Download - Palo Alto Network Integrationcdnx.liveaction.com/.../Palo-Alto-Network-Integration.pdf · 2016-12-22 · displayed though LiveAction’s LiveNX can help a network or security engineer

Copyright©2008-2016LiveAction,Inc.Allrightsreserved.LiveAction,LiveNX,LiveUX,theLiveActionLogoandLiveActionSoftwarearetrademarksofLiveAction,Inc.Informationsubjecttochangewithoutnotice.

LiveAction,Inc.3500WESTBAYSHOREROADPALOALTO,CA94303

Palo Alto Networks Integration with LiveNX

LIVEACTION,INC.

2|PaloAltoNetworksIntegrationwithLiveNX

1. Introduction

PaloAltoNetwork’sNextGenerationFirewallprovidesextensiveinformationaboutsessions,websitesandusersvisitingthosesites.ThisinformationwhendisplayedthoughLiveAction’sLiveNXcanhelpanetworkorsecurityengineervisualizespecificeventsthathavehappenedataspecifictimeorisoccurringatthepresenttime.

ThisDocumentwillwalktheadministratorthroughtheprocessofsettingupNetFlowExportonthePaloAltoNetworksdeviceandhowtovisualizetheinformationwithinLiveNX


2. IntegrationArchitecture

TheIntegrationbetweenPaloAltoNetworksdevicesandLiveNXisoverstandardprotocolsofNetFlowandtheSimpleNetworkManagementProtocol(SNMP).PaloAltoNetworksdevicescanexportNetFlowinformationtoLiveNX.Inadditiontothestandardfields,PaloAltoNetworksdevicescanalsoexportApplicationIDandUserIDwithintheNetFlowPackets.


3. EnablingNetFlowExportonPaloAltoNetworksFirewalls

ToenableNetFlowExportonthePaloAltoNetworksdevice,logintothePaloAltoNetworksWebUI

AndnavigatetoDevice,expandtheSeverProfileaccordion,andselectNetFlow.ClickonAddandenterthecorrectinformationfortheLiveNXseverornode.ToincludetheextraPaloAltoNetworksfields,User-IDandApplicationIDcheckthePAN-OSFieldTypesbox

SelectOKandtheExporterhasbeensetup.Nowweneedtoactivatetheexportoftheflows.Thisisdoneonaninterfacelevel.NownavigatetotheNetworkTab,andInterfaces.SelecttheInterface(s)thatwillbeusedtogeneratetheNetFlowdata.IntheNetFlowProfilesectionaddtheExporterthatwejustsetup.


Oncecompleted,committheconfiguration.ThePaloAltoNetworksdeviceshouldnowbeexportingflowstoLiveNX.

ThenextstepistoenablethePaloAltoNetworksdevicetousetheMicrosoftActiveDirectorytopulltheUseridtoIPaddressmapping.PaloAltoNetworkscanpullthisinformationfromothersourcesaswell,pleaserefertothePaloAltoNetworksdocumentationtoenabletheothersources.OntheDeviceTab,navigatetoUserIdentificationandinUserMappingselectthegearicon(topright)tosetuptheagent.WearegoingtousetheAgentlessmethodandenableWindowsManagementInterface(WMI).EnterthenameandpasswordthatwillbeusedforWMIconnectivity.WewillpresumethatthisUseridhasalreadybeensetupbyyourADadministratorwiththecorrectsecuritylevel.


MakesurethatyoualsoenableServerMonitoring,ClientProbingandNTLM.NextclickOKandthenintheServerMonitoringsectionaddthedomaincontrollersthatneedtobeaccessedbythisPaloAltoNetworksDevice.ThislistmaybedifferentdependingontheADarchitectureandgeographiclocation,asADsecurityauditlogsarelocaltothedomaincontrollersthatareusedforauthentication.


OnceyouhaveaddedtheUserIdentificationserver,nowyoumustenableUserididentificationontheZones,toaccomplishthisnavigatetoNetwork,ZonesandediteachoftheZonesthatyouwanttheUseridtobedisplayon.


Nowcommitthechanges,andwehavefinishedsettingupthePaloAltoNetworksdevice.


4. AddingthePaloAltoNetworksDevice(s)toLiveNX

OpentheLiveNXJavaClientandlogintothesystem.NavigatetoFile->AdddeviceandtheAddDeviceWizardwillstart.Thisisa9stepwizardthatwillaskandinterrogatethedevicetofindtheInterfacesandotherinformationaboutthesystem.YoumusthavetheIPaddressofAnyLayer3interfacethatwillbeexportingFlowdata,andtheManagementIPaddress.YoumustalsohavetheSNMPcommunitystringthatwillbeusedtocollecttheinterfaceTable.

SelectNextandLiveNXwillnowgothroughandfindtheinterfacesinthePaloAltoNetworks.OnceyouhaveselectedtheinterfacesthatNetFlowwillbeexportedfromclicknext,andasLiveNXwillnotknowofanyVLANSdefinedwithinthePaloAltoNetworksselectNext.


NowwecanchangethePollingRate,leaveitatOneminute,andselectFlowsandclicknexttoreviewtheconfigurationandthenselectFinish.



ThedevicewillnowappearontheMainScreenandshouldbegreenmeaningthatLiveNXhascontactedthedevice.Next,weneedtorunthedevicesetupagain.ThisisanissuewithretrievingtheIPaddressesfromtheinterfaces.PaloAltoNetworksdevicesdonotupdatetheInterfaceMIBtablewithIPAddresses,andthereforeLiveNXcannotassociatetheflowdatawiththecorrectinterfaceor,connectittothecorrectnetworks.Thisisremediedbymodifyingthedevice.RightClickonthePaloAltoNetworksdeviceandopenEditDeviceSettings.


