

前置条件

• Palo Alto Networks PA 系列设备或 VM-Series 虚拟防火墙
• PAN-OS 10.2 或更高版本
• 有效的威胁防御、URL 过滤和 WildFire 许可证
• 包含区域定义的网络拓扑文档
• 用于 User-ID 的 LDAP/Active Directory 集成凭据
• 用于 SSL Forward Proxy 解密的内部 CA 证书

核心概念

App-ID 技术

App-ID 无论端口、协议或加密情况如何，都能按应用程序对网络流量进行分类。分类引擎按顺序使用多种识别技术：

1. 应用签名 - 与已知应用签名进行模式匹配
2. SSL/TLS 解密 - 解密流量以识别加密隧道中隐藏的应用
3. 应用协议解码 - 解码协议以发现其中隧道传输的应用
4. 启发式分析 - 对规避其他方法的应用进行行为分析

Policy Optimizer 工具通过分析流量日志并推荐特定应用替代规则，帮助从旧式基于端口的规则迁移到 App-ID 规则。

User-ID 集成

User-ID 通过多种方式将 IP 地址映射到用户身份：

• 服务器监控 - 解析 Windows 安全事件日志（事件 ID 4624、4768、4769）
• Syslog 监听 - 接收来自 RADIUS、802.1X、代理的认证事件
• GlobalProtect - 自动映射 VPN 用户
• 强制门户（Captive Portal） - 对未知用户进行 Web 认证
• XML API - 从自定义来源程序化映射用户

基于区域的架构

区域代表网络的逻辑分段。安全策略控制区域间（inter-zone）和区域内（intra-zone）的流量：

区域	用途	信任级别
Trust	企业内部 LAN	高
Untrust	面向互联网	无
DMZ	公开服务器	中
Guest	访客无线	低
DataCenter	服务器基础设施	高

实施步骤

步骤 1：初始系统配置

配置管理接口、DNS、NTP 和系统设置：

set deviceconfig system hostname PA-FW01
set deviceconfig system domain corp.example.com
set deviceconfig system dns-setting servers primary 10.0.1.10
set deviceconfig system dns-setting servers secondary 10.0.1.11
set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.pool.ntp.org
set deviceconfig system timezone US/Eastern
set deviceconfig system login-banner "仅授权访问。所有活动均受监控。"

步骤 2：配置网络区域和接口

定义安全区域并分配接口：

set zone Trust network layer3 ethernet1/1
set zone Untrust network layer3 ethernet1/2
set zone DMZ network layer3 ethernet1/3
set zone Guest network layer3 ethernet1/4

set network interface ethernet ethernet1/1 layer3 ip 10.10.0.1/24
set network interface ethernet ethernet1/1 layer3 interface-management-profile allow-ping
set network interface ethernet ethernet1/2 layer3 dhcp-client

set network virtual-router default interface [ ethernet1/1 ethernet1/2 ethernet1/3 ethernet1/4 ]

步骤 3：配置区域保护配置文件

在区域级别防范侦察和 DoS 攻击：

set network profiles zone-protection-profile Strict-ZP flood tcp-syn enable yes
set network profiles zone-protection-profile Strict-ZP flood tcp-syn alert-rate 100
set network profiles zone-protection-profile Strict-ZP flood tcp-syn activate-rate 500
set network profiles zone-protection-profile Strict-ZP flood tcp-syn maximal-rate 2000
set network profiles zone-protection-profile Strict-ZP flood tcp-syn syn-cookies enable yes

set network profiles zone-protection-profile Strict-ZP flood udp enable yes
set network profiles zone-protection-profile Strict-ZP flood icmp enable yes

set network profiles zone-protection-profile Strict-ZP scan 8003 action block-ip
set network profiles zone-protection-profile Strict-ZP scan 8003 interval 2
set network profiles zone-protection-profile Strict-ZP scan 8003 threshold 100

步骤 4：配置威胁防御配置文件

创建防病毒、反间谍软件、漏洞防护和 URL 过滤配置文件：

# 反间谍软件配置文件
set profiles spyware Strict-AS botnet-domains lists default-paloalto-dns packet-capture single-packet
set profiles spyware Strict-AS botnet-domains sinkhole ipv4-address pan-sinkhole-default-ip
set profiles spyware Strict-AS rules Block-Critical severity critical action block-ip

# 漏洞防护配置文件
set profiles vulnerability Strict-VP rules Block-Critical-High vendor-id any severity [ critical high ] action block-ip

# URL 过滤配置文件
set profiles url-filtering Strict-URL credential-enforcement mode ip-user
set profiles url-filtering Strict-URL block [ command-and-control malware phishing ]
set profiles url-filtering Strict-URL alert [ hacking proxy-avoidance-and-anonymizers ]

# 文件阻断配置文件
set profiles file-blocking Strict-FB rules Block-Dangerous application any file-type [ bat exe msi ps1 vbs ] direction both action block

# WildFire 分析配置文件
set profiles wildfire-analysis Strict-WF rules Forward-All application any file-type any direction both analysis public-cloud

