Next-Generation Security
Platform and Architecture
EDU-210
PAN-OS® 8.0
Courseware Version A
Agenda
§ Security platform overview
§ Next-generation firewall architecture
§ Zero Trust security model
§ Public cloud security
§ Firewall offerings
2 | ©2017, Palo Alto Networks, Inc.
Security Platform Overview
3 | ©2017, Palo Alto Networks, Inc.
Cyber Attack Lifecycle
Command Act on
Reconnaissance Weaponization Delivery Exploitation Installation & Control Objective
Stop the attack at any point!
4 | ©2017, Palo Alto Networks, Inc.
Next-Generation Security Platform
Next-Generation Firewall Threat Intelligence Cloud
§ Identifies and inspects all traffic § Gathers potential threats from network
and endpoints
§ Blocks known threats
§ Analyzes and correlates threat
§ Sends unknown to cloud
intelligence
§ Extensible to mobile and virtual
§ Disseminates threat intelligence to
networks
network and endpoints
Advanced Endpoint Protection
§ Inspects all processes and files
§ Prevents both known and unknown exploits
§ Integrates with cloud to prevent known and
unknown malware
5 | ©2017, Palo Alto Networks, Inc.
Next-Generation Security Platform (Cont.)
§ Panorama: Management and
Reporting
§ AutoFocus: Threat intelligence that
can be acted on
§ Aperture: Software-as-a-service
(SaaS) security
§ GlobalProtect: Extend platform
externally
6 | ©2017, Palo Alto Networks, Inc.
Next-Generation Firewall Architecture
7 | ©2017, Palo Alto Networks, Inc.
Palo Alto Networks Single-Pass Architecture
Single pass:
§ Operations per packet:
• Traffic classification with App-ID
technology
• User/group mapping
• Content scanning – threats, URLs,
confidential data
§ One single policy (per type)
Parallel processing:
§ Function-specific parallel processing
hardware engines
§ Separate data/control planes
8 | ©2017, Palo Alto Networks, Inc.
Palo Alto Networks Firewall Architecture
Control Plane
Control Plane | Management
MANAGEMENT CPU RAM STORAGE Provides configuration, logging, and report functions
configuration | logging | reporting
on a separate processor, RAM, and hard drive
Dataplane
SINGLE RAM Signature Matching
SIGNATURE MATCHING PASS
exploits (IPS) | virus | spyware | CC# | SSN PATTERN Stream-based, uniform signature match including
MATCH FPGA vulnerability exploits (IPS), virus, spyware, CC#, and
SSN
RAM Security Processing
SECURITY PROCESSING REPORT
AND High-density parallel processing for flexible hardware
App-ID | User-ID | URL match ENFORCE
policy match | app decoding | SSL/IPsec | decompression POLICY acceleration for standardized complex functions
CPU
Network Processing
RAM
NETWORK PROCESSING Front-end network processing, hardware-accelerated
flow control | route lookup | MAC lookup | QoS | NAT per-packet route lookup, MAC lookup, and NAT
FPGA
DATA INTERFACES
9 | ©2017, Palo Alto Networks, Inc.
Zero Trust Security Model
10 | ©2017, Palo Alto Networks, Inc.
Data Flows in an Open Network
North-
South
Traffic
East-West Traffic
11 | ©2017, Palo Alto Networks, Inc.
Data Flows Secured by Palo Alto Networks Solution
12 | ©2017, Palo Alto Networks, Inc.
coordinated Threat Prevention
Integrated Approach to Threat Prevention Act on
Delivery Exploitation Installation C2 Objective
Block high risk Block C2 on non- Prevent exfiltration
App-ID applications standard ports and lateral movement
URL Block known Block malware,
Filtering malware sites fast-flux domains
Prevent lateral
Vulnerability Block the exploit
movement
Anti- Block spyware,
spyware C2 traffic
Prevent lateral
AV Block malware
movement
Monitor allowed
Prevent malicious
Traps processes and Prevent the exploit
.exe from running
executables
Prevent drive-by Prevent exfiltration
File Blocking downloads and lateral movement
DoS/Zone Prevent evasions Prevent DoS attacks
Detect unknown Detect new
WildFire Identify malware
malware C2 traffic
13 | ©2017, Palo Alto Networks, Inc.
