Configure Device-ID

Activate your IoT Security license on the hub.
Follow the instructions that you received in your email to activate your IoT Security license.
Initialize your IoT Security app. For more information, refer to Get Started with IoT Security and IoT Security Best Practices.
Define your Security policy rules set in IoT Security.
Create
a new set of policy rules for the source device object.
For information about creating security policy rule recommendations in IoT Security, refer to Recommend Security Policies.
Activate
the Security policy rules set.
When you activate a policy rules set, IoT Security automatically generates policy rule names by concatenating the policy rules set name with the name of the application in each rule. It then automatically pushes the set of rules to Panorama and all next-generation firewalls subscribed to the IoT Security service.
Import the policy rule recommendations to the Security policy rulebase on the firewall or in Panorama.
Open or refresh the
Policy Recommendation
IoT
page.
When you select
Policy Recommendation
IoT
, the firewall or Panorama communicates with IoT Security to obtain the latest policy rule recommendations. The policy rule recommendations are not cached on the firewall or Panorama. If you are already on this page when a new policy rule set was activated or modified in IoT Security, refreshing the page retrieves the new or updated recommendations from IoT Security.
(
Firewall
) Select
Device
Policy Recommendation
IoT
.
(
Panorama
) Select
Panorama
Policy Recommendation
IoT
.
Select policy rule recommendations to import into the Security policy rulebase.
Verify that the destination and permitted applications are correct in each rule you want to import. Then select up to ten policy rule recommendations to import into the rulebase. For Panorama you can import policy rule recommendations into multiple firewall rulebases in multiple device groups.
Select
Import Policy Rule(s)
, enter the following, and then click
OK
:
(
Firewall
)
Choose the name of a rule in the rulebase after which you want PAN-OS to place the imported rules. If you choose
No Rule Selection
, the firewall imports the selected rules to the top.
(
Panorama
)
Location
: Choose one or more device groups where you want to import the policy rules.
Suggested Location
: IoT Security learns about zones and device groups in the logs it receives from next-generation firewalls and suggests device groups for various policy rules accordingly. You can choose these suggested device groups among those available in the
Location
list or any other device groups if you prefer.
Destination Type
: Select either
Pre-Rulebase
to add the recommended policy rules before rules defined locally on a firewall or
Post-Rulebase
to add them after rules defined locally.
After Rule
: Choose a rule after which you want to add the imported rule or rules. If you choose
No Rule Selection
, the firewall imports the selected rules to the top. This is an optional setting. If you don’t choose a rule, the imported rules are added to the top of the rulebase.
Device-ID rules must precede any existing rules that apply to the same devices in the rulebase. Because IoT Security creates the policy rule recommendation using the trusted behaviors for the device, the default action for each rule is allow.
Repeat this process to import more rules to allow devices to communicate with the specified destinations with the specified applications.
Click
OK
and
Commit
your changes.
Enable Device-ID in each zone where you want to use Device-ID to detect devices and enforce your Security policy rules.
By default, Device-ID maps all subnetworks in the zones where you enable it. You can modify which subnetworks Device-ID maps in the
Include List
and
Exclude List
.
As a best practice, enable Device-ID in the source zone to detect devices and enforce Device-ID Security policy rules. Only enable Device-ID for internal zones.
Select
Network
Zones
.
Select the zone where you want to enable Device-ID.
Enable Device Identification
then click
OK
.
Repeat this as necessary for other zones for which you want to enforce Device-ID Security policy rules.
Commit
your changes.
Verify your Security policy rules are correct.
Select
Policies
and then select one of the rules you created from the policy rule recommendations.
IoT Security assigns a
Description
that contains the source device object and
Tags
to identify the source device object and that this rule is a recommendation from IoT Security.
Select the
Source
tab, then verify the source device pforile.
Select the
Destination
tab and verify the destintation.
Select the
Application
tab and verify the application.
Select the
Actions
tab and verify the action (default is
Allow
).
Use Explore to verify that the logging service receives your logs and review which logs it gets.
Create custom device objects for any devices that do not have IoT Security policy rule recommendations.
For example, you cannot secure traditional IT devices such as laptops and smartphones using policy rule recommendations, so you must manually create device objects for these types of devices to use in your Security policy rules. For more information on custom device objects, see Manage Device-ID.
Use the device objects to enforce policy rules and monitor and identify potential issues.
The following list includes some example use cases for device objects.
Use source device objects and destination device objects in Security, Authentication, QoS, and decryption policies.
Use the decryption log to identify failures and which assets are the most critical to decrypt.
View device object activity in ACC to track new devices and device behavior.
Use device objects to create a custom report (for example, for incident reports or audits).