步骤 5：配置 SSL 解密

为出站流量检测设置 SSL Forward Proxy：

# 生成 Forward Trust CA 证书
request certificate generate certificate-name SSL-FP-CA algorithm RSA digest sha256 ca yes

# 创建解密配置文件
set profiles decryption Strict-Decrypt ssl-forward-proxy block-expired-certificate yes
set profiles decryption Strict-Decrypt ssl-forward-proxy block-untrusted-issuer yes
set profiles decryption Strict-Decrypt ssl-forward-proxy block-unknown-cert yes
set profiles decryption Strict-Decrypt ssl-forward-proxy restrict-cert-exts yes

# 创建解密策略
set rulebase decryption rules Decrypt-Outbound from Trust to Untrust source any destination any
set rulebase decryption rules Decrypt-Outbound action decrypt type ssl-forward-proxy
set rulebase decryption rules Decrypt-Outbound profile Strict-Decrypt

# 排除敏感类别（金融、医疗）
set rulebase decryption rules No-Decrypt-Sensitive from Trust to Untrust
set rulebase decryption rules No-Decrypt-Sensitive category [ financial-services health-and-medicine ]
set rulebase decryption rules No-Decrypt-Sensitive action no-decrypt

步骤 6：构建安全策略

创建带安全配置文件的应用感知安全策略：

# 允许来自 Trust 区到互联网的业务应用
set rulebase security rules Allow-Business from Trust to Untrust
set rulebase security rules Allow-Business source-user any
set rulebase security rules Allow-Business application [ office365-enterprise salesforce-base slack-base zoom ]
set rulebase security rules Allow-Business service application-default
set rulebase security rules Allow-Business action allow
set rulebase security rules Allow-Business profile-setting group Strict-Security-Profiles

# 允许带 URL 过滤的 Web 浏览
set rulebase security rules Allow-Web from Trust to Untrust
set rulebase security rules Allow-Web application [ web-browsing ssl ]
set rulebase security rules Allow-Web action allow
set rulebase security rules Allow-Web profile-setting profiles url-filtering Strict-URL

# 阻断高风险应用
set rulebase security rules Block-HighRisk from any to any
set rulebase security rules Block-HighRisk application [ bittorrent tor anonymizer ]
set rulebase security rules Block-HighRisk action deny
set rulebase security rules Block-HighRisk log-end yes

# 默认拒绝规则（明确设置）
set rulebase security rules Deny-All from any to any source any destination any
set rulebase security rules Deny-All application any service any action deny
set rulebase security rules Deny-All log-end yes

步骤 7：配置日志记录和 SIEM 集成

将日志转发至 SIEM 进行关联分析：

# 配置 Syslog 服务器配置文件
set shared log-settings syslog SIEM-Server server SIEM transport UDP port 514 server 10.0.5.100
set shared log-settings syslog SIEM-Server server SIEM facility LOG_USER

# 配置日志转发配置文件
set shared log-settings profiles SIEM-Forward match-list Threats log-type threat
set shared log-settings profiles SIEM-Forward match-list Threats send-syslog SIEM-Server
set shared log-settings profiles SIEM-Forward match-list Traffic log-type traffic
set shared log-settings profiles SIEM-Forward match-list Traffic send-syslog SIEM-Server
set shared log-settings profiles SIEM-Forward match-list URL log-type url
set shared log-settings profiles SIEM-Forward match-list URL send-syslog SIEM-Server

验证与测试

1. 策略审计 - 使用 show running security-policy 检查并排查被遮蔽的规则
2. 流量验证 - 监控流量日志以验证应用分类准确性
3. 威胁模拟 - 使用 EICAR 测试文件和已知恶意 URL 验证威胁配置文件
4. SSL 解密测试 - 验证浏览器中的证书链是否匹配 Forward Trust CA
5. 区域保护测试 - 运行受控 SYN Flood 验证 SYN Cookie 激活
6. Policy Optimizer - 运行 Policy Optimizer 识别剩余的基于端口的规则

# 验证活动会话
show session all filter application web-browsing

# 检查威胁日志条目
show log threat direction equal backward

# 验证 App-ID 分类
show running application-override

# 检查系统资源
show system resources

最佳实践

• 最小权限 - 从全部拒绝开始，仅明确允许所需应用
• App-ID 优先于端口 - 使用 Policy Optimizer 将基于端口的规则替换为特定应用规则
• 解密覆盖率 - 在适当隐私排除的前提下，至少解密 80% 的 SSL 流量
• 安全配置文件组 - 将防病毒、反间谍软件、漏洞防护、URL 过滤、文件阻断和 WildFire 作为组应用
• 签名更新 - 启用应用和威胁的每日自动内容更新
• HA 配置 - 在生产环境中以主备 HA 对部署
• 提交前验证 - 提交前始终验证配置：validate full

参考资料

• PAN-OS 管理指南
• NGFW 部署最佳实践
• NIST SP 800-41 Rev 1 - 防火墙和策略指南