This document discusses security options for branch locations that have different needs than corporate headquarters. It notes that a one-size-fits-all approach does not work well due to variations in factors like employee count, sites, bandwidth needs, applications, IT staffing, and budgets across locations. It presents three main options: hardware firewalls at each branch, virtualized firewalls running on SD-WAN edge devices, and using Palo Alto Networks' GlobalProtect cloud service. For each option, it outlines considerations around deployment, administration, use cases, and key advantages and limitations. It concludes by listing several important questions to evaluate for determining the best branch security approach, such as location characteristics and networking configuration.

1. Secure Your Branch

2. Different Locations have Different Needs
• # of Employees
• # of Sites
• Bandwidth
Requirements
• Applications
• IT Staffing
• Capital Expense
Budgets
• Operational
Budgets
2 | © 2018, Palo Alto Networks. All Rights Reserved.
Headquarters Branch offices Retail store
It’s not one size fits all.

3. Corporate HQ
Challenges with Traditional Hub & Spoke WAN
• Branch sites connect via MPLS
• Optimized for reliable connections
to an internal data center
• Centralized firewall secures
internet traffic
• Networking not optimal for
internet/cloud access
Internet
Branch office
MPLS
Internet
Branch
Router

4. Insecure Breakout at the Branch
• Direct path to the cloud
• Branch UTMs and proxies deliver much less
security
• Security fragmentation at different locations
• More administration, higher staffing costs
Internet
Branch office
Internet
UTM
Cloud Proxy
for HTTP
Branch
Router
Non-
HTTP

5. Options for the Branch

6. Branch Solutions from Palo Alto Networks
6 | © 2018, Palo Alto Networks. All Rights Reserved.
Hardware Firewall
Virtualized Firewall (VM-
Series)
GlobalProtect cloud
service
Deployment
Security appliance at the
branch
Runs as a VNF on SD-WAN
Edge Device
Integrates with a tunnel to on-
prem branch router or SD-
WAN fabric
Administration Customer managed Customer Managed
Customer policies on cloud
service managed by Palo Alto
Networks
Use Case
Full control over device for
local network segmentation,
high performance, flexible
network insertion
For secure internet breakout
at the branch without on-
prem security appliance
Consistent security with
predictable operational cost

7. Hardware Firewalls at the Branch
• Direct internet for local breakout
• Same security policies as HQ
• Integration with on-prem hardware, internal
network segmentation, multiple zones, VLAN
support
• Branch may not have technical staff
• Need resources to handle hardware
replacements / cold spares / upgrades
Internet
Branch office
Internet
Branch Router /
SD-WAN Edge
Device
Palo Alto
Networks
NGFW

8. GlobalProtect Cloud Service
• Full stack security
without the backhaul
to a corporate firewall
• Does not require an
on-prem security
appliance
• Unlike other branch
solutions, inspects all
traffic, bidirectionally
Branch office
Internet
Internet
Branch to GlobalProtect cloud service
Branch Router
or SD-WAN
Edge Device

9. Corporate HQ
Virtualized Firewall on SD-WAN Edge
SaaS
Internet
IPSEC
Internet
Branch office
SD-WAN
• Organization manages the VMs in the CPE
• Does not necessarily provide full access to
the interfaces (i.e. often implemented as a
service chain)
• Maintains full visibility and optimal SD-WAN
performance
• Can be mixed with GPCS integration use
cases
SD-WAN
Edge

10. Key Questions in Branch Security
10 | © 2018, Palo Alto Networks. All Rights Reserved.
Question Key Decisions
How many branch locations do you
have?
Sending IT staff or consultants to handle maintenance and upgrades at
each location can be time consuming and slow.
How many users are at each of these
locations?
If your site doesn’t have on-site technical staff (or is not large enough to
justify hiring one), then on-prem maintenance may be difficult.
Where are your branches located? Location may make the logistics of deploying hardware more
challenging.
What applications do your users need
at these locations?
High bandwidth requirements may require local appliances for high
performance.
What services are operating at the
location?
If you want to do network segmentation or zero trust, it makes sense to
do local enforcement of policy.
How are you networking the
branches?
Organizations using SD-WAN may need to consider from a range of
security deployment options.

11. Example:
Post-Merger Security
Operations

12. Corporate HQ
Example of Mixed Operating Environments: Post-Merger Operations
• Company inherits an entirely different security
environment from the acquisition
• Standardizing on one security environment
takes time to replace boxes
• Different security posture at different locations
Branch
Company using Palo Alto Networks Acquired Company using Another Firewall Vendor
Branch Branch Branch Branch

13. Mergers and Acquisitions
• Quickly standardize security policy by onboarding
sites to GlobalProtect cloud service
• Other vendor’s boxes can be left in place, or swapped
out to Palo Alto Networks hardware in the future
Corporate HQ
Branch Branch Branch Branch Branch
Company using Palo Alto Networks Acquired Company using Another Firewall Vendor

14. THANK YOU