Palo Alto Networks Customer Presentation November 2009 Ozan

Palo Alto Networks Customer Presentation November 2009 Ozan Ozkara

About Palo Alto Networks • Founded in 2005 by a world-class team with strong security and networking experience • Innovations: App-ID, User-ID, Content-ID • Builds next-generation firewalls that identify and control more than 850 applications; makes firewall strategic again • Global footprint: presence in 50+ countries, 24/7 support Page 2 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Applications Have Changed – Firewalls Have Not • The gateway at the trust border is the right place to enforce policy control - Sees all traffic - Defines trust boundary Need to Restore Visibility and Control in the Firewall Page 3 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Application Control Efforts are Failing • Palo Alto Networks’ Application Usage & Risk Report highlights actual behavior of 900, 000 users across more than 60 organizations - Bottom line: despite all having firewalls, and most having IPS, proxies, & URL filtering – none of these organizations could control what applications ran on their networks • Applications evade, transfer files, tunnel other applications, carry threats, consume bandwidth, and can be misused. Applications carry risks: business continuity, data loss, compliance, productivity, and operations costs Page 5 | © 2009 Palo Alto Networks. Proprietary and Confidential.

The Right Answer: Make the Firewall Do Its Job New Requirements for the Firewall 1. Identify applications regardless of port, protocol, evasive tactic or SSL 2. Identify users regardless of IP address 3. Protect in real-time against threats embedded across applications 4. Fine-grained visibility and policy control over application access / functionality 5. Multi-gigabit, in-line deployment with no performance degradation Page 7 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Identification Technologies Transform the Firewall App-ID Identify the application User-ID Identify the user Content-ID Scan the content Page 8 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Purpose-Built Architecture: PA-4000 Series RAM Content Scanning Engine Dedicated Control Plane • Highly available mgmt • High speed logging and route updates RAM RAM Content Scanning HW Engine • Palo Alto Networks’ uniform signatures • Multiple memory banks – memory bandwidth scales performance 10 Gbps RAM Dual-core CPU 1 CPU 2 CPU 3 . . RAM CPU 16 RAM HDD SSL IPSec De. Compression Multi-Core Security Processor • High density processing for flexible security functionality • Hardware-acceleration for standardized complex functions (SSL, IPSec, decompression) 10 Gbps Qo. S Control Plane Page 9 | © 2009 Palo Alto Networks. Proprietary and Confidential. Route, ARP, MAC lookup NAT 10 Gig Network Processor • Front-end network processing offloads security processors • Hardware accelerated Qo. S, route lookup, MAC lookup and NAT Data Plane

Enables Visibility Into Applications, Users, and Content Page 10 | © 2008 2009 Palo Alto Networks. Proprietary and Confidential.

PAN-OS Core Firewall Features Visibility and control of applications, users and content complement core firewall features • Strong networking foundation - Dynamic routing (OSPF, RIPv 2) - Tap mode – connect to SPAN port - Virtual wire (“Layer 1”) for true transparent in-line deployment - L 2/L 3 switching foundation • VPN - All interfaces assigned to security zones for policy enforcement - SSL VPN • Qo. S traffic shaping - Max/guaranteed and priority - By user, app, interface, zone, IP and scheduled PA-4060 • High Availability - Active / passive PA-4050 - Configuration and session synchronization - Path, link, and HA monitoring • Virtual Systems - Site-to-site IPSec VPN Page 11 | • Zone-based architecture - Establish multiple virtual firewalls in a single device (PA-4000 & PA 2000 Series only) • Simple, flexible management PA-4020 PA-2050 PA-2020 - CLI, Web, Panorama, SNMP, Syslog, XML API © 2009 Palo Alto Networks. Proprietary and Confidential. PA-500

Flexible Deployment Options Visibility • Application, user and content visibility without inline deployment Page 12 | Transparent In-Line • IPS with app visibility & control • Consolidation of IPS & URL filtering © 2009 Palo Alto Networks. Proprietary and Confidential. Firewall Replacement • Firewall replacement with app visibility & control • Firewall + IPS + URL filtering

