Palo Alto Networks, Inc.

Thomas Arthur Warburton

Shu Lin

Hao Long

Devendra Raut

Jialiang Li

Ashwath Sreenivasa Murthy

Jeffrey James Fitz-Gerald, Jr

Mingfei Peng

Jr Jeffrey James Fitz-Gerald

Techniques for providing localization at scale for a cloud-based security service are disclosed. In some embodiments, a system/method/computer program product for providing localization at scale for a cloud-based security service includes receiving a connection request at a network gateway of a cloud-based security service; performing a source Network Address Translation (NAT) from a registered set of public IP addresses associated with a tenant; and providing secure access to a Software as a Service (SaaS) using the cloud-based security service.

Localization at scale for a cloud-based security service

Techniques for providing a networking and security split architecture are disclosed. In some embodiments, a system, process, and/or computer program product for providing a networking and security split architecture includes receiving a flow at a security service; processing the flow at a network layer of the security service to perform one or more networking functions; and offloading the flow to a security layer of the security service to perform security enforcement based on a policy.

Networking and security split architecture

Some network architectures include perimeter or edge devices which perform network address translation or otherwise modify data in a network traffic packet header, such as the source address. The modification of the source address prevents downstream devices from knowing the true or original source address from which the traffic originated. To address this issue, perimeter devices can insert the original source address in an X-Forwarded-For field of the packet header. Firewalls and related security services can be programmed to record the original source address in the XFF field in addition to the other packet information and to consider the original source address during security analysis. Using the original source address in the XFF field, services can determine additional characteristics about the traffic, such as geographic origin or associated user accounts, and use these characteristics to identify applicable rules or policies.

Security policy enforcement and visibility for network traffic with masked source addresses

Security policy enforcement and visibility for network architectures that mask external source addresses

Growing community of inventors

San Jose, CA, United States of America

Thomas Arthur Warburton