Palo Alto Networks, Inc. · NASDAQ:PANW

Palo Alto Networks — Technical Presentation (2018)

49 slides from Palo Alto Networks's technical presentation, 2018

  1. Slide 1: GlobalProtect

    ie NE—-KYIRAEITGIEALY ! GlobalProtectOE=, sy

  2. Slide 2: GlobalProtect agenda: GlobalProtect, Windows, iOS

    • GlobalProtect • GlobalProtect • [ ] Windows • [ ] iOS • 2 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  3. Slide 3: GlobalProtect

    GlobalProtect 3 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  4. Slide 4: VPN and proxy architecture with split tunnel

    VPN%NProxyU7E3#5G+1:444 H U'>SK3 r?I3,: 8R ]gfceJC`hnceeqfo r r0: 8R U73E67O7G3<B;QE=@' r I'r-:&HGR ↓ Xqbsfce ( HOBCJ I :&H4) Xqbsfce9PIn`[:2MR JC Split Tunnel VPN Tunnel Firewall VPN%Dls^)(:$TSR ↓ rVPN)(p\EFirewall"p\I/ aYkndW .Servers :& → [mXVqe:=H;6 VPN jn_s DMZ Active Directory .DNS Proxy Proxy

  5. Slide 5: GlobalProtect with VPN and proxy architecture

    GlobalProtectAY\Th+n VPN9LGProxyP' o,(DI@6 l0;$%A<N l F@E^gaR\UPVPN^k`iH7 ll5;$%A<N l<J&:8Ybh\^ ^k`i,K )7 Sk[m`\^ l,l2#;'=ON ( Qbh/1D >8Qbh,") _dSk Split Tunnel VPN Tunnel ! External Gateway PA Firewall 3:MEQUZYFFirewallAfmW. -?NEA6*jVBfmWBE 4; ZTeh]R 3Servers 7 chXm DMZ Active Internal Directory Ga

  6. Slide 6: VPN challenges and Next-Generation Firewall

    LVPN +(N666 • *0M)XFG9J96 • '5Net-Generation FirewallKLU6 • /io[aMWTKJU?INH=J96 • /LANMkq`qX(VPNfpgnX#%BJ9H)-CU)<J96 • ]lZYpf<Y]cbBEWeb_ZfMURLXo\p^CU)<J96 • !"J N5 /;SMmjqfY]cbK1@VU6 • mjqfY]cbKVPN&M X 3H=U<5/LANH CU?IN@ VG9J96 • bimeffpgnN7$_hgef G8I9:AF>T,6 • ZpdqgefONPQDMRR.CU6 • *OMmb]<4RU6;JT 2

  7. Slide 7: GlobalProtect and Next Generation Firewall

    GlobalProtect8?! Next Generation Firewall9>A)8 '.,A • D_hNlPfk$ • DNSRJdhWE(New)*IPS*DkUGEiQ*DkUQ\FGHD*URL^EiThkM*SjXF: (Wildfire) &_jJPl:B@725 6/A • elO$ (2-=! 9jMFk) • URLjKkM (jKkM418?gFRkQ") B3*8 .6/A • hclYDLRQ41680*&LAN9+A 6=C (2*`hPlC%6/A /<-+Q_hVYYk[i#.6/A • ZbFk • ]XIQYhlakM;D_hNlPfk 7 | ©

  8. Slide 8: GlobalProtect Next Generation Firewall

    GlobalProtect Next Generation Firewall 8 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  9. Slide 9: App-ID

    App-IDTM qMaiUoVgmK0 =J;AD, `LOePQojD3$ _kMj]^[]loSWD nMaiUoVgm0 *C< `LOePQoj PAVioX nco]&@EMaiUoVgm * n+D9I (SSL) n2FDb[]^[]1 (C&C)(* ]h`N[SKMaiUoVgm0 =G?5-8J 6App-ID TCP 22(ssh), 25(smtp), 80/443(http/https). UDP 53(dns). • MaiUoVgm@MSYW./)!9* Internet ()P2P4`LOj4Dropbox4Twitter4 Skype4pZdm^jCBD %

  10. Slide 10: Content-ID

    Content-IDTM:'%</0HbSbRNE]_S? INTERNET PA Firewall KbG`CbLbdMU_c\[cM2314HbSbRNE]_S?< • X=@`,96TcOX?`O_bG • X=@`O@Z705TcOWOcb(FaLQUDcV 8WOcb)39:X?`O_bG • & • ! (IPS))>bPA@`M)>bPMW@AB> • URLX?`O_bG • 63DSI_3.;0 2000<$+: URL <3/0Web>FNM (X` 35JYMF_ZK^b4#-"* 10 | © 2018, Palo Alto Networks, Inc. All Rig

