The support for Palo Alto Networks Next Generation Firewalls (NGFW) is one of our flagship products. The coverage spans a wide variety of use cases, all with problem avoidance as a primary goal. Today, we have over 240 Auto-Detect elements to help you proactively manage your firewalls.

Key use cases:

In-depth visibility with proactive alerting
High availability readiness
Security risks identification including alerts on critical CVE
Best practices validation including support for Palo Alto Networks Best Practice Assessment (BPA)
Organization standards enforcement
Ongoing maintenance automation

In this blog post, we’ll look at some of the most popular automation elements among our customers.

#1 Monitoring Critical Services

Firewalls depend on many external security services to get dynamic content updates for the latest threat intelligence. Services include advanced threat prevention, malware prevention, URL filtering, External Dynamic List (EDL), etc. A key capability of Indeni is ensuring connectivity to these external services is maintained at all times.

It goes beyond just constantly checking on the connectivity, but ensuring service registration is successful and vendor recommended best practices are followed. For example, if WildFire content update is not set to “every minute” and update action is not set to “download and install”, Indeni will generate a warning.

Another example is our support for EDL. It is important to ensure that the EDL list is not empty and it has not reached capacity.

If the connectivity is lost, Indeni will even perform automated troubleshooting to determine the root cause of the connectivity problem.

#2 Automated Troubleshooting

When an issue is detected, Indeni will automatically apply device-specific domain knowledge to the problem. It will analyze the problem to accelerate root cause analysis. Let’s look at the previous WildFire connectivity problem as an example. Indeni first checks to see if the best server assigned for WildFire updates is reachable. If pinging fails, we will determine if it is due to DNS unknown host or unresponsiveness. If ping fails and DNS is working, we run a traceroute command to see if there is a route to the host. We then query the traffic log to see if traffic from the local service route IP address is blocked from reaching the destination IP of the WildFire Cloud IP address.

Complete workflow

Automatically investigating a problem enables us to provide you with very detailed and prescriptive remediation steps to accelerate resolution. With the help from our community of experts and customers, we developed 20 Auto-Triage elements that are considered either business critical or common problems.

Auto-Triage Elements for Palo Alto Networks NGFW:

BGP peer(s) down
Cluster member no longer active
Communication between management server and specific devices not working
DNS lookup failure(s)
Debug mode enabled
Device restarted (uptime low)
Disk RAID in error state
Dynamic VPN in error state
EDL(s) configured not reachable
High ARP Cache
High CPU usage per core(s)
Logs are being discarded
MAC cache usage high
Maximum number of routes nearing (IPv4)
NTP sync failure(s)
Next hop inaccessible
Permanent/Monitored VPN tunnel(s) down
Temperature nearing maximum
URL cloud not connected
WildFire cloud status is not OK

#3 SSL Decryption Visibility

Decrypting encrypted traffic can consume significant firewall processing resources. If firewall resources are an issue, it can affect performance. Measuring firewall performance is a great first step to understand the available resources. Measuring specific metrics relating to decryption traffic is essential. Receiving notifications about decryption sessions approaching limit and high memory usage enable you to take corrective measures before service is impacted.

#4 High Availability

Our support for high availability readiness has always been popular among our customers. An all time favorite is the check for synchronized static routes among the firewalls in a cluster. This is something people often forget to add to the standby firewall when a new static route is needed. Sadly, no one notices the missing static route until a switchover occurs when you actually need it!

Learn more about our high availability support here.

#5 Center for Internet Security Benchmark Automation

With cyber attacks on the rise, enterprises need to be hyper-vigilant about how they secure their firewalls. Device hardening is necessary to reduce the attack surface. Aligning to the Center for Internet Security (CIS) benchmark for Palo Alto Firewalls helps you strengthen your security with a best practice implementation. It can also improve your security compliance programs and posture.

Learn more about our support for CIS here.

Try Indeni

There, you have our top picks for Palo Alto Networks firewalls. You have made a big investment in security with your firewall and all the features it has enabled. Let us help you make the most out of your security infrastructure. For a complete list of Auto-Detect Elements, download here.

panos-ADE-7.9 Download

If you are new to Indeni, we encourage you to take Indeni for a spin and try out our automation capabilities.