TheDeviceWizardwillstartandthistimewearegoingtochangetheDevicetypetoNonSNMPdevice,selectNextandtheInterfaceTablewillbepresented


EntertheIPAddressesoftheInterfacesthatwillbeexportingtheflowsandselectFinish

TheDevicewillnowconnecttothecorrectnetworks.IfthePaloAltoNetworksisrunninginLayer2mode,entertheManagementIPaddress.


5. Reports

LiveNXcurrentlyhasarichsetofreportsandvisualaidsthatcanhelpthenetwork/securityengineertoviewtrafficthatistraversingthePaloAltoNetworksdeviceandbeabletounderstandtheapplicationsandusersthatmaybeeffectingthestabilityofthenetwork.Let’sstartwithasetofVisualAids…ThefirstistomonitorthePaloAltoNetworksdeviceitselfandseewhatflowareactiveinreal-time.FromthemainscreenintheJavaClient,changetheflowdisplaytoFirewall.ThiswilldisplayallflowstraversingthePaloAltoNetworks

Nowifwedoubleclickontothedevicewewillnowseeareal-timedisplayofalltheflowsthePaloAltoNetworksdeviceisexporting.Thisviewisupdatedeveryminuteandcanbeusedtofindspecificflowsandusethattodrilldownintomorespecificreports.


Ifweselectaspecificflow,itcanbeaddedtothesearchfilter,andthenonlyinformationdestinedtothatapplicationorIPaddresscanbedisplayed.Orwecandrilldownintomorespecificreports,likeTopAnalysis,orInterfaceBandwidthreports


Byrightclickingonspecificcolumnsinthisdisplaywecandrilldownandlookatspecificissuesthatcouldbehappening,ifwechoosetheSourceIPAddresswecandrilldowntotheinterfacereportandseetheamountoftrafficthatisbeinggeneratedthatistraversingthroughthefirewallbythatspecificaddress,orbyrightclickingontheAPP-ID(PaloAltoNetworks)wecanchoosethesamereportandseetheamountoftrafficthatisspecificapplicationisgenerating


FromLiveNX’sFlowReportswecanalsolookatalltheapplicationsandthebandwidtheachisconsuming.OpenFlowReportsandchoosetheApplicationreport,choosethePaloAltoNetworksdeviceandmaketheGraphtypeFirewall,selectthetimeframeandexecutethereport.


FromthisviewwecanalsodrilldoneonspecificapplicationsandgathermoreinformationonNetworkActivity.


6. UseCases

Let’slookatsomespecificusecasesthatcanhelpsolvespecificissuesthatmaybegeneratedwithinanorganization.

1)WhatwasDone?Inthisspecificusecase,weneedtounderstandwhatanemployeedidduringaspecifictimeperiodandwhatapplicationswereusedandifanylargeamountsofdatawastransferredoutsidetheofthecompany’sinfrastructure.InformationthatwehavearetheUsersIDandthetimeframethattheeventhappened.InLiveNXwecanrunFlowreportsonthetimeframeandthenastheUser’sIDappearsinthereportswecanusetheassociatedIPaddresstoaddtothefliterlist.Executethereportandnowwehavealltheexternalactivityforthatuserovertheselectedtimeperiod.

ButnotonlycanweseewhatexternalappsandsystemsweretouchedwecanalsoseealltheinternalactivityfromthataddresswhiletheuserwasassociatedwiththatIPaddress.SelectAllDevicesandthetimeframe,setthegraphtoBasicFlowandexecutethereport.


2)DataLeakageReportofalargeDataLeakagehasoccurred.Yourmissionasanetwork/securityengineeristotryandfindoutwho,whatandwhenitoccurred.YouknowtheApplication,butyoudon’tknowwhodidit,orwhenitwasdone.Howdoyoufigureitout?Thefirststepistolookattheapplicationsgoingthroughthefirewall(s)overaperiodoftime.NavigatetoFlowreportsinLiveNX,selecttheperiodoftimethatyouwanttomonitor,selectthefirewallthatyouwilluseasthesource,selectgraphtypetobefirewallandexecutethereport


Fromthisreportwecandrilldownintotheapplicationwerethedataleakagewasreported.SoifwerightclickontheapplicationandthendrilldownandruntheTopAnalysiswecannowseetheindividualflowsoverthisspecifictimeframeandtheusersthatgeneratedthetraffic.InthisexamplewewilllookforsomethinggoingtoFacebook,whileit’snotadataexporttoolthesameprincipleapplies.


3)ShadowIT/CloudApplicationVisibilityThecloudistransformingthewaybusinessisdone.ButtheITteamsdonotalwayshavevisibilityofthesebusinesscriticalapplicationsandyettheyarestillresponsibleformakingsuretheseapplicationsareperformingwellandmeetinguser’sneeds.

ThefirststepistocollectinformationfromtheInternetedgesacrossyournetwork.ScheduleaweeklyreporttoprovideyoualistofCloudapplicationsonanongoingbasis.


Fromthisreport,youcanseethelistofCloudapplicationsandtheamountoftrafficeachapplicationisconsumingyourresources.Networkcongestioncanbeanissueformanybusinessestoday.Youwanttobesurethatcriticalapplicationsarenotimpactedwhencompetingwithrecreationaltraffic.InthenewInternet-basedworld,itisimportanttoidentifywhichapplicationsareonyournetworkandwhereyourresourcesarebeingconsumedtoalignwithyourbusinesspolicy.


7. Conclusion

CombiningPaloAltoNetworksNextGenerationFirewallsandLiveAction’sLiveNXgivesbothnetworkengineersandSecurityEngineersmorevisibilityintotrafficthatisinthenetwork,andexitingasegmentortheperimeterofthenetwork.