Palo alto networks next generation firewalls
37 likes•20,797 views
The document summarizes Palo Alto Networks next-generation firewalls which can identify applications, users, and content to provide visibility and granular control. This helps address challenges of uncontrolled use of internet applications in enterprises. The firewalls can see through ports and protocols to classify over 900 applications using techniques like App-ID, User-ID, and Content-ID. This gives IT unprecedented control over network activities.
Palo alto networks next generation firewalls
- 1. Palo Alto Next-generation Firewalls Castle Force is an authorised partner of Palo Alto Networks in the UK http://www.castleforce.co.uk/Palo-Alto-Networks.php
- 2. Our enterprise is changing Driven by new generation of Internet-centric users Giant social system - traditional boundaries have been eliminated Built around communication, sharing, collaboration, group knowledge Full, unrestricted access to everything on the Internet is a right IT and business need to determine risk tolerance of Social Enterprise Internet Enterprise Work Life Home Life Page | Rewards Risks
- 3. Enterprise applications take many forms What’s running on YOUR network? Page |
- 4. What we recently found on enterprise networks 484 total unique applications running on 60 large enterprises Application usage and Risk Report Page |
- 5. Employees use them, but management is struggling 73% - like to read and write blogs for business 59% - use Instant Messaging at work 53% - like Twitter for business and personal use 52% - participate in online discussion forums at work 52% - execs admit they’re important to business goals, success 6% - but very few businesses deploy them widely today Page |
- 6. Business benefits of enterprise applications Twitter – instant alerts on corporate news or information Blogs – instant perspective and analysis on relevant issues IM – instant communication with remote employees Webex – instant meetings with customers in another city Salesforce – instant update to sales data from any location YouTube – instant distribution of product training videos SharePoint – instant collaboration on complex projects Better communication, collaboration, information exchange Increased efficiency, lower cost, higher productivity for all Page |
- 7. Data loss Unauthorized employee file transfer, data sharing Non-compliance Using unapproved applications – IM, web mail in financial services Operational cost overruns Excessive bandwidth consumption, desktop cleanup Employee productivity loss Uncontrolled, excessive use of personal applications Business continuity Malware or application vulnerability induced downtime Internal risks of enterprise applications Page |
- 8. But employees are unconcerned about risks 64% - understand some apps can result in data leakage 33% - experienced security issues when using an app 45% - did nothing when confronted with a security breach 61% - feel more productive using internet apps The inmates are running the asylum 59% - admit these apps are completely uncontrolled IT is losing control of applications, users, content 48% - don’t know what apps are used by employees Page |
- 9. Summary of the social enterprise challenge for IT Employees Driving exploding use of collaborative Internet applications Using an average of 6 different business and personal applications Ignoring policies and circumventing security controls to get them Unaware and unconcerned about data theft and potential threats In control of the network – more users, more apps coming IT Cannot see applications Cannot control applications Cannot identify specific users Cannot enforce effective policies Cannot manage the risk or rewards of these apps for the business Page |
- 10. The underlying cause of the security problem Firewalls should see and control applications, users, and threats . . . . . . but they only show you ports, protocols, and IP addresses –all meaningless! Page |
- 11. The current solving Internet Doesn’t solve the problem Firewall “helpers” have limited view of traffic Complex and costly to buy and maintain © 2009 Palo Alto Networks. Proprietary and Confidential. Page |
- 12. Enough! it’s time to fix the firewall! Page | How to Make the Firewall Useful Again 1. Identify applications regardless of port, protocol, evasive tactic or SSL 2. Identify users regardless of IP address 3. Identify and prevent potential threats associated with all high risk applications 4. Granular policy-based control over applications, users, functionality 5. Multi-gigabit, in-line deployment with no performance degradation