  11. Slide 11: Content-ID: DNS security

    Content-IDTM: DNS!/1$ New PAN-OS9.0~ DNS '.4 &4)14 -3# +#- DNS WildFire DNS %6" DNS 0' *(65)#& URL,2"14 62 Cyber Threat Alliance Unit 42 11 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  12. Slide 12: WildFire

    .:`{~mnk=qvzuos – WildFireTM • 8,F1`{~mnk/o}mvq€xs Ø qvzuos^ahg$D]T8XfNZ[.:`yjl~i"5]/ZT .:`{~mnki9E→U):V`{~mnk_ Ø 5JM]L rpwt|i8_I Ø o}mvi7Z\Wg[c,(Bb`+!e2A%Y* WildFire 7?‚ R2A3_rpwt|i Q{~mnk/ C6# 22,000;Y7 WildFireTM -_>1000; S2A_L rpwt| i CI P.:`yjl~ iC'& <@2K(*)dOG 0:4 99.3% H0:4 1.3% 12 | © 20

  13. Slide 13: GlobalProtect

    GlobalProtect 13 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  14. Slide 14: SSL decryption and proxy

    $37.18- : • .4215&): • SSL &#$ !'(SSL$)Proxy".4215"amp;"( + $ • 680#&URL7/: • ,&)%37.18-: • ,$*Firewall% 9 14 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  15. Slide 15: URL filtering

    URL3'4)6/ /%(-,$ 205/" LAN 15+ LAN" 7 !7 7 "7 #7 &.*2() URL (SSL FQDN ) 15+ 15 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  16. Slide 16: GlobalProtect

    GlobalProtect 16 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  17. Slide 17: HIP check

    Windows10+Y HIPA6B9 FN4WQX;L>E OSHX=RWL>EID Host Information Profile GP Agent+HX=RW GBEVX9 (+ KUJ14T) (MAC/IP)() SOXE29?>#') LAN*&-HIP+ 2WA54T> (HX=RW)() '. HB92BK@JE562 " 0amp; ?8PSC3MS<X0' . D3>9 +Y D3>9/&) WindowsJ14257XT , 0 % :XH*,29?>!) WindowsIBA 17 | © 2018, Palo Alto Networks, Inc. All Rights

  18. Slide 18: GlobalProtect

    GlobalProtect 18 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  19. Slide 19: Split tunnel by domain: *.acme.com

    / '( #% ("& Internet Corporate Traffic *.acme.com !$( '( #% #% 19 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  20. Slide 20: Split tunnel for YouTube, Netflix, Instagram

    / !! ( ) YouTube Netflix instagram.com VPN! VPN! Lync Network > GlobalProtect > Gateways > external-gateway > Agent > Video Traffic VPN! Network > GlobalProtect > Gateways > external-gateway > Agent > Client Settings > Split Tunnel > Domain and Application 20 | © 2018, Palo Alto Networks, Inc. All R

  21. Slide 21: GlobalProtect

    GlobalProtect 21 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  22. Slide 22: GlobalProtect connection flow

    GlobalProtect:CF PA Firewall (#>B)) External Gateway DNS %D3F847 AgentPortal#+10@F-! External PortalConfig" Portal intra.paloalto.local E Gateway E,F7&'%B07 E(F/'D72:7&'##4;6F7 1*?B5$ Servers E" 9A>F3 =B.F DMZ E<07 Active Internal Directory PA Firewall Gateway DNS LAN 22 | © 2018, Palo Alto Networks

  23. Slide 23: GlobalProtect connection flow: external

    GlobalProtect&AHJ PA Firewall (/DF2) External Gateway DNS Intra.paloalto.local? 1I8J>:< NXDOMAIN Portal+! FQDN(intra.paloalto.local)DNS ",.), (1I8J>:<4J@6BH?19J+DHCP"- DNS/=G6() &FQDN'DNS $*&amp;" , →Agent'%,# , External Portal intra.paloalto.local Gateway 73EF;0 Servers CF5J DMZ Active Internal Direc

  24. Slide 24: GlobalProtect connection flow: portal and gateway

    GlobalProtect-35 PA Firewall ( /1#) External Gateway DNS "4(5,)+ PortalGateway1&+2&.4& External Portal intra.paloalto.local Gateway '$01*! Servers .1%5 DMZ Active Internal Directory PA Firewall Gateway DNS LAN 24 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  25. Slide 25: GlobalProtect external gateway connection

