Focus

IoT Security Administrator’s Guide

Support Isolated Network Segments

Table of Contents

Support Isolated Network Segments

Configure next-generation firewalls as security telemetry gateways to safely forward outbound connections from firewalls in isolated network segments.

An isolated network segment is a part of a private network that allows an extremely limited set of connections between devices in the segment and devices in any other local segment or in the public network. Because

IoT Security

is a cloud-based application that relies on network traffic logs to provide its services, there needs to be a way to get the logs to

IoT Security

without compromising the security of the isolated segment. To accomplish this, you can configure next-generation firewalls as security telemetry gateways (referred to in the PAN-OS web interface as proxies
) to forward traffic logs from the isolated segment through the non-isolated part of the network to the Palo Alto Networks logging service, where

IoT Security

can access it. In addition, the security telemetry gateways can forward requests from isolated firewalls for the data and files they need to onboard

IoT Security

and support Device-ID: licenses, certificates, IP address-to-device mappings, security policy rule recommendations, and dictionary file downloads.

This data path occurs only through security telemetry gateways, and only requests and network traffic logs that next-generation firewalls generate, not actual data from protected devices, are sent on this path through the security telemetry gateway chain.

Importantly, there are no direct connections between devices in the isolated network segment and the cloud, and the status of the security telemetry gateway-to-cloud connection (up or down) has no impact on protected device operations nor on next-generation firewall functions such as policy enforcement and threat detection and prevention. All protected device and firewall operations will continue to operate even if an upstream security telemetry connection goes down.

You can use a single security telemetry gateway or a chain of two or more security telemetry gateways for additional security layering. In this way, Palo Alto Networks can provide

IoT Security

services to industries that have isolated OT networks as is common in power utilities and oil and gas companies for example. These networks typically consist of two segments: an IT network and OT network. Leveraging existing next-generation firewalls or deploying new ones, you could configure two firewalls as security telemetry gateways, placing one at the boundary between OT and IT networks and the other at the boundary between the IT and public networks. Firewalls in the OT network would send traffic logs to the OT security telemetry gateway, which forwards them to the IT security telemetry gateway, which forwards them to the Palo Alto Networks logging service. Setting up next-generation firewalls in a security telemetry gateway chain like this increases the depth of the logical network segment boundary because the IT security telemetry gateway blocks inbound connections to the OT security telemetry gateway.

The following next-generation firewalls support the security telemetry gateway feature:

Physical firewalls: PA-1400 series, PA-3400 series, PA-5400 series (except PA-5450)

VM-300, VM-500, VM-700

The firewalls must be running PAN-OS version 11.0.1-h2 or later.

When deploying firewalls for a network that contains an isolated OT network segment, set up the security telemetry gateways in order from the IT perimeter (the IT security telemetry gateway) toward the deepest part of the OT network: IT security telemetry gateway, then OT security telemetry gateway, and then OT firewalls. By deploying them in this order, you will have the information you need after completing one deployment to deploy the next one. Also, as each firewall comes online, the firewall or firewalls that the next one needs to reach the public network will already be online and reachable.

The following illustration shows the logical relationship of next-generation firewalls in a security telemetry gateway chain and the IP addresses and subnets used as examples in the configuration instructions that follow. As shown here, OT firewalls initiate all outbound connections through the OT and IT security telemetry gateways to the logging service,

IoT Security

cloud, and update server.

Although having an IT security telemetry gateway in front of an OT security telemetry gateway lets you block inbound connections to the firewall at the perimeter of the OT network, multiple cascading gateways is not required. If you use a single security telemetry gateway at the perimeter of the OT network, it becomes the proxy between OT firewalls and Palo Alto Networks cloud services in the external network instead of hopping through an IT security telemetry gateway.

Configure the IT Security Telemetry Gateway

The IT security telemetry gateway is the next-generation firewall that forwards the traffic logs and requests it receives from the OT security telemetry gateway to the logging service,

IoT Security

, and update server. It would typically be deployed on the network perimeter.

Configure a next-generation firewall to act as an IT security telemetry gateway.

