Palo Alto Networks Overview

Transcription

1 Palo Alto Networks Overview campu[s]³ Christian Etzold Sr. System Engineer

2 About Palo Alto Networks Palo Alto Networks is the Network Security Company World-class team with strong security and networking experience - Founded in 2005, first customer July 2007, top-tier investors Builds next-generation firewalls that identify / control 1,300+ applications - Restores the firewall as the core of enterprise network security infrastructure - Innovations: App-ID, User-ID, Content-ID Global momentum: 4,500+ customers - August 2011: Annual bookings run rate is over US$200 million*, cash-flow positive last five consecutive quarters A few of the many enterprises that have deployed more than $1M Page 2 (*) Bookings run rate is defined as 4 (four) times the bookings amount of the most recently finished fiscal quarter. Bookings are defined as non-cancellable orders received during the fiscal period. Palo Alto Networks fiscal year runs from August 1st until July 31st.

3 The Internet World Anno 1995 Virtually no application traffic, no known threats Simple assumptions worked; HTTP traffic = browsing Firewalls were born to keep simple traffic from coming in or going out; in 15 years time it became a $5B industry Page Palo Alto Networks. Proprietary and Confidential.

4 Security v1.0 Response: Rip Holes in Firewall Traditional Applications DNS Gopher SMTP HTTP Dynamic Applications FTP RPC Java/RMI Multimedia Background Appeared mid 1980 s Typically embedded in routers Classify individual packets based on port numbers Internet Challenge Could not support dynamic applications Flawed solution was to open large groups of ports Opened the entire network to attack

5 Security v2.0: Stateful Inspection Traditional Applications DNS Gopher SMTP HTTP Internet Dynamic Applications FTP RPC Java/RMI Multimedia Evasive Applications Encrypted Web 2.0 P2P Instant Messenger Skype Music Games Desktop Applications Spyware Crimeware Background Innovation created Check Point in 1994 Used state table to fix packet filter shortcomings Classified traffic based on port numbers but in the context of a flow Challenge Cannot identify Evasive Applications Embedded throughout existing security products

6 The Internet World Anno 2010 Many applications; many more threats Applications are evasive and are the #1 threat vector Traditional firewalls are defenseless and offer no protection to enterprises Page Palo Alto Networks. Proprietary and Confidential.

7 Applications Have Changed; Firewalls Have Not The firewall is the right place to enforce policy control Sees all traffic Defines trust boundary Enables access via positive control BUT applications have changed Ports Applications IP Addresses Users Packets Content Need to restore visibility and control in the firewall Page 7

8 Applications Carry Risk Applications can be threats P2P file sharing, tunneling applications, anonymizers, media/video Applications carry threats Qualys Top 20 Vulnerabilities majority result in applicationlevel threats Applications & application-level threats result in major breaches RSA, Comodo, FBI Page 8

9 Enterprise 2.0 Applications and Risks Widespread Palo Alto Networks latest Application Usage & Risk Report highlights actual behavior of 1M+ users in 1253 organizations - More enterprise 2.0 application use for personal and business reasons. - Tunneling and port hopping are common - Bottom line: all had firewalls, most had IPS, proxies, & URL filtering but none of these organizations could control what applications ran on their networks Page 9

10 The Traditional Approach to Network Security Corporate Assets Security Perimeter WAN XML/W.S. Attacks (2004) Web App Attacks (2002) Info Leakage (2005) Worms (2005) Eavesdropping (1994) IM Attacks (2002) Content Access (1998) Resource Access (1992) Viruses (1997) Denial of Service (2000) XML Security Spyware (2006) Exploits (1996) IM Security Anti-Virus Anti-Spyware IPS IPSEC DoS Internet DLP/ILP Content VPN Protection Filtering IDS Worm Mitigation WebApp Security

11 Traditional Systems Have Limited Understanding Some port-based apps caught by firewalls (if they behave!!!) Some web-based apps caught by URL filtering or proxy Some evasive apps caught by an IPS None give a comprehensive view of what is going on in the network Page 11

12 Technology Sprawl & Creep Are Not The Answer Internet More stuff doesn t solve the problem Firewall helpers have limited view of traffic Complex and costly to buy and maintain Putting all of this in the same box is just slow Page 12

13 The Right Answer: Make the Firewall Do Its Job New Requirements for the Firewall 1. Identify applications regardless of port, protocol, evasive tactic or SSL 2. Identify users regardless of IP address 3. Protect in real-time against threats embedded across applications 4. Fine-grained visibility and policy control over application access / functionality 5. Multi-gigabit, in-line deployment with no performance degradation Page 13

14 How Do You Change The Architecture? Conventional Wisdom Disruptive Thinking Sprawl Simplification Page Palo Alto Networks. Proprietary and Confidential.