- 13. About Palo Alto Networks Founded in 2005 by security visionary Nir Zuk World class team with strong security and networking experience Innovations: App-ID, User-ID, Content-ID Builds next-generation firewalls that identify and control more than 900 applications; makes firewall strategic again Global footprint: presence in 50+ countries, 24/7 support © 2009 Palo Alto Networks. Proprietary and Confidential. Page |
- 14. Unique Technologies Transform the Firewall App-ID Identify the application User-ID Identify the user Content-ID Scan the content © 2009 Palo Alto Networks. Proprietary and Confidential. Page |
- 15. Purpose-Built Architecture: PA-4000 Series © 2009 Palo Alto Networks. Proprietary and Confidential. Page | Content Scanning HW Engine Palo Alto Networks’ uniform signatures Multiple memory banks – memory bandwidth scales performance Multi-Core Security Processor High density processing for flexible security functionality Hardware-acceleration for standardized complex functions (SSL, IPSec, decompression) Dedicated Control Plane Highly available mgmt High speed logging and route updates 10Gbps Dual-core CPU RAM RAM HDD 10 Gig Network Processor Front-end network processing offloads security processors Hardware accelerated QoS, route lookup, MAC lookup and NAT CPU 16 . . SSL IPSec De-Compression CPU 1 CPU 2 10Gbps Control Plane Data Plane RAM RAM CPU 3 QoS Route, ARP, MAC lookup NAT Content Scanning Engine RAM RAM RAM RAM
- 16. Enables Executive Visibility © 2009 Palo Alto Networks. Proprietary and Confidential. Page | © 2008 Palo Alto Networks. Proprietary and Confidential. Page | © 2008 Palo Alto Networks. Proprietary and Confidential. Page |
- 17. Palo Alto Networks-OS Features Strong networking foundation Dynamic routing (OSPF, RIPv2) Site-to-site IPSec VPN SSL VPN for remote access Tap mode – connect to SPAN port Virtual wire (“Layer 1”) for true transparent in-line deployment L2/L3 switching foundation QoS traffic shaping Max/guaranteed and priority By user, app, interface, zone, and more Zone-based architecture All interfaces assigned to security zones for policy enforcement High Availability Active / passive Configuration and session synchronization Path, link, and HA monitoring Virtual Systems Establish multiple virtual firewalls in a single device (PA-4000 Series only) Simple, flexible management CLI, Web, Panorama, SNMP, Syslog © 2009 Palo Alto Networks. Proprietary and Confidential. Page | Visibility and control of applications, users and content are complemented by core firewall features PA-500 PA-2020 PA-2050 PA-4020 PA-4050 PA-4060
- 18. Flexible Deployment Options © 2009 Palo Alto Networks. Proprietary and Confidential. Page | Visibility Transparent In-Line Firewall Replacement Application, user and content visibility without inline deployment IPS with app visibility & control Consolidation of IPS & URL filtering Firewall replacement with app visibility & control Firewall + IPS Firewall + IPS + URL filtering
- 19. You decide how much control is needed Unprecedented level of application control Decrypt where appropriate Deny – even unknown applications Allow Allow but scan Allow certain users Allow certain functions Shape (QoS) … and various combinations of the above Page |
- 20. Next-generation firewalls for everyone Performance Remote Office/ Medium Enterprise Large Enterprise PA-2000 Series PA-4000 Series PA-500 Page |
- 21. Leading Organisations Trust Palo Alto Networks © 2009 Palo Alto Networks. Proprietary and Confidential Page | Financial Services Government Media / Entertainment / Retail Service Providers / Services
- 22. Leading Organisations Trust Palo Alto Networks © 2009 Palo Alto Networks. Proprietary and Confidential Page | Education Mfg / High Tech / Energy Healthcare Industry
- 23. Thank You Please contact us on Tel : +44(0)118 907 1600 Tel: +44(0)151 203 1400 Email: [email protected] Need a Quote for Palo Alto Firewall
Editor's Notes
- #5: 494 unique apps * 30 business apps * 44 file sharing apps (all types) * 43 photo/video apps * 17 social networking * 45 IM
- #13: Now lets change gears and think positive… What the firewall really did provide innovation? What would it look like? Based on whats really happening, here are 5 critical requirements. Networks exist to support apps – you need to see them Ip addresses are annoying – you need to know the user by name Forget adding other threat prevention stuff – make the FW stop the damn threats! If you have this level of visibility, the policies you create will be effective and enforceable at the end of the day, it must keep pace with your business – security stuff should not slow you down.
- #16: 03/05/07