CN-Series
IOT Security Support for CN-Series Firewall
Table of Contents
Expand All
|
Collapse All
CN-Series Firewall Docs
-
-
- Deployment Modes
- HSF
- In-Cloud and On-Prem
-
-
-
IOT Security Support for CN-Series Firewall
Where Can I Use This? | What Do I Need? |
---|---|
|
|
For Palo Alto Networks next-generation CN-Series firewall, the IoT Security
solution uses machine learning (ML) to provide visibility of discovered IoT devices
based on the meta-data in the logs it receives from the firewall. IoT Security also
identifies vulnerabilities and assess risk in devices based on their network traffic
behaviors and dynamically updated threat feeds.
You can use the policy rule recommendations that IoT Security generates as a
reference when manually adding rules to your CN-Series firewall. IoT Security always
generates Security policy rule recommendations regardless of the PAN-OS version.
When using IoT Security Subscription, which stores data in Strata
Logging Service, you need one Strata Logging Service license per account and must
ensure that Strata Logging Service configuration for your
CN-Series firewall is complete.
For more information, see IoT Security Prerequisites.
Configure IOT Support for CN-Series Firewall
You must ensure that your environment meets all prerequisites for deploying
IoT Security with CN-Series firewall. For more information, see IoT Security Prerequisites.
To configure IoT - Requires Data Lake subscription for CN-Series
firewall, you must complete the following steps:
You must
ensure that you onboard your Panorama onto the strata logging service instance.
For more information, see Onboard firewalls with
Panorama.
-
Create a Tenant Service Group (TSG). For more information, see Step 3 in Activate IoT Security Subscriptions Through Common Services.
-
Onboard strata logging service tenant to the TSG. You must ensure that you purchase the strata logging service and activate it using Magic link before using in TSG.
-
Create a CN-Series Deployment Profile with IoT - Requires Data Lake option.
-
Click Finish Setup. Once you associate the deployment profile to the TSG and click Activate, an IoT tenant will be created if one doesn't already exist.You can then forward the collected metadata to the cloud-based logging service where IoT Security uses it to identify various IoT devices on the network.
-
Provision Panorama and generate a serial number. For more information, see Register Panorama and Install Licenses.
-
Configure your CN-Series firewall with Panorama using the auth code to push licenses from Panorama to CN-Series firewall using the kubernetes plugin. For more information, see Configure Panorama to Secure a Kubernetes Deployment.Apply deployment authcode to Kubernetes plugin in Panorama.You can now see your CN-series firewall onboarded on an IoT tenant.
-
Configure template vwire to allow and enable device id in zone.You can use the Default template K8S-Network-Setup-V2 and make the following changes in that template:
-
Enable link state passthrough and multicast firewall for default vwire.
-
Enable device identification for default zone.
For more information, see Configure Virtual Wires. -
-
Configure the Enable Cloud Logging and Enable Enhanced Application Logging option on Panorama to CN-Series firewall. For more information, see Strata Logging Service configuration for your CN-Series firewall.
To configure IoT Security, Doesn't Require Data Lakesubscription for
CN-Series firewall, you must complete the following steps:
Note: You must ensure that you onboard your Panorama onto the strata logging
service instance. When using IoT Security, Doesn't Require Data Lake Subscription,
you must register your Panorama in the IoT portal after adding the CN-series
Firewall. For more information, see Step 2 in Prepare Your Firewall for IoT
Security.
-
Create a Tenant Service Group (TSG). For more information, see Step 3 in Activate IoT Security Subscriptions Through Common Services.
-
Create a CN-Series Deployment Profile with IoT - Doesn’t Require Data Lake option.
-
Set up your IOT instance and select Finish Setup option to associate your deployment profile with the tenant service group (TSG) to enable logging service on your CN-Series firewall and configure it to obtain and log network traffic metadata. For more information, see Prepare Your Firewall for IoT Security.You can then forward the collected metadata to the cloud-based logging service where IoT Security uses it to identify various IoT devices on the network.
-
Provision Panorama and generate a serial number. For more information, see Register Panorama and Install Licenses.
-
Configure your CN-Series firewall with Panorama using the auth code to push licenses from Panorama to CN-Series firewall using the kubernetes plugin. For more information, see Configure Panorama to Secure a Kubernetes Deployment.Apply deployment authcode to Kubernetes plugin in Panorama. You can now see your CN-series firewall onboarded on an IoT tenant.
-
Configure template vwire to allow and enable device ID in zone. For more information, see Configure Virtual Wires.You can use the Default template K8S-Network-Setup-V and make the following changes in that template:
-
Enable link state passthrough and multicast firewall for default vwire.
-
Enable device identification for default zone.For more information, see Configure Virtual Wires.Vwire configured in k8s-template-v2 allows Link state pass through and Multicast Firewalling. The zone configuration of the k8s-template-v2 enables device identification
-
- Configure the Enable Cloud Logging and Enable Enhanced Application Logging option Panorama to CN-Series firewall. For more information, see Strata Logging Service configuration for your CN-Series firewall
After you have successfully onboarded your Panorama and CN-Series firewall
onto the cloud-based logging service, go to your IoT instance.
After IoT Security has sufficient information to identify devices from
their network behavior, it provides CN-Series firewall with IP address-to-device
mappings and Panorama with policy recommendations that the Panorama administrator
can import and then push to CN-Series Firewall to enforce policy on IoT device
traffic.
Click Administration > Sites and Firewalls > Firewalls in the
IoT Security portal to see the status of logs that the logging service is streaming
to the IoT Security application. For more information, see IoT Security Integration Status with
Firewalls.