Firewall Feature Overview

Transcription

1 PALO ALTO NETWORKS: Firewall Featre Overview Firewall Featre Overview Palo Alto Networks family of next generation firewalls delivers nprecedented visibility and control of applications, sers and content flowing across the enterprise network. PA-4060 PA-4020 PA-4050 APPLICATION IDENTIFICATION : Identifies more than 700 applications irrespective of port, protocol, SSL encryption or evasive tactic employed Graphical visibility tools enable simple and intitive view into application traffic Policy controls block bad applications and control good applications USER IDENTIFICATION: Policy-based visibility and control over who is sing the applications throgh seamless integration with Active Directory Control non-windows hosts via webbased athentication CONTENT IDENTIFICATION: Block virses, spyware, and vlnerability exploits, limit nathorized transfer of files and sensitive data sch as CC# or SSN, and control non-work related web srfing Single pass architectre enables mltigigabit throghpt with low latency while scanning content PLATFORM SUPPORT AND FIREWALL THROUGHPUT: PA Gbps PA Gbps PA Gbps PA Gbps PA Mbps As the center of enterprise network secrity, the firewall is the ideal location to enforce secrity policy. Bt becase traditional firewalls rely on port and protocol to classify traffic, today s Internet applications can bypass them with ease; hopping ports, sing SSL, sneaking across port 80 or sing nonstandard ports that are generally left open. The resltant loss of application control exposes enterprises to bsiness risks inclding network downtime, increased operational expenses, data loss throgh nathorized data transfer. A next generation firewall restores application visibility and control for today s enterprises while scanning application content for threats, enabling organizations to manage risk more effectively. Enterprises need a next generation firewall that flfills these key reqirements: Identifies applications across all ports, irrespective of protocol, SSL encryption or evasive tactic. Protects in real time against attacks and malware embedded in application traffic. PA-2020 Simplifies policy management with powerfl visalization tools and a nified policy editor. Delivers mlti-gigabit throghpt with no performance degradation when deployed in-line. PA-2050 The Palo Alto Networks TM next generation firewall addresses key shortcomings that plage traditional statefl inspection-based firewalls and brings policybased visibility and control over applications, sers and content back to the IT department where it belongs.

2 PALO ALTO NETWORKS: Firewall Featre Overview Identification Technologies: The Power Behind Palo Alto Networks Next Generation Firewall Palo Alto Networks family of next generation firewalls provides policy-based visibility and control over applications, sers and content with three niqe identification technologies: App-ID, User-ID and Content-ID. App-ID is a patent-pending traffic classification technology that determines exactly which applications are traversing the network sing p to for different identification techniqes. The application identity is then sed as the basis for all policy decisions inclding appropriate sage and content inspection. Application Protocol Detection and Decryption: With its deep knowledge of application protocols, App-ID identifies which protocol is being sed and whether or not it is encrypted with SSL. Encrypted traffic is decrypted, inspected based on policy, re-encrypted and sent on its way. Application Protocol Detection / Decryption Application Protocol Decoding Application Signatre Heristics App-ID Mltiple traffic classification engines accrately identify applications traversing the network. Application Protocol Decoding: Protocol decoders determine whether the application is sing a protocol as a normal application transport or as an obfscation techniqe and they help narrow the range of possible applications, providing valable context when applying signatres. The decoders also identify files and other content that shold be scanned for threats or sensitive data. Application Signatres: Context-based signatres look for niqe application properties and related transaction characteristics to correctly identify the application regardless of the protocol and port being sed. Heristics: Heristic or behavioral analysis is combined with other App-ID identification techniqes as needed to identify certain evasive applications, particlarly those that se proprietary encryption. User-ID seamlessly integrates Palo Alto Networks next generation firewalls with Active Directory to dynamically link an IP address to ser and grop information. With visibility into ser activity, enterprises can monitor and control applications and content traversing the network based on the ser and grop information stored within the ser repository. Content-ID combines a real-time threat prevention engine with a comprehensive URL database and elements of application identification to limit nathorized file transfers, detect and block a wide range of threats and control nonwork related web srfing. A single pass architectre inspects traffic sing a combination of stream-based scanning and a niform signatre format. Content-ID works in concert with App-ID, leveraging the application identity which makes the content inspection process more efficient. A rich set of networking, IPSec VPN and management featres join App-ID, User-ID and Content-ID as the key featres of PAN-OS, the secrity-specific operating system that controls the Palo Alto Networks next generation firewalls. PAN-OS is married to a family of cstom hardware platforms that are designed to manage enterprise network traffic flows sing fnction specific processing for networking, secrity, threat prevention and management. PAGE 2

