Interop: Palo Alto Networks' Firewall Identifies App Traffic On Content, Not Ports

You've programmed your firewall to block the ports that some unwanted app is using and that app turns up on your net again. Net-enabled applications don't tie themselves down to one port the way the Web (HTTP, port 80) and other apps do. After some firewall shuts their ports down, they find another port. Using traffic profiles instead of ports to identify more than 600 applications, not only did Palo Alto Networks' series win InformationWeek's Best of Interop in the security category, it took the grand prize as well. In the video below, Palo Alto's Lee Klarich walks me through some of the firewall's innovations.

One of the more interesting attributes of the PA-4000 series of firewalls is how, in addition to profiling unencrypted traffic, it can also inspect and apply policies to SSL-enabled traffic.

Take Gmail, for example. When a PC client attempts to make a connection to Gmail over https (which is the way you should access Gmail when going over a WLAN) from behind a PA-4000 firewall, the PA-4000 firewall spoofs the Gmail service, intercepts the traffic, decrypts it, inspects it, builds its own encrypted connection to Gmail, and passes the traffic on (to Gmail).

So long as the encryption is over SSL, Klarich says the PA-4000 series can proxy the traffic. But if it's an application that uses some sort of proprietary encryption method, there's little that Palo Alto can do to apply its magic there.

Once a PA-4000 series firewall can identify applications by their traffic, the next step (as with other conventional firewalls) is to apply security policies to that traffic. According to Klarich, the PA-4000 supports Microsoft's Active Directory in such a way that firewall policies are easy to apply to AD groups or to individuals by name (as opposed to IP address) since AD keeps track of IP addresses by user. Of course, the PA-4000 series also can apply policies by IP address if you want to do it that way (or the system isn't registered with Active Directory, as is the case with the many Macs that are now getting more traction in the enterprise).

The PA-4000 doesn't support LDAP. At least not yet. Right now, it comes in two versions, the 4020 and the 4050. The 4020 is designed to handle a load of about 2 Gbps and costs about $35,000. The 4050 can handle 10 Gbps and costs $60,000.