Access the CLI as a superuser or device administrator and enter the following command to enable the firewall to function as a security telemetry gateway (proxy):

set system setting paloalto-networks-service-proxy on

Reboot the firewall.

When using Panorama to manage firewalls, enter the above command in the Panorama CLI and then reboot Panorama.

Log in to the firewall web interface as a superuser or device administrator and configure two Layer3 interfaces—one on the IT network and the other on the external network. For example, configure ethernet1/1 with IP address 192.168.10.1/24 for the IT network and ethernet1/2 with IP address 1.1.1.1/24 for the external network.

Create a loopback interface with an IP address in a different subnet from the other two networks. For example, if the subnet of the IT network is 192.168.10.0/24 and the subnet of the external network is 1.1.1.0/24, use an IP address that’s not in either of these subnets, such as 10.1.2.3, for the loopback interface.

Create a virtual router for all three interfaces and add them to it (for example, vr1
). If the external network interface is a static IP address, add a default route to the gateway in the external network subnet as the next hop.

Create a zone for each interface such as

external

, and

loop

Select

Network

DNS Proxy

and configure a DNS proxy for the interface in the external zone. For example, create a configuration called

dns-proxy

that does DNS lookups on a DNS server at

8.8.8.8

from

ethernet1/2

Select

Objects

URL Category

and create the following URL group:

Name

: Give the URL list a name; for example,

iot_cloud_traffic

URL List

: Add the following URLs (and IP address) to the URL list. These are the only destinations that proxied traffic must be allowed to access.

*.paloaltonetworks.com/

*.panservicetest.com/

ocsp.godaddy.com/

certificates.godaddy.com/

*.gpcloudservice.com/

*.lencr.org/

34.122.191.141

When using Panorama to manage firewalls, create the URL category as “shared”.

Select

Policies

Security

, and create a universal policy rule that allows any application from the IT zone to the external zone for destinations in the

iot_cloud_traffic

URL category and position it above other policy rules.

Select

Policies

NAT

, and create a policy that translates source addresses of devices and interfaces in the IT and loop zones to the IP address of the egress interface in the external zone. In our example, this would be 1.1.1.1, which is the IP address of ethernet1/2.

Select

Network

Proxy

, click the settings icon for Proxy Enablement, choose

Palo Alto Networks Service Proxy

and then click

Click the settings icon for Palo Alto Networks Service Proxy Configuration and enter the following:

Connect Timeout

(default)

Listening

: Enter the name of the IT network interface; for example,

ethernet1/1

Upstream interface

loopback.1

Proxy IP

: Enter the IP address of the interface in the IT zone; for example,

192.168.10.1

DNS-Proxy

: Enter the name of the DNS proxy you defined previously; for example,

dns-proxy

Allowed URL Category

: Enter the name of the allowed URL group you defined previously, for example,

iot_cloud_traffic

Next Hop Proxy Server

: Leave empty.

Next Hop Proxy Port

: Leave empty.

(Optional) To use

IoT Security

for device identification, risk assessment, and vulnerability detection in the IT network, subscribe the firewall acting as the IT security telemetry gateway to

IoT Security

If you don’t want the firewall acting as the IT security telemetry gateway to use

IoT Security

services in the IT network, it’s unnecessary to subscribe it to

IoT Security

and you can skip this step.

Onboard IoT Security on the IT security telemetry gateway.

Install licenses for the logging service and on the IT security telemetry gateway and download a device certificate to the IT security telemetry gateway to authenticate its connections with the logging service and

IoT Security

Configure the IT security telemetry gateway to support Device-ID and work with.

Configure the OT Security Telemetry Gateway

With the IT security telemetry gateway configured and in place, you can next configure the OT security telemetry gateway. The OT security telemetry gateway is the next-generation firewall that forwards the traffic logs it receives from OT firewalls to the IT security telemetry gateway, which in turn forwards them logging service. It also forwards requests from OT firewalls for IP address-to-device mappings, policy rule recommendations, and dictionary files to

IoT Security

and the update server. It would typically be deployed on the edge of the OT network.

Configure a next-generation firewall to act as an OT security telemetry gateway.