3 PALO ALTO NETWORKS: Firewall Featre Overview Application Command Center View crrent application, URL, data filtering and threat activity in a clear, easy-to-read format. Add/remove filters to navigate to any depth of data specificity. Powerfl Visalization Tools A powerfl set of visalization tools presents administrators with a wide range of data points on applications traversing the network, who is sing them, and the potential secrity impact. The Application Command Center, log viewer and flly cstomizable reporting are the primary components of the web interface that provide administrators with nmatched visibility into the applications, sers and content traversing the network. Application Command Center (ACC): ACC graphically displays the applications, URLs, threats and data (files and patterns) traversing the network. Unlike other soltions that may present the data in a cryptic, hard-to-interpret format, ACC provides administrators with a view into crrent activity that can be tailored in several ways. Application data can be viewed by risk, category, sbcategory, or nderlying technology. Web activity can be displayed based on top URLs visited or blocked or top URL categories visited or blocked. Data filtering shows files and sensitive data patterns (CC # and SSN) that are traversing the network. To learn more abot the applications, URLs, data and threats traversing the network, administrators can mine ACC data by adding and removing filters in order to achieve the desired reslt. For example, selecting a specific application shows the details of what the application is, who is sing it, where the traffic is going, and the sorce/destination contries. Additional filters can be added to learn more abot individal ser behavior, which secrity zones are sending/receiving the traffic, the potential threats and what files or data types are being transferred. The visibility that data mining ACC provides allows administrators to learn more abot the network activity to make more informed policy decisions or respond more qickly to potential threats. In the event that ACC displays something that warrants immediate, in depth analysis, administrators can jmp to the corresponding logs that match the crrent ACC context with a click of a mose. Reporting and logging: The log viewer enables forensic investigation into every session traversing the network sing real-time filtering and reglar expressions. Flly cstomizable and schedlable reports are available that provide detailed views into applications, sers, and threats on the network. Threat activity can be viewed based on spyware, vlnerability exploits, and virses. PAGE 3

4 PALO ALTO NETWORKS: Firewall Featre Overview Content Inspection The accrate identification of applications by App-ID solves only part of the visibility and control challenge that IT departments face with today s Internet-centric environment. Inspecting permitted application traffic becomes the next significant challenge and one that is addressed by the threat prevention, URL filtering and data filtering elements within Content-ID. URL filtering: A flly integrated URL filtering database of over 20 million URLs across 76 categories allows administrators to apply granlar web browsing policies, complementing the application visibility and control policies and safegarding the enterprise from a fll spectrm of legal, reglatory, prodctivity and resorce risks. In addition to black list/white list options, administrators can se cstomizable block pages, password enabled access and ser override to enable flexible yet enforceable web activity policies. Threat prevention: Detect and block a broad range of threats inclding virses, spyware, application vlnerability exploits is performed by a threat prevention engine that delivers real-time performance throgh Palo Alto Networks single pass architectre. The threat prevention engine combines a niform signatre format and stream-based scanning to inspect the traffic only once, simltaneosly detecting and blocking all manner of malware in a single pass. The single pass architectre eliminates the need to bffer or proxy the files prior to threat inspection, reslting in improved throghpt and redced latency. File and data filtering: Taking fll advantage of the in-depth application inspection being performed by App-ID and the single pass architectre, administrators can implement several different types of policies that redce the risk associated with nathorized file and data transfer. File blocking by type: Controls the flow of a wide range of file types by looking deep within the payload to identify the file type (as opposed to looking only at the file extension). Data filtering: Identify and control the transfer of sensitive data patterns sch as credit card and social secrity nmbers in application content or attachments. File transfer fnction control: Control the file transfer fnctionality within an individal application, allowing application se yet preventing ndesired inbond or otbond filr transfer. Traffic Map Geographical map of traffic and threats flowing in and ot of the network PAGE 4