    GlobalProtect1MW[ PA Firewall (:QU=) External Gateway DNS <YE[KFI External Gateway31W@<Y$87VPNIYKV$(76() T[A .Host Information Profile(HIP\NCI$, )$Agent#5Gateway3(76 VPN Tunnel () ZGateway31W@<Y0T[A$4" External Portal intra.paloalto.local ?UHYBRV 9*6 2/! Gateway Portal-T[A9)+9Gateway$ % &'.$-%6(Cook

  26. Slide 26: GlobalProtect connection flow: internal

    GlobalProtect:CF PA Firewall (#>B)) External Gateway DNS %D3F847 VPN Tunnel External Portal intra.paloalto.local Gateway 1*?B5$ Servers =B.F DMZ Active Internal Directory PA Firewall Gateway DNS AgentPortal#+10@F-! PortalConfig" E E,F7&'%B07 E(F/'D72:7&'##4;6F7 E" 9A>F3 LAN E<07 26 | © 2018, Palo Al

  27. Slide 27: GlobalProtect internal DNS resolution

    GlobalProtect'=CE PA Firewall (/?A2) External Gateway DNS 1D7E<8: VPN Tunnel External Portal intra.paloalto.local Gateway 63@A90 Servers >A4E DMZ Active Internal Directory PA Firewall Gateway DNS Intra.paloalto.local A record: 10.10.10.10 Portal+"!FQDN(intra.paloalto.local)DNS $,.*, ( LAN+DNS)'(FW$-

  28. Slide 28: GlobalProtect internal gateway connection

    GlobalProtect1NZ^ PA Firewall (:SX>) External Gateway DNS <\F^LGJ VPN Tunnel () ]Gateway31ZA<\0V^B$4" External Portal intra.paloalto.local @XI\CTY 9*6 2/! Gateway Portal-V^B9)+9Gateway$ % &'.$-%6(Cookie) E?UXH; Servers ][\F<RMD[^K9 *6'.4-%6 QXC^ DMZ ]-VPN9*6'.4-%6(=OCW\) Active Internal Directory PA

  29. Slide 29: Windows

    [] Windows 29 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  30. Slide 30: GlobalProtect Portal download

    Global ProtectPortal%' ('($) • GlobalProtectPortal PA FirewallWeb! # • "( &( LOG IN 30 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  31. Slide 31: GP Agent installer

    GP Agent • GlobalProtect Agent • (.msi) 31 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  32. Slide 32: GP Agent install (1)

    GP Agent (1) • Next 32 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  33. Slide 33: GP Agent install (2)

    GP Agent (2) • Next 33 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  34. Slide 34: GP Agent install (3)

    GP Agent (3) • Next 34 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  35. Slide 35: GP Agent install (4)

    GP Agent (4) • Close 35 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  36. Slide 36: GP Agent connect to Portal (1)

    GP Agent (1) • PA Firewall Portal • Connect 36 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  37. Slide 37: GP Agent sign in (2)

    GP Agent!#('(2) • .4%,'24+ • Sign In #/)# • 2 Windows#/*3&-0 1quot;3 37 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  38. Slide 38: GP Agent (3)

    GP Agent (3) • 38 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  39. Slide 39: GP Agent connected (4)

    GP Agent! (4) • %" • LAN(VPN# 'amp;) 39 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  40. Slide 40: iOS

    [] iOS 40 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  41. Slide 41: Install GlobalProtect Agent from App Store

    • App Store GlobalProtect Agent • 41 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  42. Slide 42: 42 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

    • • 42 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  43. Slide 43: 43 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

    ( ) • " $# • "! % 43 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  44. Slide 44: Portal IP, username, password

    • • PortalIP • Username • Password • 44 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  45. Slide 45: Token authentication

    #$! #% • #$! #% TOKEN • $ " 45 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  46. Slide 46: External Gateway

    -1 External Gateway • External Gateway • #'%# • !"$(&)# 46 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  47. Slide 47: Internal Gateway

    -2 Internal Gateway • Internal Gateway Internal Network • " !# 47 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  48. Slide 48: GlobalProtect summary

    708 • GlobalProtect@#)0/ lt;4QNUKADIH.(/2' LAN/9 OUFV4%! • GlobalProtect5 PA Firewall3ALCT/&>4/ PA Firewall42 04BTJESUGPT% ! • GlobalProtect5 iOS:Android214NMBR69 ! • VPN:Proxy@+>;=9 ,?<4@*-% ;=2"%/&>! 48 | © 2018, Palo Alto Networks, Inc. All Rights Reserved.

  49. Slide 49: Thank you

    THANK YOU I

Palo Alto Networks — Technical Presentation (2018) on 6ix