Configure next-generation firewalls as security telemetry gateways to safely forward
outbound connections from firewalls in isolated network segments.
| Where Can I Use This? | What Do I Need? |
|---|
|
|
One of the following subscriptions:
Device Security subscription for an advanced
Device Security product (Enterprise,
OT, or Medical)
Device Security X subscription
|
An isolated network segment is a part of a private network that allows an extremely
limited set of connections between devices in the segment and devices in any other
local segment or in the public network. Because Device Security is a cloud-based
application that relies on network traffic logs to provide its services, there needs
to be a way to get the logs to Device Security without compromising the security
of the isolated segment. To accomplish this, you can configure next-generation
firewalls as security telemetry gateways (referred to in the PAN-OS web interface as
proxies) to forward traffic logs from the isolated segment through the
non-isolated part of the network to the Palo Alto Networks logging service, where
Device Security can access it. In addition, the security telemetry gateways
can forward requests from isolated firewalls for the data and files they need to
onboard Device Security and support Device-ID: licenses, certificates, IP
address-to-device mappings, security policy rule recommendations, and dictionary
file downloads.
This data path occurs only through security telemetry gateways, and only
requests and network traffic logs that next-generation firewalls generate, not
actual data from protected devices, are sent on this path through the security
telemetry gateway chain.
Importantly, there are no direct connections between devices in the
isolated network segment and the cloud, and the status of the security telemetry
gateway-to-cloud connection (up or down) has no impact on protected device
operations nor on next-generation firewall functions such as policy enforcement and
threat detection and prevention. All protected device and firewall operations will
continue to operate even if an upstream security telemetry connection goes down.
You can use a single security telemetry gateway or a chain of two or more
security telemetry gateways for additional security layering. In this way, Palo Alto
Networks can provide Device Security services to industries that have isolated OT
networks as is common in power utilities and oil and gas companies for example.
These networks typically consist of two segments: an IT network and OT network.
Leveraging existing next-generation firewalls or deploying new ones, you could
configure two firewalls as security telemetry gateways, placing one at the boundary
between OT and IT networks and the other at the boundary between the IT and public
networks. Firewalls in the OT network would send traffic logs to the OT security
telemetry gateway, which forwards them to the IT security telemetry gateway, which
forwards them to the Palo Alto Networks logging service. Setting up next-generation
firewalls in a security telemetry gateway chain like this increases the depth of the
logical network segment boundary because the IT security telemetry gateway blocks
inbound connections to the OT security telemetry gateway.
The following next-generation firewalls support the security telemetry
gateway feature:
The firewalls must be running PAN-OS version 11.0.1-h2 or later.
When deploying firewalls for a network that contains an isolated OT network
segment, set up the security telemetry gateways in order from the IT perimeter (the
IT security telemetry gateway) toward the deepest part of the OT network: IT
security telemetry gateway, then OT security telemetry gateway, and then OT
firewalls. By deploying them in this order, you will have the information you need
after completing one deployment to deploy the next one. Also, as each firewall comes
online, the firewall or firewalls that the next one needs to reach the public
network will already be online and reachable.
The following illustration shows the logical relationship of
next-generation firewalls in a security telemetry gateway chain and the IP addresses
and subnets used as examples in the configuration instructions that follow. As shown
here, OT firewalls initiate all outbound connections through the OT and IT security
telemetry gateways to the logging service, Device Security cloud, and update
server.
Although having an IT security telemetry gateway in front of
an OT security telemetry gateway lets you block inbound connections to the firewall
at the perimeter of the OT network, multiple cascading gateways is not required. If
you use a single security telemetry gateway at the perimeter of the OT network, it
becomes the proxy between OT firewalls and Palo Alto Networks cloud services in the
external network instead of hopping through an IT security telemetry gateway.