Access the CLI as a superuser or device administrator and enter the following command to enable the firewall to function as a security telemetry gateway (referred to as a proxy
in PAN-OS):

set system setting paloalto-networks-service-proxy on

Reboot the firewall.

When using Panorama to manage firewalls, enter the above command in the Panorama CLI and then reboot Panorama.

Configure two Layer3 interfaces—one on the OT network and the other on the IT network. For example, configure ethernet1/1 with IP address 192.168.100.1 for the OT network and ethernet1/2 with IP address 192.168.10.2 for the IT network.

Create a loopback interface with an IP address in a different subnet from the other two networks. Because it’s only used for internal routing, you can even use the same IP address as the loopback interface on the IT security telemetry gateway—10.2.3.4, for example.

Create a virtual router for all three interfaces and add them to it (for example, vr1
) and add a default route using ethernet1/2 as the egress interface and 192.168.10.1, the IP address of ethernet1/1 on the IT security telemetry gateway interface, as the next hop.

Create a zone for each interface such as

, and

loop

If the next hop security telemetry gateway server is a hostname, select

Network

DNS Proxy

and configure a DNS proxy for the interface of the OT security telemetry gateway that’s in the IT zone. For example, create a configuration called

dns-proxy

that does DNS lookups on a local DNS server that the OT security telemetry gateway can reach from ethernet1/2.

If the next hop security telemetry gateway server is an IP address, you don’t need to configure a DNS proxy and can skip this step.

Select

Objects

URL Category

and create the following URL group:

Name

: Give the URL list a name; for example,

iot_cloud_traffic

URL List

: Add the following URLs (and IP address) to the URL list. These are the only destinations that proxied traffic must be allowed to access.

*.paloaltonetworks.com/

*.panservicetest.com/

ocsp.godaddy.com/

certificates.godaddy.com/

*.gpcloudservice.com/

*.lencr.org/

34.122.191.141

When using Panorama to manage firewalls, create the URL category as “shared”.

Select

Policies

Security

, and create a universal policy rule that allows any application from the OT zone to the IT zone for destinations in the

iot_cloud_traffic

URL category and position it above other policy rules.

Add security policy rules that deny all other outbound connections from the OT network and all inbound connections to the OT network and position them below the rule that allows outbound connections to the destinations in the iot_cloud_traffic URL list.

Select

Network

Proxy

, click the settings icon for Proxy Enablement, choose

Palo Alto Networks Service Proxy

and then click

Click the settings icon for Palo Alto Networks Service Proxy Configuration and enter the following:

Connect Timeout

(default)

Listening

: Enter the name of the 0T network interface; for example,

ethernet1/1

Upstream interface

loopback.1

Proxy IP

: Enter the IP address of the interface in the OT zone; for example,

192.168.100.1

DNS-Proxy

: Enter the name of the DNS proxy you defined previously; for example,

dns-proxy

Allowed URL Category

: Enter the name of the allowed URL group you defined previously, for example,

iot_cloud_traffic

Next Hop Proxy Server

: Enter the IP address of ethernet1/1 on the IT security telemetry gateway interface;

192.168.10.1

in our example.

Next Hop Proxy Port

8080

(Optional) To forward network traffic logs for the OT network from the OT security telemetry gateway as well as from OT firewalls, subscribe the OT security telemetry gateway to

IoT Security

If you don’t want the firewall acting as the OT security telemetry gateway to use

IoT Security

services in the OT network, it’s unnecessary to subscribe it to

IoT Security

and you can skip this step.

Onboard IoT Security on the OT security telemetry gateway.

Install licenses for the logging service and on the OT security telemetry gateway and download a device certificate to the OT security telemetry gateway to authenticate its connections with the logging service and

IoT Security

Configure the OT security telemetry gateway to support Device-ID and work with.

Configure OT Firewalls

With both the IT and OT security telemetry gateways configured, you can set up the OT firewalls to use the security telemetry gateway chain to access the Palo Alto Networks cloud services necessary to support

IoT Security

Logging service
– OT firewalls forward EAL and traffic logs to the logging service, which streams the metadata to

IoT Security

for analysis to identify devices, assess risk, and detect device vulnerabilities.