Public Cloud Security
14 | ©2017, Palo Alto Networks, Inc.
Public Cloud Security Overview
§ Protect your public cloud deployment just as you would your data center.
Hybrid Segmentation Internet Gateway Remote Access
Securely deploy applications
Separate data and applications Protect internet-facing Consistent policy on the network,
in your data center or in the
for compliance and security applications in the cloud, on devices
cloud
Automated Deployment and Centralized Management
§ Automate firewall deployments with bootstrapping; dynamically update Security policy to ensure security keeps pace with workload
changes
§ Manage all aspects of the VM-Series – from configuration to policy to reporting – from a centralized location
§ Enforce policy consistency across both virtualized and physical form-factor firewalls
15 | ©2017, Palo Alto Networks, Inc.
Hybrid Cloud: Quick Way to Get Started
§ Extend the corporate data center into the public cloud:
• Application dev/test/product projects are common…
§ IPsec VPN protects the connection and contents.
§ VM-Series NGFW features protects the content.
Dev Subnet
10.0.1.0/24
DC-FW1
IPsec VPN
DC-FW2
QA Subnet
10.0.2.0/24
16 | ©2017, Palo Alto Networks, Inc.
Application Segmentation: Expands upon Hybrid
§ Maintain separation between data and applications for security and compliance
§ Control which applications can communicate with each other
§ Protect traffic within the VPC/vNet and traversing each subnet
§ Prevent threats from moving laterally
Dev Subnet
10.0.1.0/24
DC-FW1
IPsec VPN
DC-FW2
QA Subnet
10.0.2.0/24
Prod Subnet
10.0.3.0/24
17 | ©2017, Palo Alto Networks, Inc.
Internet-Facing Applications: Leverage Perimeter Controls
§ Traditional perimeter security strengths apply:
• Visibility: Classify all traffic based on application identity
• Control: Enable those applications you want, deny those you don’t
• Protect: Block known and unknown threats
• Authorize: Grant access based on user identity
Edge Subnet
10.0.4.0/24
Server Subnet
10.0.5.0/24
18 | ©2017, Palo Alto Networks, Inc.
GlobalProtect: Extend Security to All Users/Devices
Public
Public cloud
cloud
§ Leverage scale and availability of the public cloud to reach global employees
§ Extend corporate Security policy to remote users
19 | ©2017, Palo Alto Networks, Inc.
Firewall Offerings
20 | ©2017, Palo Alto Networks, Inc.
Physical Platforms
Next-Generation Firewalls PA-5200 Series
PA-5000 Series
PA-3000 Series
PA-800 Series
PA-500
PA-220
PA-200 PA-7000 Series
Panorama
M-100 M-500/WF-500
21 | ©2017, Palo Alto Networks, Inc.
VM-Series Models and Capacities (PAN-OS® 8.0)
Performance and Capacities VM-700 VM-500 VM-300 VM-100 VM-50
Firewall throughput (App-ID enabled) 20Gbps 10Gbps 4Gbps 2Gbps 200Mbps
Threat prevention throughput 10Gbps 5Gbps 2Gbps 1Gbps 100Mbps
Max sessions 10,000,000 2,000,000 800,000 250,000 50,000
Dedicated CPU cores 2, 4, 8, 16 2, 4, 8 2, 4 2 2
Dedicated memory (minimum) 48GB 16GB 9GB 6.5GB 4.5GB
Dedicated disk drive capacity (minimum) 60GB 60GB 60GB 60GB 32GB
22 | ©2017, Palo Alto Networks, Inc.
Questions?
23 | ©2017, Palo Alto Networks, Inc.
Secures the Network
