Advanced Device-ID connects Device Security device management and Security policy enforcement in Palo Alto Networks Next-Generation Firewall. With Advanced Device-ID, you can create flexible, customizable device identification rules that provide more granular control without the limitations of legacy Device-ID objects. To enable Advanced Device-ID, you need an active Device Security subscription on a firewall running PAN-OS 12.1 or later.

Advanced Device-ID addresses several key use cases that are challenging to implement with legacy Device-ID.

This feature enhances policy recommendation workflows, generating behaviors for both system default and custom Advanced Device-ID objects. It also improves visibility by adding Advanced Device-ID information to asset inventory views and Traffic logs.

Advanced Device-ID configurations are centrally managed in Device Security, providing a unified location for defining complex device matching criteria. Users can create Advanced Device-ID objects using a combination of all non-custom attributes in Device Security, including third-party attributes. This greatly expands the number of attributes available for legacy Device-ID objects. Additionally, Advanced Device-ID matching rules support nested conditional logic, enabling precise device identification based on multiple criteria. You can combine up to 30 attributes in a single Advanced Device-ID object.

Once created, an Advanced Device-ID synchronizes to PAN-OS firewalls through the PAN-OS Edge Service. The firewall receives a list of Advanced Device-ID definitions, including UUIDs, names, and descriptions. Additionally, Device Security IoT Device Context, also known as IoT verdicts, now include Advanced Device-ID attributes for each device, enabling more granular policy enforcement.

PAN-OS provides flexible enforcement options, letting administrators choose to use legacy Device-ID objects, Advanced Device-ID objects, or a hybrid mode supporting both. This flexibility ensures backward compatibility while enabling the adoption of the new Advanced Device-ID capabilities.

When your firewalls receive traffic from overlapping IP address blocks, use multi-vsys support for Device-ID so that each vsys applies policy against the correct device. Multi-vsys support assigns device context segments to firewalls and vsys, and their traffic gets scoped to the corresponding segment. The segment identifier helps scope device context to the correct firewall or vsys, preventing merged baselines when the same address appears in more than one part of your network.

By implementing Advanced Device-ID, you can create more precise and efficient Security policy rules, reduce administrative overhead for monitoring network traffic, and improve your overall security posture for assets on your networks. The centralized management and flexible matching criteria enable security teams to adapt quickly to new assets and evolving requirements in modern, complex network environments.