! PermitANY — Palo Alto Security Hardening
! PAN-OS security hardening aligned with Palo Alto best practices and CIS Benchmarks: admin access, SSL/TLS, SNMP, management plane restrictions, and security profile defaults.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
# Palo Alto Security Hardening — PA-FW-01
#
# Password Policy
set mgt-config password-complexity enabled yes
set mgt-config password-complexity minimum-length 12
set mgt-config password-complexity minimum-uppercase-letters 1
set mgt-config password-complexity minimum-lowercase-letters 1
set mgt-config password-complexity minimum-numeric-letters 1
set mgt-config password-complexity minimum-special-characters 1
#
# Admin Lockout
set deviceconfig setting management admin-lockout failed-attempts 5
set deviceconfig setting management admin-lockout lockout-time 15
set deviceconfig setting management idle-timeout 10
#
# Management Access

set deviceconfig system service disable-http yes


set deviceconfig system service disable-telnet yes

set deviceconfig system service disable-userid-service yes
#
# TLS Settings
set deviceconfig system ssl-tls-service-profile tls-profile protocol-settings min-version tls1-2
set deviceconfig system ssl-tls-service-profile tls-profile protocol-settings max-version max
#
# Login Banner

set deviceconfig system login-banner "AUTHORIZED ACCESS ONLY."

#
# Management Permitted IPs

set deviceconfig system permitted-ip 10.0.0.0/24,172.16.0.0/16

#
# SNMP
{{#if (eq snmp_version "v3")}}
set deviceconfig system snmp-setting access-setting version v3
{{/if}}
#
# DNS Proxy Hardening
set deviceconfig system dns-security-policy no-expired-domains block yes
#
# Threat Prevention Defaults
set vsys1 profiles zone-protection-profile default flood tcp-syn enable yes
set vsys1 profiles zone-protection-profile default flood udp enable yes
set vsys1 profiles zone-protection-profile default flood icmp enable yes
set vsys1 profiles zone-protection-profile default scan enable yes
#
commit