Interop: Palo Alto Networks' Firewall Identifies App Traffic On Content, Not Ports - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Infrastructure // PC & Servers
Commentary
4/30/2008
01:10 AM
David Berlind
David Berlind
Commentary
Connect Directly
Facebook
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Interop: Palo Alto Networks' Firewall Identifies App Traffic On Content, Not Ports

You've programmed your firewall to block the ports that some unwanted app is using and that app turns up on your net again. Net-enabled applications don't tie themselves down to one port the way the Web (HTTP, port 80) and other apps do. After some firewall shuts their ports down, they find another port. Using traffic profiles instead of ports to identify more than 600 applications, not only did Palo Alto Networks' series win InformationWeek's

You've programmed your firewall to block the ports that some unwanted app is using and that app turns up on your net again. Net-enabled applications don't tie themselves down to one port the way the Web (HTTP, port 80) and other apps do. After some firewall shuts their ports down, they find another port. Using traffic profiles instead of ports to identify more than 600 applications, not only did Palo Alto Networks' series win InformationWeek's Best of Interop in the security category, it took the grand prize as well. In the video below, Palo Alto's Lee Klarich walks me through some of the firewall's innovations.

One of the more interesting attributes of the PA-4000 series of firewalls is how, in addition to profiling unencrypted traffic, it can also inspect and apply policies to SSL-enabled traffic.

Lee Klarich, Palo Alto NetworksTake Gmail, for example. When a PC client attempts to make a connection to Gmail over https (which is the way you should access Gmail when going over a WLAN) from behind a PA-4000 firewall, the PA-4000 firewall spoofs the Gmail service, intercepts the traffic, decrypts it, inspects it, builds its own encrypted connection to Gmail, and passes the traffic on (to Gmail).

So long as the encryption is over SSL, Klarich says the PA-4000 series can proxy the traffic. But if it's an application that uses some sort of proprietary encryption method, there's little that Palo Alto can do to apply its magic there.

Once a PA-4000 series firewall can identify applications by their traffic, the next step (as with other conventional firewalls) is to apply security policies to that traffic. According to Klarich, the PA-4000 supports Microsoft's Active Directory in such a way that firewall policies are easy to apply to AD groups or to individuals by name (as opposed to IP address) since AD keeps track of IP addresses by user. Of course, the PA-4000 series also can apply policies by IP address if you want to do it that way (or the system isn't registered with Active Directory, as is the case with the many Macs that are now getting more traction in the enterprise).

The PA-4000 doesn't support LDAP. At least not yet. Right now, it comes in two versions, the 4020 and the 4050. The 4020 is designed to handle a load of about 2 Gbps and costs about $35,000. The 4050 can handle 10 Gbps and costs $60,000.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Email This  | 
Print  | 
RSS
More Insights
Commentary
Enterprise Guide to Edge Computing
Cathleen Gagne, Managing Editor, InformationWeek,  10/15/2019
News
Rethinking IT: Tech Investments that Drive Business Growth
Jessica Davis, Senior Editor, Enterprise Apps,  10/3/2019
Slideshows
IT Careers: 12 Job Skills in Demand for 2020
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/1/2019
White Papers
Register for InformationWeek Newsletters
Video
All Videos
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
Back Issues | Must Reads
Slideshows
Flash Poll