Enhance Network Security with the Palo Alto Networks and Zero Networks Integration

Summary

Zero Networks integrates with Palo Alto Networks Next-Generation Firewalls by automatically classifying and tagging workloads, then syncing those tags to Panorama as dynamic address groups. Security teams can write Layer 7, App-ID, threat prevention, and DLP policies against those groups without changing network topology, and the groups update as the environment changes. In this demo, Nidhi Pandey of Palo Alto Networks walks through setup and shows the firewall blocking a cross-site scripting attempt and a malicious FTP download.

Key takeaways

• Zero Networks discovers workloads agentlessly, groups them by traffic and attributes, and pushes IP-to-tag mappings to Panorama.
• Panorama redistributes those mappings to VM-Series firewalls, so policies reference dynamic address groups instead of static IPs.
• Setup needs an API token from the Zero Networks portal, Panorama credentials, and a script run on the Zero Networks Trust Server.
• Zero Networks polls the environment continuously, so groups and policies stay accurate as workloads change.
• In the demo, Threat Prevention blocked cross-site scripting and data filtering blocked a malicious file download between tagged groups.

[00:00] Nidhi Pandey, Principal Technical Marketing Engineer – Software Firewalls, Palo Alto Networks: Welcome to a demonstration of how the Palo Alto Networks integration with Zero Networks achieves security with microsegmentation.

Zero Networks offers an innovative agentless microsegmentation solution that automates the classification and tagging of workloads. It gains visibility into all traffic moving between workloads and automatically tags the workloads. This integration allows writing dynamic address group policies in Palo Alto Networks next-generation firewalls for advanced Layer 7 inspection, App-ID enforcement, and DLP without modifying network topology. Automated synchronization of IP-to-tag mappings across platforms helps ensure consistent enforcement throughout the network. This unified approach simplifies security architecture, reduces operational overhead, and provides comprehensive protection against sophisticated cyber threats.

What does the integration architecture look like?

[00:57] Let us see this in action. Consider a data center hosting web servers, client machines, DNS, DHCP, and other services. Palo Alto Networks VM-Series is deployed inline. The Trust Server is deployed in the customer environment to act as a proxy between the customer network and the Zero Networks app. The solution can sync with a directory source to identify the environment’s workloads.

How do you connect Zero Networks to Panorama?

[01:25] As a first step, generate an API token in the Zero Networks portal from the API section under Settings. Scroll down, select Firewall Vendors, and click Add Panorama. Add the Panorama IP, the Zero Networks API key, and the Panorama API key. Download the script. You can verify the Panorama IP and keys in the downloaded script. Transfer the script to the Zero Networks Trust Server, where you will run it to start the service.

[02:00] Before we run the script, let us verify the configuration on Panorama. We notice that there are no groups created under Objects. We have configured data redistribution so the firewall can learn the IP tags. Under Managed Devices, we have one VM-Series firewall added to this Panorama. Now let us log into the firewall and check the configuration. We have data redistribution configured to learn the mapping from Panorama. Also, we don’t have any device addresses available under Objects.

How does Zero Networks discover and group workloads?

[02:45] Now let us go ahead and execute the script to learn about the environment. Navigate to the folder where the file was copied and run the Python script. Zero Networks now learns the resources and automatically groups them based on traffic and other attributes. The environment will be polled at continuous intervals to monitor any change. These groups and mappings are sent to Panorama.

[03:15] On Panorama, we see that the dynamic address groups have been learned and all the resources have been identified and mapped. Going to the Zero Networks console, all the identified devices can be seen under Assets. Monitored devices can be seen under the Monitored section. We notice that the client machine and the web server have been identified, and properties like IP addresses have been learned. Click the device name to check the other properties of the resource. We can see all the other attributes for this resource.

How do you build a policy with dynamic address groups?

[03:54] You can also verify the learned resources and mappings from the Panorama console. We notice that the client IP has been learned and grouped under Client, and the app server IP has also been learned and grouped under Servers. Now let us go back to Panorama and use these learned dynamic address groups in a policy. Use Client as the source and Servers as the destination. We have the security profile enabled for this policy.

[04:33] Let us go ahead and push the changes to the firewall. Edit the selection and select the firewall. Once the configuration is committed successfully, notice that the address groups are visible in the firewall console as well. Expand the More option to view the learned IP mappings. We see that the client and server IP addresses have been learned correctly. From the Policy section, we can check the address mappings from the View More option.

What happens when an attacker targets the application?

[05:19] Now let us send some traffic from the client machine to access the application hosted on the web server. We see that the application is accessible. Now let us assume that a hacker injects a script in the URL, a cross-site scripting attack, to find vulnerabilities in the application. The Threat Prevention security service enabled for this traffic on the firewall detects the malicious code being injected and drops the packet. The firewall traffic log shows the traffic between the client and server groups. The threat log on the firewall shows the vulnerability detected for the traffic between client and server, and the action was reset.

[06:07] Let us now go back to the client machine and simulate another attack scenario. The user connects to the FTP server. Now the user tries to download a malicious file from the FTP server. The data filtering policy enabled for this traffic detects the file as malicious and blocks the action. We notice that the file download does not succeed and the connection is reset. Checking the firewall logs, we see the logs captured under the Data Filtering section.

[06:43] This brings us to the end of this demo. To summarize, the Palo Alto Networks and Zero Networks integration helps customers achieve microsegmentation and ensures that security policies implemented for east-west and north-south communication are dynamically updated and applied to the environment. Thank you for watching.