The Palo Alto Networks next-generation firewalls are network firewall appliances and virtual appliances used to manage enterprise network traffic flow using function specific processing for networking, security, and management. The next-generation firewalls let the administrator specify security policies based on an accurate identification of each application seeking access to the protected network. The next-generation firewall uses packet inspection and a library of applications to distinguish between applications that have the same protocol and port, and to identify potentially malicious applications that use non-standard ports. The next-generation firewall also supports the establishment of Virtual Private Network (VPN) connections to other next-generation firewalls or third party security devices.
\r\nThe TOE is Palo Alto Networks PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series, PA-7000 Series, and VM Series Next-Generation Firewall with PAN-OS 7.0.1-h4. The appliance models are:
\r\n· PA-200
\r\n· PA-500
\r\n· PA-2000: PA-2020, PA-2050
\r\n· PA-3000: PA-3020, PA-3050, PA-3060
\r\n· PA-4000: PA-4020, PA-4050, PA-4060
\r\n· PA-5000: PA-5020, PA-5050, PA-5060
\r\n· PA-7000: PA-7050, PA-7080
\r\n· VM-Series—the following virtual appliances when installed on a specified hardware platform (see below) that includes VMware ESXi 5.5 hypervisor and an Intel Core or Xeon processor based on the Ivy Bridge or Haswell microarchitectures, which implement Intel Secure Key:
\r\na. VM-1000-HV
\r\nb. VM-300
\r\nc. VM-200
\r\nd. VM-100
\r\nNote, the NDPP specifies requirements for a network device—a device composed of hardware and software that is connected to the network and has an infrastructure role on the network. Therefore, the VM-Series virtual appliances are considered to be in their evaluated configuration only when installed on the following specified hardware platforms and are not evaluated for deployment on any other platforms.
\r\n· Dell PowerEdge R430, R530, R630, R730, R730xd and R930 Servers
\r\n· Equivalent platforms i.e., Intel Ivy Bridge or Haswell-based processor with Broadcom or Intel Network Interface Controllers supported by the server
\r\nIn addition, the VM-Series virtual appliance must be the only guest running in the virtualized environment. Evaluation testing included the VM-300 installed on a Dell PowerEdge R730 Server running VMware ESXi 5.5 on an Intel Xeon E5-2630 v3 (Haswell microarchitecture) processor with Broadcom 5720 NIC.
","evaluation_configuration":"","security_evaluation_summary":"\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme for the Protection Profile for Network Devices with Stateful Traffic Filter Firewall and VPN Gateway extended packages. The criteria against which the Palo Alto Networks Next-Generation Firewall Devices with PAN-OS 7.0.1-h4 were judged are described in the Protection Profile Assurance Activities. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 revision 4. The product, when delivered configured as identified in the guidance document, satisfies all of the security functional requirements stated in the Palo Alto Networks PA-200, PA-500, PA-2000 Series, PA-3000 Series, PA-4000 Series, PA-5000 Series, PA-7000 Series, VM Series, Next-Generation Firewall with PAN-OS 7.0.1-h4 Security Target. The project underwent CCEVS validation team review. The evaluation was completed in November 2015. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"\r\n\r\nSecurity Audit
\r\nThe TOE is designed to be able to generate logs for a wide range of security relevant events including the events specified in NDPP. The TOE can be configured to store the logs locally so they can be accessed by an administrator and can also be configured to send the logs to a designated external log server.
\r\nCryptographic Support
\r\nThe TOE implements NIST-validated cryptographic algorithms that provide key management, random bit generation, encryption/decryption, digital signature and cryptographic hashing and keyed-hash message authentication features in support of higher level cryptographic protocols, including IPsec and TLS. Note that to be in the evaluated configuration, the TOE must be configured in Common Criteria mode, which ensures the TOE’s configuration is consistent with the FIPS 140-2 standard.
\r\nUser Data Protection
\r\nThe TOE is designed to ensure that it does not inadvertently reuse data found in network traffic.
\r\nIdentification and Authentication
\r\nThe TOE requires all users accessing the TOE user interfaces to be successfully identified and authenticated before they can access any security management functions available in the TOE. The TOE offers network accessible (HTTP over TLS) and direct connections to the GUI for interactive administrator sessions.
\r\nThe TOE supports the local (i.e., on device) definition and authentication of administrators with username, password, and role (set of privileges), which it uses to authenticate the human user and to associate that user with an authorized role. In addition, the TOE can authenticate users using X509 certificates and can be configured to lock a user out after a configurable number of unsuccessful authentication attempts.
\r\nSecurity Management
\r\nThe TOE provides a GUI to access the wide range of security management functions. Security management commands are limited to administrators and are available only after they have provided acceptable user identification and authentication data to the TOE. The TOE provides access to the GUI locally via direct RJ-45 Ethernet cable connection and remotely using an HTTPS/TLS client.
\r\nThe TOE provides a number of management functions and restricts them to users with the appropriate privileges. The management functions include the capability to create new user accounts, configure the audit function, configure the information flow control rules, and review the audit trail. The TOE provides pre-defined Security Administrator, Audit Administrator, and Cryptographic Administrator roles. These administrator roles are all considered Security Administrator as defined in the NDPP for the purposes of this ST.
\r\nProtection of the TSF
\r\nThe TOE implements a number of features designed to protect itself to ensure the reliability and integrity of its security features.
\r\nIt protects particularly sensitive data such as stored passwords and cryptographic keys so that they are not accessible even by an administrator. It also provides its own timing mechanism to ensure that reliable time information is available (e.g., for log accountability).
\r\nThe TOE includes functions to perform self-tests so that it might detect when it is failing. It also includes mechanisms so that the TOE itself can be updated while ensuring that the updates will not introduce malicious or other unexpected changes in the TOE.
\r\nTOE Access
\r\nThe TOE provides the capabilities for both TOE- and user-initiated locking of interactive sessions and for TOE termination of an interactive session after a period of inactivity. The TOE will display an advisory and consent warning message regarding unauthorized use of the TOE before establishing a user session.
\r\nTrusted Path/Channels
\r\nThe TOE protects interactive communication with remote administrators using IPsec or HTTP over TLS. IPsec and TLS ensures both integrity and disclosure protection.
\r\nThe TOE protects communication with the UIA, update server using TLS connections; the external log server with IPsec or TLS, and remote VPN gateways/peers using IPsec to prevent unintended disclosure or modification of the transferred data.
\r\nStateful traffic filtering
\r\nThe TOE provides a stateful traffic filter firewall for layers 3 and 4 (IP and TCP/UDP) network traffic optimized through the use of stateful packet inspection.
\r\nAn administrator can configure the TOE to control the type of information that is allowed to pass through the TOE. The administrator defines the security zone and applies security policies to network traffic attempting to traverse the TOE to determine what actions to take.
\r\nThe TOE groups interfaces into security zones. Each zone identifies one or more interfaces on the TOE. Separate zones must be created for each type of interface (Layer 2, Layer 3, or virtual wire), and each interface must be assigned to a zone before it can process traffic. Security policies provide the firewall rule sets that specify whether to block or allow network connections, based on the source and destination zones, and addresses, and the application service (such as UDP port 67 or TCP port 80). Security policy rules are processed in sequence, applying the first rule that matches the incoming traffic.
\r\nPacket filtering
\r\nThe TOE provides packet filtering and secure IPsec tunneling. The tunnels can be established between two trusted VPN peers as well as between remote VPN clients and the TOE. An administrator can configure security policies that determine whether to block, allow, or log a session based on traffic attributes such as the source and destination security zone, the source and destination IP address, the application, user, and the service.
","features":[]}