Sample report
A complete deliverable on a fictional configuration
Every finding, its evidence, its remediation and the section that states what the analysis could not prove
This is a sample on a fictional environment. No customer configuration is shown.
Sample: lab edge firewall (PAN-OS 11.1)
FirewallPAN-OS 11.1.0PAN-BP 0.1.0
- Scope
- vsys1
- Rules
- 15
- Objects
- 18
- NAT rules
- 4
- Zones
- 3
- Analyzed
- Oct 31, 2026, 12:00 PM
- Kept until
- 362 days left
Executive summary
This firewall running PAN-OS 11.1.0 scored 0 out of 100. The review examined 15 security rules, 4 NAT rules and 18 objects, and produced 63 findings: 16 critical, 19 high, 18 medium, 3 low and 7 informational. The critical findings are the ones to act on this week; each one describes a path that is open right now.
Do these first
- critical: Inbound internet rule without threat prevention (4 affected)
- critical: Allow rule without any security profile (3 affected)
- critical: Allow rule matches any source and any destination (2 affected)
- critical: Inbound destination NAT without a restrictive security rule (2 affected)
- critical: Well known administrator account is active with full privilege (2 affected)
Findings
63 findings, sorted by risk
63 of 63
Passed0
| Severity | Finding | Object | Evidence | Risk | Status | Learn more |
|---|---|---|---|---|---|---|
| Critical | deviceconfig/system/service | /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system | 375 | Open | ||
| Critical | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 300 | Open | ||
| Critical | Inbound-Web-DMZ | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ'] | 300 | Open | ||
| Critical | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 300 | Open | ||
| Critical | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 300 | Open | ||
| Critical | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 300 | Open | ||
| Critical | DNAT-Unpublished-Admin | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Unpublished-Admin'] | 300 | Open | ||
| Critical | DNAT-Web-Any-Service | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Web-Any-Service'] | 300 | Open | ||
| Critical | MGMT-ALLOW-ALL | /config/devices/entry[@name='localhost.localdomain']/network/profiles/interface-management-profile/entry[@name='MGMT-ALLOW-ALL'] | 300 | Open | ||
| Critical | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 240 | Open | ||
| Critical | admin | /config/mgt-config/users/entry[@name='admin'] | 240 | Open | ||
| Critical | apiuser | /config/mgt-config/users/entry[@name='apiuser'] | 240 | Open | ||
| Critical | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 180 | Open | ||
| Critical | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 180 | Open | ||
| Critical | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 180 | Open | ||
| Critical | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 180 | Open | ||
| High | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 144 | Open | ||
| High | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 144 | Open | ||
| High | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 135 | Open | ||
| High | DNAT-Web-Any-Service | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='DNAT-Web-Any-Service'] | 128 | Open | ||
| High | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 120 | Open | ||
| High | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 120 | Open | ||
| High | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 120 | Open | ||
| High | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 120 | Open | ||
| High | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 120 | Open | ||
| High | admin | /config/mgt-config/users/entry[@name='admin'] | 120 | Open | ||
| High | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 108 | Open | ||
| High | Outbound-Web | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web'] | 108 | Open | ||
| High | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 96 | Open | ||
| High | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 96 | Open | ||
| High | all-networks | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address-group/entry[@name='all-networks'] | 96 | Open | ||
| High | SNAT-DB-Bidirectional | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/nat/rules/entry[@name='SNAT-DB-Bidirectional'] | 96 | Open | ||
| High | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 80 | Open | ||
| High | Legacy-Partner-Inbound | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Legacy-Partner-Inbound'] | 80 | Open | ||
| High | Inbound-Web-DMZ | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Web-DMZ'] | 80 | Open | ||
| Medium | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 72 | Open | ||
| Medium | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 72 | Open | ||
| Medium | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 72 | Open | ||
| Medium | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 64 | Open | ||
| Medium | Inbound-Mail | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Mail'] | 60 | Open | ||
| Medium | Inbound-Mail | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Inbound-Mail'] | 60 | Open | ||
| Medium | log-settings | /config/shared/log-settings | 60 | Open | ||
| Medium | deviceconfig/system/snmp-setting | /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system | 54 | Open | ||
| Medium | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 48 | Open | ||
| Medium | Catch-All-Internal | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal'] | 48 | Open | ||
| Medium | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 48 | Open | ||
| Medium | Catch-All-Internal | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal'] | 48 | Open | ||
| Medium | Temp-Vendor-Access-tmp | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Temp-Vendor-Access-tmp'] | 48 | Open | ||
| Medium | Catch-All-Internal | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal'] | 48 | Open | ||
| Medium | Catch-All-Internal | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Catch-All-Internal'] | 40 | Open | ||
| Medium | Outbound-Web | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Outbound-Web'] | 36 | Open | ||
| Medium | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 32 | Open | ||
| Medium | Block-Known-Bad-Sources | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Block-Known-Bad-Sources'] | 32 | Open | ||
| Low | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 24 | Open | ||
| Low | deviceconfig/system/ntp-servers | /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system | 24 | Open | ||
| Low | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 8 | Open | ||
| Observation | web-server-1 | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='web-server-1'] | 6 | Open | ||
| Observation | Old-Guest-Wifi-Rule | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Old-Guest-Wifi-Rule'] | 4 | Open | ||
| Observation | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 4 | Open | ||
| Observation | Any-Any-Permit-All | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Any-Any-Permit-All'] | 4 | Open | ||
| Observation | Broad-Datacenter-Allow | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/rulebase/security/rules/entry[@name='Broad-Datacenter-Allow'] | 4 | Open | ||
| Observation | deviceconfig/system/login-banner | /config/devices/entry[@name='localhost.localdomain']/deviceconfig/system | 4 | Open | ||
| Observation | web-server-dup | /config/devices/entry[@name='localhost.localdomain']/vsys/entry[@name='vsys1']/address/entry[@name='web-server-dup'] | 1 | Open | ||
Limits of this report
Stated by the analysis, not by a person deciding what to admit.
- This review reads the configuration only. It cannot see traffic logs, so it cannot say which permitted paths are actually used.
- Internet exposure is inferred from zone names and address breadth, not from routing tables.
- This is a firewall export. Objects, rules and log settings inherited from Panorama may not appear in it.