Palo Alto Networks, Inc.

Juniper Networks, Inc.

Michael Soren Jacobsen

Song Wang

Joby Menon

Martin Walter

Zhipu Jin

Wilson Xu

Shadi Rostami-Hesarsorkh

Suiqiang Deng

Philip Austin Shafer

Tong Jiang

Srinath Gutti

Greg Sidebottom

Kent A Watsen

Robert P Enns

Amro A Younes

Paulo Lima

Darren Christopher Tom

Xingang Huang

William P Welch

Craig A Bardenheuer

Sandeep Panuganti

Miaomiao Shen

Saurabh Pradhan

Nicholai Gian Piagentini

The present application discloses a method, system, and computer system for providing policy configurations. The method includes (i) receiving a set of shared policy configurations, (ii) sharing the set of shared policy configurations across a plurality of entities, and (iii) deploying the set of shared policy configurations across the plurality of entities.

Alternate means to sharing configuration across multiple firewalls or groups of firewalls

Enforcing a policy is described. A mapping between an IP address of a device and a user identity is identified at a first appliance, at least in part by correlating event information. The mapping is transmitted to a second appliance. A policy is applied by the second appliance to the device based at least in part on the user identity.

User-ID information propagation among appliances

Enforcing a policy is described. System log messages are received, via an interface, from a network device. At least a portion of the received system log messages are parsed to obtain an IP address and to obtain a user identifier. A policy to apply to a session associated with the IP address is determined, based at least in part on the user identifier. The policy is applied to the session.

Using log event messages to identify a user and enforce policies

Techniques for network-based security for mobile devices based on device state are disclosed. In some embodiments, network-based security for mobile devices based on device state includes receiving a Host Information Profile (HIP) report for a mobile device from a mobile device management (MDM) service at the security device, in which the HIP report includes device state information for the mobile device; applying a policy based on the HIP report for the mobile device and the device state; and performing access control at the security device based on the policy based on the HIP report for the mobile device.

Security policy enforcement for mobile devices based on device state

Enforcing a policy is described. Event data generated in response to a device authenticating to a node on a first network is received. A request for a resource that is external to the first network is received from the device. A mapping between an IP address of the device and a user identity is determined, at least in part by using at least a portion of the received event data. A policy is applied to the device based at least in part on the user identity.

Using events to identify a user and enforce policies

Techniques for network-based security for mobile devices based on device state are disclosed. In some embodiments, automatically configuring mobile devices and applying policies based on a Host Information Profile (HIP) report includes receiving a Host Information Profile (HIP) report for a mobile device; performing a policy match based on the HIP report for the mobile device; and performing an action based on the policy match based on the HIP report for the mobile device.

Automatically configuring mobile devices and applying policy based on device state

Techniques for detecting encrypted tunneling traffic are disclosed. In some embodiments, detecting encrypted tunneling traffic includes monitoring encrypted network communications between a client and a remote server, in which the encrypted network communications are encrypted using a first protocol (e.g., Secure Shell (SSH) protocol or another protocol for encrypted network communications); and determining if the client sends a request to create a tunnel using the first protocol with the remote server. In some embodiments, detecting encrypted tunneling traffic further includes performing an action in response to determining that the client sent a request to create a tunnel using the first protocol with the remote server.

Detecting encrypted tunneling traffic

Enforcing a policy is described. A mapping between an IP address of a device and a user identity is identified, at least in part by correlating event information. A policy is applied to the device based at least in part on the user identity. One example of an event is an access to a mail server, such as an access to a Microsoft Exchange server.

A network management system is described for assuring that a network device complies with a device-specific configuration policy. One example of the network management system contains one or more business rules that describe a business policy regarding a computer network in a network-independent form. In general, the business rules refer to high-level business requirements and not to device-specific configuration information. The network management system uses the business rule to determine which business policies are currently in force. In addition, the network management system contains one or more network design rules that describe relationship between the business policy and one or more device-specific configuration policies. The network management server uses the network design rules to determine whether to deploy a device-specific configuration policies. In this manner, an administrator or other user may create high-level business rules without regard to particular network devices or topologies, yet device-specific configuration polices are deployed to the network devices to assure compliance even if the network management system is bypassed.

Enforcement of network device configuration policies within a computing environment

A network device management application may manage a number of network devices. When managing the network devices, the management application may receive requests from administrators to modify a configuration of the network devices. In response, the management application may apply the requested modification to a model of the network device and synchronize configuration information of the model of the network device to the configuration information of the real network device using a configuration-based state machine.

Growing community of inventors

Mountain View, CA, United States of America

Michael Soren Jacobsen