| Where Can I Use This? | What Do I Need? |
|---|
NGFW (Managed by PAN-OS or Panorama) Device Security (Managed by Strata Cloud Manager) (Legacy) IoT Security (Standalone portal)
|
One of the following subscriptions:
Device Security subscription for an advanced
Device Security product (Enterprise,
OT, or Medical)
Device Security X subscription
|
When new devices join the network, they must be allowed to function
normally so that Device Security can identify them by analyzing their normal network
behavior. However, firewalls are typically configured with Zero Trust security
policy rules that allow only the network activities that devices need based on their
function. As a result, the rules might inadvertently block traffic for a new device
that, if allowed, would have allowed Device Security to determine its identity.
To overcome this, you can configure one or more onboarding policy rules
that use Device-ID to apply the rules only to devices that have been
recently
detected on the network but have not yet been confidently identified. For the
firewall to enforce the rule, a device must be categorized as an Onboarding Device.
Device Security places low-confidence devices in this category during a customizable
period of time that starts when Device Security first detects them on the network.
Devices continue to be categorized as “Onboarding Device” until Device Security
confidently identifies them with a confidence score above 90 or until the time
period ends. The policy rule does not apply to other, previously identified devices
and must be configured to allow new devices enough network access for Device Security
to identify them. Once Device Security identifies them, it switches them over to an
appropriate category for what they are. The firewall can then apply appropriate
policy rules based on their identities. If Device Security cannot confidently identify
one or more devices and the time period expires, it still switches them to a
category it considers appropriate, but because their confidence scores are below 90,
Device Security doesn’t generate any security rule recommendations.
