Palo Alto Data Redistribution and HIP - Step-by-Step

Your GlobalProtect gateway holds rich HIP posture data — antivirus state, disk encryption, patch level — but every other firewall in your fleet is blind to it. In this tutorial we wire up PAN-OS 11.x Data Redistribution so a single GP gateway becomes a Collector, and any datacenter or branch firewall pulls HIP data as an Agent — with TLS handled automatically and trust based on a Collector Name + Pre-Shared Key.

By the end you'll have posture-aware policy enforced on a firewall that never terminates a GP tunnel.

What you'll learn:
• How HIP Data Redistribution actually works (Collector vs Agent — the part the docs make confusing)
• Configure Collector Settings on the GP gateway (port 5007, PSK, no manual certs)
• Add a Data Redistribution Agent on a datacenter firewall and subscribe to HIP
• Verify the channel from both sides — GUI + CLI (show redistribution service client / show redistribution agent state all)
• Build local HIP Objects and HIP Profiles on the receiving firewall — and why they're independent of the gateway
• Write Allow / Deny security policy driven by HIP Profile match
• Test compliant vs non-compliant endpoints and read the right logs (Monitor → HIP Match vs Monitor → Logs → Traffic)
• Common silent-failure trap: mismatched Pre-Shared Key

Chapters:
00:00 Intro — why HIP data needs to travel
00:48 Architecture: Collector + Agent + Pre-Shared Key
02:48 Step 1 — Configure the Collector (GP gateway)
03:41 Step 2 — Add the Redistribution Agent (datacenter firewall)
05:50 Step 3 — Verify the channel (GUI + CLI)
08:13 Step 4 — Create the HIP Object and HIP Profile
10:17 Step 5 — Security policy rules
11:44 Step 6 — Test compliant vs non-compliant
13:13 Wrap-up

Who this is for:
Network security engineers running Palo Alto Networks NGFWs who want HIP-based enforcement on internal segmentation, datacenter, or branch firewalls — without replicating GlobalProtect across every box.

PAN-OS version: 11.x (works on 10.2 with minor menu differences)

If this saved you a license-budget conversation — like, subscribe, and drop in the comments how many firewalls in your fleet could consume this data.

#PaloAlto #PANOS #GlobalProtect #HIP #NetworkSecurity #Cybersecurity #Firewall #ZeroTrust #DataRedistribution #EnterpriseSecurity
Disclaimer: This video is for educational and news purposes only. All information presented is to help viewers understand security vulnerabilities and how to protect themselves. We do not encourage or condone illegal hacking or unauthorized access to any system.

Видео Palo Alto Data Redistribution and HIP - Step-by-Step канала marIA