Asset & Anomaly Detection - APCL logging

[TheRealDiZ]

Hey guys,

I just need some tips in order to start with an IoT deployment.

I need to gain informations about network traffic/protocol and app that are used in a specific environment.

Traffic is passing through R80.20 cluster.

The goal is to provide a better security for network traffic related to air conditioning systems/video surveillance systems.

Tried first to enable an ordered layer to log the application traffic with a rule :

For now it seems the firewall is only able to log "ICMP Proto" application.

So I'm assuming the layer is working properly and the app control is working properly as well.

By the way do you have any idea/tips?

Do you think that an AAD Management on a dedicated machine will help?

I was trying to to imagine a scenario where we configure a span port on the core switch in order to forward the traffic to AAD.

Do you think is it possible and is it a good idea in order to gain visibility?

Let me know guys I hope someone can share his experience in this area.

Thanks in advance

D!Z

[PhoneBoy]

Unless you have the Log field set at Detailed or Extended, App Control won't be fully activated with that particular rule.
We have several integrations with AAD vendors that work on that same basic premise (they listen for types of traffic and they tag hosts via the IDA API).