Hardening the management interface

From a security perspective, it is best practice to ensure all your vulnerable and critical systems are always hardened. Thus, any unneeded services must be turned off, access should be restricted to only specific hosts, role-based access control (RBAC) principles should be upheld, and protocols should be restricted to the most secure version. The default configuration of the Palo Alto Networks appliances is actually relatively weak. This is intentional, to allow administrators to quickly deploy a firewall or panorama out of the box without too much hassle to get it running. Securing the appliance is left for after the initial deployment, but this stage is often overlooked. The following sections will provide you with knowledge you will need in order to harden your appliances.

FIPS-CC mode

FIPS-CC mode sets the system to comply with standards described in the Federal Information Processing Standard (FIPS) 140-2 and Common Criteria (CC). Enabling...