IoT Security Solution Setup

Table of Contents

IoT Security Integration with Next-generation Firewalls

Set up the multiple components that constitute the IoT Security solution.

Where Can I Use This?	What Do I Need?
From email activation link NGFW (Managed by PAN-OS or Panorama) IoT Security (Managed by IoT Security)	IoT Security subscription for an advanced IoT Security product (Enterprise Plus, Industrial OT, or Medical)

The following is an overview of the main steps involved in setting up the IoT Security solution with particular focus on the following three components:

Palo Alto Networks Next-Generation Firewalls with or without Panorama management
Logging service with or without a Strata Logging Service instance
IoT Security application

The solution also makes use of the update server for device dictionary file updates and the Customer Support Portal and hub for IoT Security user management. Optionally, IoT Security integrates with Prisma Access and SD-WAN and, through XSOAR, with third-party products.

Learn about the main steps involved in the IoT Security solution setup:

1 - Check Firewall Support and Prerequisites

2 - Onboard IoT Security

3 - Prepare Firewalls

4 - Install Certificates and Licenses

5 - Configure Logging

1 - Check Firewall Support and Prerequisites

Most current Palo Alto Networks firewall models support IoT Security with a few exceptions.

Although IoT Security is a cloud application and is always running its latest software version, make sure the firewall models and PAN-OS versions on them support the level of functionality you want.

In addition, there are several prerequisites. For example, each firewall that integrates with IoT Security must have an IoT Security subscription. Not all firewalls on your network must subscribe to IoT Security; only those that collect network traffic and forward logs to it and those after PAN-OS 10.0 that receive policy rule recommendations and IP address-to-device mappings from it.

Detailed Instructions

Firewall and PAN-OS Support of IoT Security

IoT Security Prerequisites

Medical IoT

IoT Security Integration with Prisma Access

2 - Onboard IoT Security

IoT Security onboarding is a six-step process that starts from an Activate link in an email from Palo Alto Networks. (If you have an Enterprise License Agreement, it starts either in the Customer Support Portal or in the hub). During the IoT Security onboarding process, do the following depending on what you’re activating:

Create an IoT Security tenant
(IoT Security Subscription) Activate a new Strata Logging Service instance or associate an existing one with your IoT Security tenant
or
(IoT Security Subscription - Doesn’t Require Data Lake) Specify the data ingestion region
Subscribe firewalls to IoT Security services
Optionally activate a third-party integrations add-on

Detailed Instructions

Onboard IoT Security

3 - Prepare Firewalls

For IoT Security to discover network-connected devices and assess their network behavior patterns, it needs quality network metadata from next-generation firewalls. Therefore, it’s essential that firewalls are placed on the network and configured to collect metadata from traffic and forward it for IoT Security to access. In particular, DHCP traffic is important because it links dynamically assigned IP addresses to device MAC addresses, making them trackable over time.

Firewalls must also provide IoT Security with metadata for other types of traffic that devices generate. They do this by enforcing policy on network traffic, creating logs, and then forwarding them to the logging service, which then streams the metadata to IoT Security.

Detailed Instructions

Firewall Deployment for Device Visibility

Firewall Deployment Options for IoT Security

4 - Install Certificates and Licenses

Logging service and device licenses permit next-generation firewalls to connect to the logging service and IoT Security. Logging service and device certificates authenticate these connections. Firewalls need these licenses and certificates to integrate with IoT Security.

Firewalls running PAN-OS 8.1–10.0 use logging service certificates to secure communications with the logging service so they can forward various logs to it. From PAN-OS 10.0, when Device-ID was introduced, firewalls use device certificates to secure communications with IoT Security to get IP address-to-device mappings and recommended policy rules. (Note: Panorama-managed firewalls can get recommended policy rules either directly from IoT Security or indirectly from IoT Security through Panorama.) From PAN-OS 10.1, firewalls use just one device certificate to secure connections to both the logging service and IoT Security. Panorama also uses a device certificate to secure communications with IoT Security.

Detailed Instructions

Onboard IoT Security

Prepare Your Firewall for IoT Security

Install a Device Certificate

Install the Panorama Device Certificate

5 - Configure Logging

Configure Security policy rules on firewalls to log traffic and forward logs to the logging service where IoT Security accesses it. The more network traffic metadata IoT Security has for analysis, the more quickly and confidently it identifies devices and establishes a baseline of their normal network behaviors. This results in a broader application of Security policy rules based on Device-ID (IoT Security sends firewalls IP address-to-device mappings only when it has a high confidence in their identities and the devices have sent or received traffic within the past hour) and broader and deeper insight into device risk and real and potential security threats.