High risk. 4 critical findings leave the device exposed until they are fixed.
Score 23/100 (high risk) overall. 4 Critical, 3 High, 22 Medium and 23 Low findings were found. Fix first: an allow-everything rule, insecure services open to the internet and cleartext management access.
Start at 100 points. Each level has a weight (Critical 12, High 5, Medium 2, Low 0.5) that is multiplied by the number of findings; every additional finding at the same level counts 90% as much as the previous one. Total deduction 77.4, result 23/100.
| Level | Count | Weight | Deducted |
|---|---|---|---|
| Critical | 4 | 12.0 | 41.3 |
| High | 3 | 5.0 | 13.6 |
| Medium | 22 | 2.0 | 18.0 |
| Low | 23 | 0.5 | 4.6 |
Total deducted: 77.4
This rule allows anyone to access any internal resource, making a breach trivial if a single password is stolen.
First step: Policies > Security: check the rule's traffic in Monitor > Traffic, then restrict source, destination, application and service to what is actually used.
Exposing management ports like SSH or RDP to the internet allows attackers to attempt brute-force logins to your servers.
First step: Policies > Security: Change the source zone or add a specific source IP to restrict access.
Enabling HTTP or Telnet sends management credentials in plain text, allowing them to be stolen by anyone on the path.
First step: Network > Network Profiles > Interface Mgmt: edit the profile and untick HTTP and Telnet (keep HTTPS/SSH only where needed).
Default SNMP strings are well-known to attackers and can be used to leak sensitive device information.
First step: Device > Setup > Operations > SNMP Setup: use SNMPv3, or replace the community string with a long random value.
Allowing any application enables attackers to use non-standard ports to bypass security controls and hide malicious traffic.
First step: Policies > Security: use the rule's App-ID data (Policy Optimizer) to replace 'any' in Application with the specific applications seen.
Missing zone protection leaves the firewall vulnerable to flood attacks and reconnaissance scans on that interface.
First step: Network > Network Profiles > Zone Protection: create a profile, then assign it under Network > Zones for this zone.
If logs are not enabled, you will have no record of who accessed your network during a security incident.
First step: Policies > Security: Edit the rule and check the 'Log at Session End' box.
Without security profiles, the firewall cannot detect or block viruses, spyware, or known vulnerabilities in the traffic.
First step: Objects > Security Profile Groups: create a group (antivirus, anti-spyware, vulnerability, URL), then attach it in the rule's Actions tab > Profile Setting.
Using 'any' service allows traffic on any port, increasing the attack surface for services that should be restricted.
First step: Policies > Security: Change the Service column from 'any' to 'application-default' or a specific port.
A broader rule above catches this traffic first, so the restriction you think is in place never applies and more traffic is allowed than intended.
First step: Policies > Security: Move the specific rule above the general 'any' rule or delete it.
Without syslog forwarding, logs are only stored locally and can be lost or deleted by an attacker.
First step: Device > Server Profiles > Syslog: add your log server, then use it in Objects > Log Forwarding and in Device > Log Settings.
Management interfaces open to the world are targets for constant brute-force attacks and vulnerability scanning.
First step: Network > Network Profiles > Interface Mgmt: add only your management networks under Permitted IP Addresses, or remove management services from this interface.
Disabled rules clutter the configuration and can lead to confusion or accidental activation of insecure policies.
First step: Policies > Security: Review the rule; delete it if it is no longer needed.
Rules without descriptions make it difficult for other engineers to understand the business purpose of the traffic.
First step: Policies > Security: Add a clear description explaining why the rule exists and who requested it.
Using the default 'admin' username makes it easier for attackers to guess the login credentials.
First step: Device > Administrators: create a named superuser account for each admin, test it, then delete or disable the default 'admin' account.
Incorrect system time can break authentication (like LDAP/SAML) and make log timestamps unreliable for forensics.
First step: Device > Setup > Services > NTP: add two reliable NTP servers.
A missing login banner fails to provide legal warning to unauthorized users, which may be required for compliance.
First step: Device > Setup > Management > General Settings: enter a legal warning in Login Banner.