IoT Security

– OT firewalls retrieve IP address-to-device mappings from

IoT Security

to enforce Device-ID Security policy rules. OT firewalls also retrieve policy rule recommendations from

IoT Security

Update server

– OT firewalls periodically download device dictionary files with a regularly updated list of device attributes used as components in Device-ID Security policy rules.

License server

– OT firewalls download activated logging service and

IoT Security

licenses from the license server.

Certificate server

– Firewalls fetch new device certificates from certificate.paloaltonetworks.com and use their existing device certificates—expiring but still valid—to fetch renewed certificates from certificatetrusted.paloaltonetworks.com.

Customer Service Portal

and the

hub

– Firewalls connect to the Customer Service Portal to verify admin users and then to the hub to get their role assignments.

Configure a next-generation firewall to act as an OT firewall.

Select

Device

Setup

Interfaces

Management

, configure MGT interface with an IP address on the OT network, and enter the IP address of the OT security telemetry gateway interface in the OT zone as its default gateway; for example:

IP Type

Static

IP Address

192.168.100.2

Netmask

255.255.255.0

Default Gateway

192.168.100.1

The OT firewall uses the management interface to onboard

IoT Security

and fetch certificates and licenses, forward various traffic logs to the logging service, request IP address-to-device mappings and policy rule recommendations from

IoT Security

, and download dictionary files from the update server.

You can also configure the OT firewall to use one of its Ethernet interfaces when initiating connections through the chain of security telemetry gateways. If you do, you must configure service routes to instruct the firewall to use this interface instead of the management interface. In the service route configuration, select Palo Alto Networks Services, Data Services, and IoT.

Configure interfaces, security zones, and security policy rules as necessary to collect network traffic metadata for

IoT Security

to analyze. PAN-OS provides various options and you’ll need to use whatever methods make sense for your network topology; for example:

Virtual wire to capture OT traffic
– Create a virtual wire zone and a virtual wire object that links two virtual wire interfaces. Add either an intrazone or universal policy rule that allows traffic between devices within the same zone, and enable logging and log forwarding on the rule. Consider placing one or more OT firewalls with this configuration on the OT network at one of the OT Purdue levels (0-3) to capture network traffic at this level and forward traffic logs to the OT security telemetry gateway.

Tap interface to collect traffic from downstream switches
– Create a tap zone with a tap interface to receive traffic from a mirror port on downstream switches. This will capture traffic at other Purdue levels that don't reach OT firewalls, which can then forward it to the logging service.

Layer 3 interface to collect traffic from a ERSPAN port on downstream switches
– Create a Layer 3 zone with a Layer 3 interface on the OT firewall. Configure your switches to use Encapsulated Remote Switched Port Analyzer (ERSPAN) to send mirrored traffic through a Generic Routing Encapsulation (GRE) tunnel to the IP address of the OT network interface on the OT security telemetry gateway. After decapsulating the traffic, the OT security telemetry gateway generates various traffic types of logs and forwards them to the IT security telemetry gateway, which then forwards them to the logging service where

IoT Security

can access them for analysis.

Select

Device

Setup

Services

, enter the following settings in the Proxy Server section and leave the other settings with their default values:

Proxy Server

Server

: Enter the IP address of the OT security telemetry gateway interface in the OT zone; for example, 192.168.100.1, which is the IP address of the OT security telemetry gateway ethernet1/1 interface.

Port

8080

Use proxy to send logs to Cortex Data Lake

: (select)

Select

Policies

Security

, and create a universal policy rule that allows the following applications from OT network zones to any zones and position it above other policy rules:

google-base

paloalto-device-telemetry

paloalto-iot-security

paloalto-logging-service

paloalto-shared-services

Subscribe the OT firewall to

IoT Security

Onboard IoT Security on the OT firewall.

Install licenses for the logging service and on the OT firewall and download a device certificate to the OT firewall to authenticate its connections with the logging service and

IoT Security

Configure the OT firewall to support Device-ID and work with IoT Security.