15 Why Visibility & Control Must Be In The Firewall Application Control as an Add-on Traffic Firewall Port IPS Port-based FW + App Ctrl (IPS) = two policies Applications are threats; only block what you expressly look for Port Policy Decision Applications App Ctrl Policy Decision Implications Network access decision is made with no information Cannot safely enable applications NGFW Application Control Application control is in the firewall = single policy Visibility across all ports, for all traffic, all the time Implications Network access decision is made based on application identity Safely enable application usage Traffic Firewall Applications App Ctrl Policy Decision Application IPS Scan Application for Threats Page 15

16 Palo Alto Networks Firewall Policy Page 16

17 What You See with Port-Based FW + Application Control Add-on Page 17

18 What You See with a True Next-Generation Firewall Page 18

19 Your Control With Port-based Firewall Add-on Page 19

20 Your Control With a Next-Generation Firewall Only allow the apps you need Safely enable the applications relevant to your business» The ever-expanding universe of applications, services and threats» Traffic limited to approved business use cases based on App and User» Attack surface reduced by orders of magnitude» Complete threat library with no blind spots Bi-directional inspection Scans inside of SSL Scans inside compressed files Scans inside proxies and tunnels Page 20

21 Identification Technologies Transform the Firewall App-ID Identify the application User-ID Identify the user Content-ID Scan the content Page 21

22 Comprehensive View of Applications, Users & Content Application Command Center (ACC) - View applications, URLs, threats, data filtering activity Add/remove filters to achieve desired result Page 22 Filter on Facebook-base 2010 Palo Alto Networks. Proprietary and Confidential. Filter on Facebook-base and user cook Remove Facebook to expand view of cook

23 PAN-OS Core Firewall Features Visibility and control of applications, users and content complement core firewall features Strong networking foundation - Dynamic routing (BGP, OSPF, RIPv2) - Tap mode connect to SPAN port - Virtual wire ( Layer 1 ) for true transparent in-line deployment - L2/L3 switching foundation - Policy-based forwarding VPN - Site-to-site IPSec VPN - SSL VPN QoS traffic shaping - Max/guaranteed and priority - By user, app, interface, zone, & more - Real-time bandwidth monitor Zone-based architecture - All interfaces assigned to security zones for policy enforcement High Availability - Active/active, active/passive - Configuration and session synchronization - Path, link, and HA monitoring Virtual Systems - Establish multiple virtual firewalls in a single device (PA-5000, PA- 4000, and PA-2000 Series) Simple, flexible management - CLI, Web, Panorama, SNMP, Syslog PA-5060 PA-5050 PA-5020 PA-4060 PA-4050 PA-4020 PA-2050 PA-2020 PA-500 Page 23

24 Palo Alto Networks Next-Gen Firewalls PA GbpsFW/10 Gbpsthreat prevention/4,000,000 sessions 4 SFP+ (10 Gig), 8 SFP (1 Gig), 12 copper gigabit PA GbpsFW/5 Gbpsthreat prevention/2,000,000 sessions 4 SFP+ (10 Gig), 8 SFP (1 Gig), 12 copper gigabit PA GbpsFW/2 Gbpsthreat prevention/1,000,000 sessions 8 SFP, 12 copper gigabit PA GbpsFW/5 Gbpsthreat prevention/2,000,000 sessions 4 XFP (10 Gig), 4 SFP (1 Gig) PA GbpsFW/5 Gbpsthreat prevention/2,000,000 sessions 8 SFP, 16 copper gigabit PA GbpsFW/2 Gbpsthreat prevention/500,000 sessions 8 SFP, 16 copper gigabit PA GbpsFW/500 Mbps threat prevention/250,000 sessions 4 SFP, 16 copper gigabit PA Mbps FW/200 Mbps threat prevention/125,000 sessions 2 SFP, 12 copper gigabit PA Mbps FW/100 Mbps threat prevention/50,000 sessions 8 copper gigabit Page Palo Alto Networks. Proprietary and Confidential

