Large Scale Juniper SRX to Palo Alto Firewall Deployment SOW

Statement of Work

Large-Scale security posture change from “Permit All” to “Deny All” with a transition from Juniper SRX firewalls to Palo Alto firewalls.   Analyze over 100,000 daily traffic flows using PAN Expedition for the creation of new specific userID, appID rulesets.

Integration Guidelines

Traffic Analysis with Gigamon and Palo Alto Expedition Tool

  1. Configure Gigamon to send/mirror ‘clean’ CORE traffic to logging server for analysis.
  2. Configure PAN firewalls to export logs to Expedition server
  3. Configure Expedition to ingest traffic logs.

Traffic Flow and Firewall Rules Analysis

  1. Refine existing legacy packet filter Security Policies for one (1) Juniper SRX firewall pair:
    1. Configure daily log exports on one (1) Palo Alto firewall to the verified working Expedition server
  2. Perform iterative analysis of exported firewall logs to produce security policy rules
  • Create net new security policies based on manual effort, log ingestion, and Expedition machine learning
  1. Analyze CORE traffic logs and patterns for the purpose of creating new rules to permit legitimate CORE traffic through the firewall.
  2. Present and review the current CORE traffic logs to ABank personnel to determine legitimate vs. illegitimate traffic.
  3. Create a draft of new security rulesets–Layer 7 rulesets will be priority with L3/4 rulesets being used as necessary.

Staging and Configuration PAN Firewalls in HA mode

  1. Onsite – Stage new PAN firewalls for integration into the ABank network
  2. Onsite – Configure management interface and routing functionality (if necessary) to receive CORE traffic
  • Perform PAN-OS upgrade, dynamic updates, licensing updates and content database update
  1. Configure PAN IDS/IPS, Threat Prevention and Wildfire to default best practice posture (tuning is not included)
  2. Configure new rule sets between CORE and ABank zones on new PA-5280 HA pair at Zayo data center and existing PA-5220 HA pair at ABank data center.
  3. PAN firewall policies to be configured and pushed from existing ABank Palo Alto Networks Panorama.

Cutover Production Traffic

  1. Export Staged Palo Alto firewall policy configuration to HA pair
  2. Perform PAN-OS upgrade, dynamic updates, licensing updates and content database updates
  3. Perform Palo Alto current best practices configuration
  4. A checklist will be sent to CLIENT for approval as some of these best practices may exceed CLIENT Information Security Policy (ISP) and audit requirement
  5. Perform cutover from SRX firewall to Palo Alto firewall:
    1. Cleary define success criteria with CLIENT and engage stakeholders to perform validation testing
    2. Schedule Internet service provider technician to clear ARP if circuit(s) terminated on layer-2 device
    3. Perform HA validation testing
View & Download