Auditing Palo Alto Firewalls

A Practitioner’s Guide to PAN-OS Security Reviews

A firewall can be operationally healthy while quietly allowing far more access than intended.

Rules accumulate. Exceptions become permanent. Security profiles get missed. Management access expands. Configurations drift.

This book provides a practical, structured approach to auditing Palo Alto Networks firewalls and finding the gap between what a firewall is supposed to do and what it actually allows.

The book takes the reader through a real audit from preparation to reporting.

Buy on Amazon Kindle

It covers:

• security policy analysis
• effective access between zones
• application and service controls
• NAT
• management-plane security
• threat prevention
• SSL/TLS decryption
• logging and monitoring
• high availability
• updates and lifecycle
• compliance mapping
• PAN-OS STIG
• NIST SP 800-53
• NIST SP 800-171 and CMMC
• audit automation
• audit reporting
• continuous auditing

The book includes five appendices:

• Audit Checklist
• Command and API Reference
• Sample Report Excerpt
• Glossary
• References and Further Reading

Who is the book for?

This book is intended for:

• network engineers
• security engineers
• firewall administrators
• security consultants
• auditors
• compliance professionals
• MSSPs
• anyone responsible for assessing Palo Alto firewall security

Readers should be comfortable with basic networking and have some exposure to PAN-OS, but the book does not assume they are Palo Alto experts.

The central idea

A firewall audit should not become a checkbox exercise.

The methodology in this book starts with the technical question:

"What can the firewall actually allow, and is that what the organization intended?"

Compliance mapping follows the technical assessment rather than replacing it. The same approach runs through every guide in the Palo Alto Firewall Auditing hub on this site.

About the author

Gordon Smith is a network and security professional based in Brisbane, Australia, with more than 30 years of enterprise networking experience.

His work has included Palo Alto hardware migrations, SSL decryption deployments and converting other vendors' firewall configurations to PAN-OS.

The recurring problems encountered during firewall audits led to the development of Rampart and ultimately to this book.

A note about Rampart

The author develops and sells Rampart, the firewall auditing product discussed in the book, through GSW Systems.

The book is deliberately structured so that the audit checks can be performed manually before automation is introduced.

The objective is to understand what is being tested and why.

Rampart automates many of the mechanical tasks involved in analysis, but automated results still require validation and auditor judgement.

This book is an independent publication and is not affiliated with, sponsored by, or endorsed by Palo Alto Networks.