25 PA-5000 Series Architecture Highly available mgmt High speed logging and route update Dual hard drives Quad-core CPU RAM RAM HDD HDD Control Plane 80 Gbps switch fabric interconnect 20 Gbps QoS engine QoS Switch Fabric Switch Fabric Signature Match HW Engine Stream-based uniform sig. match Vulnerability exploits (IPS), virus, spyware, CC#, SSN, and more 40+ processors 30+ GB of RAM Signature Match 10Gbps Separate high speed data and CPU 1 control planes CPU 2 RAM RAM RAM RAM Signature Match 10Gbps... CPU RAM CPU CPU... CPU RAM CPU CPU RAM RAM 1 2 De- De- SSL 20 IPSec Gbps SSL IPSec Compress. firewall throughputcompress. 10 Gbps threat prevention throughput Security Processors High density parallel processing for flexible security functionality Hardware-acceleration for standardized complex functions (SSL, IPSec, decompression) Flow control 20Gbps 4 Million concurrent sessions Route, ARP, MAC lookup Data Plane NAT SSL IPSec CPU 12 RAM RAM RAM RAM RAM RAM De- Compress. Network Processor 20 Gbps front-end network processing Hardware accelerated per-packet route lookup, MAC lookup and NAT Page 25

26 Transforming The Perimeter and Datacenter Perimeter Datacenter Same Next-Generation Firewall, Different Benefits Page 26

27 Flexible Deployment Options Visibility Transparent In-Line Firewall Replacement Application, user and content visibility without inline deployment IPS with app visibility & control Consolidation of IPS & URL filtering Firewall replacement with app visibility & control Firewall + IPS Firewall + IPS + URL filtering Page 27

28 Redefine Network Security and Save Money! Capital cost replace multiple devices - Legacy firewall, IPS, URL filtering device (e.g. proxy, secure web gateway ) Cut by as much as 80% Hard operational expenses - Support contracts - Subscriptions - Power and HVAC Cut by as much as 65% Save on soft costs too - Rack space, deployment/integration, headcount, training, help desk calls Page 28

29 GlobalProtect Securing Users and Data in an Always Connected World

30 Introducing GlobalProtect Users never go off-network regardless of location All firewalls work together to provide cloud of network security How it works: - Small agent determines network location (on or off the enterprise network) - If off-network, the agent automatically connects the laptop to the nearest firewall via SSL VPN - Agent submits host information profile (patch level, asset type, disk encryption, and more) to the gateway - Gateway enforces security policy using App-ID, User-ID, Content-ID AND host information profile Page 30

31 A Modern Architecture for Enterprise Network Security malware botnets exploits Establishes a logical perimeter that is not bound to physical limitations Users receive the same depth and quality of protection both inside and out Security work performed by purpose-built firewalls, not end-user laptops Unified visibility, compliance and reporting Page 31

32 Palo Alto Networks Wrap-up campu[s]³

33 Enables Visibility Into Applications, Users, and Content

34 2010 Magic Quadrant for Enterprise Network Firewalls Cisco Juniper Networks ability to execute McAfee Stonesoft WatchGuard Fortinet Check Point Software Technologies Palo Alto Networks SonicWALL NETASQ 3Com/H3C phion Astaro Source: Gartner niche players visionaries completeness of vision As of March 2010 Page 34

35 Next-Generation Firewalls Are Network Security Page 35

36 Continual Customer Driven Innovation App-ID: Traffic classification by application; all ports, all the time SSL decryption/inspection, control unknowns, PCAPs, App override, function enablement, custom App-IDs, QoS, PBF, SSH control User-ID: User identity becomes pervasive; visibility, policy, logging and reporting Active Directory, terminal services, LDAP, edirectory, XML API 4,500 Content-ID: Single engine stream-based scanning of allowed content Exploits, viruses, confidential data, botnets, modern malware 2,500 Enterprise-Class Platform: Scalable, deployable, predictable Dual-plane architecture; single pass software, function specific processing, tap mode, Vwire, L2/L3/mixed mode, IPv Customer Count Page 36

37 Addresses Three Key Business Problems Identify and Control Applications - Visibility of applications, regardless of port, protocol, encryption, or evasive tactic - Fine-grained control over applications (allow, deny, limit, scan, shape) - Addresses the key deficiencies of legacy firewall infrastructure Prevent Threats - Stop a variety of threats exploits (by vulnerability), viruses, spyware - Stop leaks of confidential data (e.g., credit card #, social security #, file/type) - Stream-based engine ensures high performance - Enforce acceptable use policies on users for general web site browsing Simplify Security Infrastructure - Put the firewall at the center of the network security infrastructure - Reduce complexity in architecture and operations Page 37

38