Enterprise Device and Policy Management • Intuitive and flexible management - CLI, Web, Panorama, SNMP, Syslog - Role-based administration enables delegation of tasks to appropriate person • Panorama central management application - Shared policies enable consistent application control policies - Consolidated management, logging, and monitoring of Palo Alto Networks devices - Consistent web interface between Panorama and device UI - Network-wide ACC/monitoring views, log collection, and reporting • All interfaces work on current configuration, avoiding sync issues Page 13 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Addresses Three Key Business Problems • Identify and Control Applications - Visibility of over 850 applications, regardless of port, protocol, encryption, or evasive tactic - Fine-grained control over applications (allow, deny, limit, scan, shape) - Fixes the firewall • Prevent Threats - Stop a variety of threats – exploits (by vulnerability), viruses, spyware - Stop leaks of confidential data (e. g. , credit card #, social security #) - Stream-based engine ensures high performance • Simplify Security Infrastructure - Fix the firewall, rationalize security infrastructure - Reduce complexity in architecture and operations Page 14 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Thank You

Additional Information Speeds and Feeds, Deployment, Customers, TCO, Support, and Management

Palo Alto Networks Next-Gen Firewalls PA-4060 • • • PA-4050 10 Gbps FW 5 Gbps threat prevention 2, 000 sessions 4 XFP (10 Gig) I/O 4 SFP (1 Gig) I/O PA-2050 • • • 10 Gbps FW 5 Gbps threat prevention 2, 000 sessions 16 copper gigabit 8 SFP interfaces PA-2020 1 Gbps FW 500 Mbps threat prevention 250, 000 sessions 16 copper gigabit 4 SFP interfaces Page 17 | • • • 500 Mbps FW 200 Mbps threat prevention 125, 000 sessions 12 copper gigabit 2 SFP interfaces © 2009 Palo Alto Networks. Proprietary and Confidential PA-4020 • • • 2 Gbps FW 2 Gbps threat prevention 500, 000 sessions 16 copper gigabit 8 SFP interfaces PA-500 • • 250 Mbps FW 100 Mbps threat prevention 50, 000 sessions 8 copper gigabit

Leading Organizations Trust Palo Alto Networks Health Care Financial Services Government Media / Entertainment / Retail Service Providers / Services Page 18 | Mfg / High Tech / Energy © 2009 Palo Alto Networks. Proprietary and Confidential Education

Fix The Firewall – and Save Money! Capital cost – replace multiple devices • Legacy firewall, IPS, URL filtering device (e. g. , proxy, secure web gateway) - Cut by as much as 80% “Hard” operational expenses • Support contracts Subscriptions Power and HVAC - Save on “soft” costs too • - Page 19 | Rack space, deployment/integration, headcount, training, help desk calls © 2009 Palo Alto Networks. Proprietary and Confidential. Cut by as much as 65%

Legendary Customer Support Experience • Strong TSE team with deep network security and infrastructure knowledge - Experience with every major firewall - TSEs average over 15 years of experience • TSEs co-located with engineering – in Sunnyvale, CA • Premium and Standard offerings • Rave reviews from customers Page 20 | © 2007 2009 Palo Alto Networks. Proprietary and Confidential. Customer support has always been amazing. Whenever I call, I always get someone knowledgeable right away, and never have to wait. They give me the answer I need quickly and completely. Every support rep I have spoken with knows his stuff. -Mark Kimball, Hewlett-Packard Customer support has been extraordinarily helpful – which is not the norm when dealing with technology companies. Their level of knowledge, their willingness to participate – it’s night and day compared to other companies. It’s an incredible strength of Palo Alto Networks. -James Jones, UPMC

Single-Pass Parallel Processing (SP 3) Architecture Single Pass • Operations once per packet - Traffic classification (app identification) - User/group mapping - Content scanning – threats, URLs, confidential data • One policy Parallel Processing • Function-specific parallel processing hardware engines • Separate data/control planes Up to 10 Gbps, Low Latency Page 21 | © 2009 Palo Alto Networks. Proprietary and Confidential.

Comprehensive View of Applications, Users & Content • Application Command Center (ACC) - View applications, URLs, threats, data filtering activity • Mine ACC data, adding/removing filters as needed to achieve desired result Filter on Skype Page 22 | Filter on Skype and user oharris © 2009 Palo Alto Networks. Proprietary and Confidential. Remove Skype to expand view of oharris