About kiwi

Prisma Access SASE Security (EDU-118)   Introducing Prisma Access SASE Security (EDU-118) Prisma Access by Palo Alto Networks is the leading SASE solution in the industry today, and it delivers the networking and security that organizations need in an architecture designed for all traffic, all applications, and all users. Rather than creating single-purpose technology overlays that are normally associated with point products, Prisma Access uses a common cloud-based infrastructure to deliver security services, including advanced threat prevention, web filtering, sandboxing, DNS security, credential theft prevention, DLP, and next-generation firewalling.    At Palo Alto Networks, we offer training videos for Prisma Access SASE Security—our EDU-118 course. For more information about the Prisma Access SASE Security (EDU-118) class or to register, please log into Beacon using the following link: Beacon.   The course collection can be found here: Prisma Access (SASE) on Beacon.   The above training covers the role of Prisma Access in cybersecurity, and it provides information about the advanced threat protection capabilities of the product, and the steps necessary to prepare an environment to activate the service. The training also describes the different security approaches available to remote networks and mobile users.    The image below illustrates some of the online classes that are available for Prisma Access.   Prisma Access SASE Security Courses       Our very own LIVEcommunity YouTube channel also has a set of Prisma Access configuration tutorial videos that can be very helpful for you. Below are just a few of the available videos.    For more information about Prisma Access, including articles, discussions, videos, and news, please visit the Prisma Access LIVEcommunity page.   The LIVEcommunity provides you with up-to-date information as soon as it comes out. Below are a few more resources, including a videos dedicated to Prisma Access.   You review our playlist with Prisma Access Videos on our YouTube channel here: Prisma Access EDU-118 Playlist. Below are some of the videos you will also find our our Prisma Access playlist.   Prisma Access EDU-118 Bulk Remote Networks Onboarding   Prisma Access EDU-118 Mobile User Onboarding   Prisma Access EDU-118 User Authentication   Prisma Access LightBoard Series: Designed in the Cloud for Security and Performance     Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.   As always, we welcome all comments and feedback in the comments section below.   Stay Secure, Kiwi out!   ... View more

Reducing Management Plane Load Palo Alto Networks knows very well how additional remote users can slow down your web interface. The LIVEcommunity shows you how to reduce the management plane load with good tips and tricks. Find answers on LIVEcommunity.     Last week, I outlined how to reduce the management plane (MP) load with some tips and tricks. Let's continue with a few more tips that you can add to your bag of tricks to reduce the load on the management plane.   A common cause for a high load on the management plane are automated processes running in the background. Some of those can be tuned to happen less frequently if they are causing issues. One of these processes is the periodic refresh of FQDN objects used in the policy. These will trigger DNS lookups to refresh the associated IP addresses. If the management plane is already taxed, it could cause spikes. The frequency can be decreased by setting the refresh time to a longer timeframe, up to four hours for regular refreshes and 24 hours for a full refresh.   > configure Entering configuration mode [edit]                                                                           # set deviceconfig system fqdn-refresh-time <600-14399> # set deviceconfig system fqdn-forcerefresh-time <14400-86400>   Last week, I also discussed disabling logging for certain applications that are very chatty but do not necessarily require extensive logging. This can also be applied to more generic rules like intrazone policies where traffic logging may not be essential.   Policies that require detailed logging should have only logging at end enabled, as log at session start could cause several logs to be generated for a single session. WebEx, for example, may change several times over the course of a session—from TLS/SSL to web-browsing, to WebEx, to WebEx Desktop, and so on. This will create several logs at start log entries, one for every time the session shifts into a different application.   In larger or more complex LDAP environments, User Identification and, more specifically, group mapping can put a significant strain on the system when large amounts of group objects are loaded onto the firewall. Decreasing the amount of group objects by filtering out the LDAP query results to only the groups used in policy can also decrease the load on the management plane.   To accomplish this, after creating an LDAP profile to retrieve LDAP information from a server,  a User Identification Group Mapping filter can be created   User Identification > Devices > Group Mapping Settings   Additional filters can be added, so only users and groups containing the appropriate entries are stored. In the example below, users need to have the string 'WebUser' in their description field to get added.   Group Mapping where Search Filter is Description=webuser   Specific groups can also be selected as a sole source of user information.   Group Include List   Here is another trick to reduce the MP load, as a best practice during times of high load. It may be beneficial for administrators to not have the ACC or log monitoring open and set to auto refresh, as this queries the log database and recompiles the output on screen every few seconds.   I hope these tips will come in handy and help you keep the load down on your firewall's management plane.   Thanks for taking time to read the blog. If you enjoyed this, please hit the Like (thumbs up) button, don't forget to subscribe to the LIVEcommunity Blog.   As always, we welcome all comments and feedback in the comments section below.   Stay Secure, Kiwi out!   ... View more