Use Dynamic Address Groups in Firewall Policy
This is one of the best feature which can be used by Network and security adminitrators.
Today Firewall administrator deal with major challenege of Auto Removal of Servers which are not part of current policy . Because that server is decommisioned and because of any xyz reason not informed to security team . Problem occurs when the server with the same IP address is used by other application and because the secuirty admin is not aware of the same . The same old policy which is actually not required can be used by new application.
This will also solve the problem of administrator adding or deleting 1000 of ipswhich ae vulnerable.
As per my knowledge there are few firewall who uses the concept of Dynamic address grup. This is mainly usefull for VM environment wehre we use the concept of Tagging.
This feature is best used in PaloAlto Firewall + VM environment.
You can refer the below link to check the same.....
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy
https://www.juniper.net/documentation/en_US/release-independent/spotlight-secure/topics/reference/general/secure-connector-dynamic-address-group-overview.html
NEXT BLOG WE WILL BE COVERING THE (ACI + PALOALTO) INTEGRATION FOR DYNAMIC EPGS (VIRTUAL + PHYSICAL ENVIRONMENT).
Today Firewall administrator deal with major challenege of Auto Removal of Servers which are not part of current policy . Because that server is decommisioned and because of any xyz reason not informed to security team . Problem occurs when the server with the same IP address is used by other application and because the secuirty admin is not aware of the same . The same old policy which is actually not required can be used by new application.
This will also solve the problem of administrator adding or deleting 1000 of ipswhich ae vulnerable.
As per my knowledge there are few firewall who uses the concept of Dynamic address grup. This is mainly usefull for VM environment wehre we use the concept of Tagging.
This feature is best used in PaloAlto Firewall + VM environment.
You can refer the below link to check the same.....
https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/policy/monitor-changes-in-the-virtual-environment/use-dynamic-address-groups-in-policy
https://www.juniper.net/documentation/en_US/release-independent/spotlight-secure/topics/reference/general/secure-connector-dynamic-address-group-overview.html
NEXT BLOG WE WILL BE COVERING THE (ACI + PALOALTO) INTEGRATION FOR DYNAMIC EPGS (VIRTUAL + PHYSICAL ENVIRONMENT).
Comments
Post a Comment