Palo Alto Networks, Inc.

Venkata Sarat Kumar Vajrapu

Anil Kumar Reddy Sirigiri

Nagaraj Bagepalli

Arivu Mani Ramasamy

Gong Cheng

Arun Kumar Palani

Madhusudhan Donthi Nagaraju

Bala Gautama

Arunkumar Mutharasanallur Desigan

Vamsidhar Valluri

Increasing use of web-based applications or Software-as-a-Service and IoT devices within enterprise networks increases the variety of network traffic and variables for consideration in managing security posture, which includes policy management. A security posture management system as disclosed herein leverages application identification and device discovery from ongoing collection and analysis of network traffic data to manage policies at device granularity allowing tailored security posture management. The system can tailor policies to handle network traffic depending on identified application and device type inputs obtained from the ongoing collection and analysis. The security posture management system can configure SD-WAN construct based parameters of a policy to tailor policies for different application traffic from different types of devices.

SD-WAN IOT security posture management

A network controller in an overlay network maintains collective sets of identity-based policies and identity mappings for onboarded users of the network for informed distribution to network elements across the network. As new users are onboarded, the controller identifies a site of the network at which the user was onboarded and determines identity mappings of the user and applicable policies for distribution to a network element at the identified site. The controller assigns index values to each identity and communicates the indices to network elements with the corresponding identity mappings and policies. The network elements encapsulate cross-site traffic with the index values corresponding to senders so recipient network elements can obtain the index value from encapsulation header formats, query the controller for the corresponding identity mappings, and apply policies to the traffic that are determined to be pertinent based on the sender's identity mappings obtained from the controller.

Scalable distribution of identity information in overlay networks with identity-based policies

Growing community of inventors

Bengaluru, India

Venkata Sarat Kumar Vajrapu