Prisma AIRS
Microperimeter
Table of Contents
Microperimeter
Secure critical workloads with L7-aware security using Microperimeter.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
|
Microperimeter (PAN Traffic Redirector) is a secure microsegmentation solution
that protects critical workloads within data centers and cloud environments. While
traditional microsegmentation relies on coarse L3/L4 controls like IP addresses and
ports, microperimeter enables L7-aware security. This allows you to inspect
application-layer traffic and enforce Zero Trust policies for internal (East-West)
traffic to detect lateral threat movement and modern application exploit.
Microperimeter solution further enhances this security posture by securing both
ingress and egress traffic for a user-defined group of workloads. Security is
established by redirecting all or selective traffic destined for and originating from
the designated workload group through a user-selected software firewall, employing a
hair-pin traffic pattern.
- Microperimeter functionality is available on private and public cloud platforms, including ESXi, KVM, Nutanix, AWS, Azure, and GCP. A key constraint is that these firewalls must be native firewalls and cannot be used in conjunction with a Gateway Load Balancer (GWLB). The firewall could either be on the next hop or a few hops away from the workloads.
- Microperimeter functionality is also available on High Availability (HA) Active/Passive environments.
The Microperimeter solution currently operates over IPv4 and utilizes a
pan-redirector package, which is supported on Linux distributions. To implement the
solution, download the pan-redirector from the CSP portal, then copy, install, and
configure it on the desired VM workload. This agent will then redirect the traffic to
the firewall.
To maintain compliance, the panredirect service now requires successful telemetry
reachability. Consequently, if the agent is unable to transmit telemetry data to the
firewall, it will stop redirecting traffic. To enable telemetry, the firewall must be a
Prisma AI Runtime Security (Prisma AIRS) firewall. Additionally, the firewall interface
used for redirection must have a management profile with HTTPS enabled. Furthermore, the
firewall interface requires a Layer 3 configuration, including an IP address, zone, and
vrouter.
- Any L3 interfaces allocated for redirection cannot be used for any other purpose.
- Prevent redirected traffic from re-entering the same firewall through other interfaces. This prevents double inspection, which leads to traffic blackholing.