5 PALO ALTO NETWORKS: Firewall Featre Overview Application Browser Learn more abot the applications traversing the network and immediately translate the reslts into secrity policies. Policy-based Controls The Increased visibility into network activity generated by App-ID, User-ID and Content-ID means the secrity team can qickly analyze which applications are traversing the network, who is sing them, the potential secrity risk and then easily translate that into firewall policies. Policy controls based on applications are enabled sing the application browser, an integral component of the policy editor that presents administrators with a wealth of information relevant to deciding how to treat an application. The policy editor carries a familiar look and feel, enabling experienced firewall administrators to qickly create firewall policies sch as: Deny network access for certain types of applications sch as peer-to-peer or circmventors and proxy services. Assign Saleforce.com and Oracle to the sales and marketing grops as defined in Active Directory. Define a grop of applications sch as SSH, Telnet, MS-RDP and allow only the IT grop to se them. Define and enforce a corporate policy that dictates which webmail and instant messaging applications shold be sed, inspecting them for virses, spyware and vlnerability exploits all in a single policy rle. Identify the transfer of sensitive information sch as credit card nmbers or social secrity nmbers, either in text or file format, and block, allow or send alerts on who is transferring the data. Define mlti-level URL filtering policies that block access to obvios non-work related sites, monitor qestionable sites and coach access to others by giving the ser the ability proceed after an initial warning. Create traditional inbond and otbond port-based firewall rles mixed with application-based rles to smooth the transition to a Palo Alto Networks next generation firewall. Networking A flexible networking architectre that incldes dynamic roting, switching, high availability and IPSec VPN spport enables deployment into nearly any networking environment. Virtal Wire: Virtal Wire logically binds two ports together and passes all traffic to the other port withot any switching or roting, enabling fll inspection and control with no impact on the srronding devices. Mltiple Virtal Wire pairs can be configred to spport mltiple network segments. Switching and Roting: A networking fondation that is very similar to common L2/L3 architectres bt with zone-based secrity enforcement, enables deployment into L2/L3 networks. Dynamic roting protocols (OSPF and RIP) combined with fll 802.1Q VLAN spport is provided for both L2/L3, so that all services can be enabled withot interfering with the existing roting or VLAN architectre. PAGE 5

6 PALO ALTO NETWORKS: Firewall Featre Overview Flexible Deployment Options A rich networking fondation enables deployment as a complement to, or as a replacement for, an existing firewall. Tap Mode Transparent In-Line Firewall Replacement Application visibility withot inline deployment Application visibility and control withot networking changes Application visibility and control, consolidated policy, high performance High Availability: Active/passive high availability is spported where the active device continosly synchronizes its configration and session information with the passive device. Site-to-Site VPN: Standards-based IPSec VPN connectivity combined with application visibility and control enables protected commnications between two or more Palo Alto Networks devices or another vendor s IPSec VPN device. Management To accommodate the dynamic natre of network secrity and the varied management styles and roles that each administrator may have, all Palo Alto Networks firewalls can be controlled by a Command Line Interface (CLI), a web-based interface, or a centralized management soltion (Panorama) with tailored roles providing access to only the necessary administrative fnctions for each administrator. Moving from one management interface to another does not hinder administrative efforts as the most crrent configration is always sed, thereby eliminating possible ot-ofsync configrations. Both Panorama and the web-based interface have the same look and feel, thereby minimizing the learning crve often associated with moving between an individal device management interface and a centralized interface. Ronding ot the management interfaces are standards-based syslog and SNMP interfaces. Reporting and Logging Fingertip access to powerfl reporting and logging enables analysis of secrity incidents, application sage and traffic patterns. Cstom reports: Create cstom reports from scratch, plling data from any of the log databases or modify one of the predefined reports. Report Exporting: Export any of the predefined or cstom reports to either CSV or PDF. Any of the PDF reports can be ed on a schedled basis. Smmary Report: A cstom, one-page smmary plls data from any of the predefined or cstom reports and can be generated and ed on a schedled basis. Log Viewer: View application, threat and ser activity throgh dynamic filtering capabilities enabled simply by clicking on a cell vale and /or sing the expression bilder to define the filter criteria. Log Exporting: Export any logs matching the crrent filter to a CSV file for offline archival or additional analysis. Palo Alto Networks 232 E. Java Drive Snnyvale, CA Sales Copyright 2008, Palo Alto Networks, Inc. All rights reserved. Palo Alto Networks, the Palo Alto Networks Logo, PAN-OS, App-ID and Panorama are trademarks of Palo Alto Networks, Inc. All specifications are sbject to change withot notice. Palo Alto Networks assmes no responsibility for any inaccracies in this docment or for any obligation to pdate information in this docment. Palo Alto Networks reserves the right to change, modify, transfer, or otherwise revise this pblication withot notice A