PaloAlto Manager: PAN-OS security policy, NAT and VPNs

PaloAlto Manager handles security policy, NAT, objects and VPNs on Palo Alto Networks firewalls and Panorama, with every commit previewed and tied to its ticket.

REQUEST DEMO

READ THE DOCS

2501's PaloAlto Manager specialty handles Palo Alto Networks firewall work (security policy, NAT, address and service objects, and VPNs) on standalone firewalls and through Panorama, with strict commit discipline. It acts only as far as you allow.

Firewall tickets are precise and unforgiving: open this flow, add this NAT, bring up this tunnel. The change is small; getting zones, rule order and objects right, without committing someone else's pending edits, is where the risk lies.

What 2501 does

The Palo Alto specialty takes these requests from your ticketing system. It reuses existing objects, follows your naming conventions, and places new rules where the ticket says, since the first match wins. Every commit is previewed and carries the ticket reference, none is forced past a real error, and if another administrator has changes pending, it stops rather than commit them. It never deletes a rule or object that something depends on, never turns logging off, and never writes a rule from any zone to any zone.

Scope map of 2501's PaloAlto Manager: it places security policy, adds NAT rules, reuses address and service objects and brings up VPN tunnels, then previews every commit, ties it to its ticket and sends it through Panorama or to a standalone firewall; closing an approved change stays with your team, and it never commits another administrator's pending changes, deletes rules or objects in use, turns logging off or writes an any zone to any zone rule.

You stay in control

You choose the level, per specialty: investigate only, act after a person confirms, or act on its own within your rules.
The administrator account is the hard limit: give the agent its own PAN-OS administrator, with a read-only role for investigation.
Your rules decide which firewalls and changes are in scope, and destructive commands can be blacklisted outright.
On-prem, cloud or hybrid: 2501 runs wherever you do. On-prem, no data leaves your network.

Frequently asked

Does it work with Panorama? Yes. Changes to Panorama-managed firewalls go through Panorama to the right group of firewalls; standalone firewalls are committed on the firewall itself.

What if the ticket leaves out a detail? It reports what is missing, such as a VPN key or the address at the other end of a tunnel, rather than inventing it.

Can it carry out approved change requests? Yes. From ServiceNow, the default gateway, an approved change is carried out as planned, and closing it stays with your team.

Problems it handles

Each page is one kind of ticket, and how this specialty handles it within the limits you set.

A request to allow one flow on a Palo Alto firewall ends with 2501 adding the rule with its zones where the ticket says, previewing the commit and committing only its own changes

Problem

Adding a security rule on a Palo Alto firewall

On PAN-OS a commit can carry every pending change. How 2501 adds the rule your ticket asks for, previews each commit and never commits edits it did not make.

See how it is handled

PaloAlto Manager: PAN-OS security policy, NAT and VPNs

What 2501 does

You stay in control

Frequently asked

Related

Problems it handles

SEE IT ON YOUR OWN INFRASTRUCTURE