To identify devices on the network, IoT Security requires network traffic metadata for analysis. Palo Alto Networks firewalls extract and log this metadata when they apply Security policy rules that have logging enabled. The firewalls send the logs to the logging service. The logging service then streams the metadata to IoT Security, which uses AI and machine learning to automatically discover and identify network-connected devices, dynamically construct an asset inventory, detect device vulnerabilities, and determine a baseline of acceptable network behaviors that IoT Security recommends next-generation firewalls allow in Device-ID policy rules.

However, depending on where the firewalls are placed, they might not have visibility into all network traffic, resulting in device discovery gaps and lower efficacy in identifying devices, monitoring behaviors, and enforcing Device-ID rules. When firewalls don’t receive traffic from all devices, they can still gather IP address-to-MAC address bindings and additional network data by using SNMP to query switches and other forwarding devices throughout the network.

When using SNMP to query network switches, firewalls first develop a network topography by requesting the Link Layer Discovery Protocol (LLDP) neighbors and Cisco Discovery Protocol (CDP) neighbors of one switch (the entry point switch) and then repeating the request with neighboring switches and child switches one by one throughout the network. After obtaining a list of switches throughout the network, or within a limited area of the network, the firewalls next query each one for its ARP table as well as other information. The ARP table contains the IP address-to-MAC address binding information for the devices connected through the switch to the network. Other device details for which firewalls query include the physical interfaces or ports on the switch to which devices connect, their VLANs and subnets, and DHCP and DNS server IP addresses. After the firewalls receive this information, they create logs and send them through the logging service to IoT Security for analysis. By using SNMP to collect more data from switches and forwarding devices in parts of the network that firewalls don’t have visibility into, you enable IoT Security to form a greater view of the devices on the network and expand its services to even more devices.