Integration with Palo Alto Networks® Firewalls

Cloudpath supplements data already captured by Palo Alto Networks® firewalls by adding mappings of the IP address to a User ID, allowing the captured traffic to be more identifiable. When a user joins the network via Cloudpath, the Palo Alto Networks® firewall is notified of the user's login. Similarly, when a user is known to have left the network, the firewall is notified of the logout.

Cloudpath also sends Host Information Profile (HIP) data to the firewall, which increases visibility on connections and allows filtering on the type of client (by operating system, etc).

This section describes how to integrate Cloudpath with a Palo Alto firewall.

In this section:

  1. Palo Alto Networks® Firewall Prerequisites
  2. Wireless Controller Configuration
  3. Configuring Palo Alto Firewall and Web Filters
  4. Support for NAS-ID in Palo Alto Firewall Configuration
    A Network Access Server Identifier (NAS-ID) is a unique identifier for a network access server (an AP or controller). For Palo Alto Network (PAN), NAS-ID is configured in the advanced scope that allows for granular control over policy application.
  5. Configuring Advanced Scope for Firewall for Palo Alto
    For the Firewall for Palo Alto, you can configure Advanced Scope Matching based on service set identifier (SSID) and network access server identifier (NAS-ID) filters.
  6. Palo Alto Networks® Output