Segmentation Intelligence

Overview

Available from 5.3.00, segmentation intelligence is an optional paid TOS feature that measures the quality of your zone setup. It analyzes the network objects in your security policy, your security zones and their defined subnets, presenting the results in a visual and informative way. It pinpoints zone configuration caveats and deviations from common best practices and provides insights and recommendations for resolution. It provides key insights and recommendations which appear even when there are no issues for the category in which they are mentioned.

The feature is available only to users who can view all domains and have write permission to zones and USPs. The zones must be defined with subnets.

The term object or network object is used in several different places and can refer to a host, subnet, or an IP address within a security rule. Network objects with the same IP address are treated as one object, however many devices or vendors define it.

What gets analyzed?

One domain is analyzed per run; see Configure target domain for model. You can configure a different domain for the model through the CLI. See Configure target domain for model.

The network object analysis is performed only on network objects, including those contained in groups, that:

  • Participate in at least one enabled security rule which is not a NAT rule

  • Have a plain IPv4 address

  • Are on a device in the Default Domain, or in the domain set for the run.

  • Are on on-prem devices which are not OPM devices

  • It is no larger than the largest subnet to analyze as set in Configuration (default /19)

Configure target domain for model

In a multi domain environment, you can configure the tool to analyze your network segmentation on a specified domain, instead of the default domain.

  1. Log in to your TOS cluster through the CLI.

  2. Get the list of domains/customer names and their corresponding IDs:

    kubectl exec -i stolon-keeper-0 -c stolon -- psql -U postgres securetrack -h stolon-proxy -c "SELECT c.id AS customer_id, c.name AS customer_name, z.id AS zone_id, z.name AS zone_name FROM zones z JOIN customers c ON c.id = z.customer_id ORDER BY c.id, z.id;"

  3. Locate the domain/customer ID you require.

  4. Configure the target domain for the model:

    tos config set -s zone-insights-job -p CUSTOMER_ID=<customer id> -f

Recommended best practice

  • Review the segmentation intelligence graphical dashboard for a high level picture of your zone distribution. This contains sections:

    • Executive summary

    • Network coverage breakdown

    • Subnet overlap across zones

    • Network balancing

    • Subnet prefix distribution

  • Download the csv files that contain the data behind the graphs, to identify definitions that might need attention. See Data for a more detailed explanation of how these files can help you identify issues.

General functions

Three buttons appear at the top of the page:

  • Configuration - see Configuration.

  • Download - download the graphs and supporting data to your PC - see Data.

  • Refresh - rebuild the data and display the updated results.

Executive summary

The executive summary consists of five widgets each containing:

  • a graph of the percentage of affected zones

  • the number of affected zones compared to the total number of zones

  • severity based on the relative number of issues

The executive summary widgets are:

Segmentation coverage: How well your network objects are covered by zones.

Subnet overlap conflicts: Subnets from one zone containing IPs defined in another zone.

High concentration zones: Zones containing more than 25% of all network objects. Cloud and OPM devices are not currently included in the widget.

Underutilized zones: Percentage of zones containing 1% or less of all zone-object associations. When Zone analysis mode is set to Raw, this includes zones with no subnets.. Cloud and OPM devices are not currently included in the widget.

Empty subnets: Subnets with no network objects identified in TOS.

Network coverage breakdown

This graph shows how network objects are included in your defined network zones, by percentage. There are three types:

Associated: Network objects that are included in a single defined zone.

Multizone: Network objects that are included in more than one defined zone.

Unassociated: Network objects that don't appear in any defined zone.

The data behind this graph can be found in the downloaded files objects_set_up_report.csv and zone_setup.csv - see Data.

Subnet overlaps across zones

The first graph shows the percentage of subnets that overlap subnets from other zones. There are two types:

Equal: The same subnet is defined in two different zones. This appears as duplicate in subnet_relations.csv.

Contained: The subnet falls entirely inside a larger subnet that belongs to another zone.

When Zone analysis mode is set to SecureTrack root zones, overlaps between a zone and its own parent or child are not reported, because a child’s subnet is expected to fall inside its parent’s. In Raw mode (the default) they are reported like any other overlap. We recommend checking the zones_hierarchy.csv to get more insight.

The second graph is a zone matrix of with color-coded number of overlapping subnets. Hovering over the graph shows the number of overlapping subnets between the two zones.

The data behind this graph can be found in the downloaded files subnet_relations.csv and zones_hierarchy.csv - see Data.

Network balancing

The first graph - zone distribution by subnet - categorizes zones by the number and size (CIDR) of their associated subnets. The second graph - zone distribution by network coverage - shows for each zone the number of network objects that are covered by it's subnets. The numbers are further broken down into subnets that are associated with a single zone and those associated with multiple zones.

Subnet prefix distribution

The purpose of the subnet prefix distribution graph is to give you insight into the sizes you have defined for your subnets. It shows the number of subnets defined for each range of CIDR and recommends as a best practice to avoid very large subnets.

The data behind this graph can be found in the downloaded file zone_prefix_summary.csv - see Data.

Configuration

Click on the configuration icon at the top of the page.

Enter the fields as needed and save.

Field Description
Largest subnet to analyze The CIDR prefix that defines the largest network object scale to analyze. Larger subnets found on your policies will be ignored.
Zone analysis mode

Options:

  • Raw zone configuration - analyze all defined zones regardless of hierarchy or participation in USP matrix.

  • SecureTrack root zones - analyze each zone hierarchy at the root level by consolidating the subnets from all zones in the hierarchy into the root zone and displaying only the root zone.

  • Zones participating in the USP - analyze only zones that appear in USP definitions. If a participating zone belongs to a zone hierarchy, consolidate its child zones’ subnets into that zone.
Excluded zones Enter the names of any zones to ignore in the analysis or click and select from the list.
Excluded device models Start typing and select from the list any device models whose network objects you want to exclude from the analysis.
Excluded device names Start typing and select from the list any monitored devices whose network objects you want to exclude from the analysis.
Ignore external addresses

Check the checkbox to exclude all IP addresses that fall outside the private address ranges defined by RFC 1918 - 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16.

Data

When clicking on Download, the following files are downloaded as a single zip archive. The file names might vary slightly.

File objects_set_up_report.csv

Contains the list of network objects used in the analysis. All network objects with the same IP address are aggregated into a single row, regardless of device and vendor.

Column

Description

ip_address

 The object's IP address, in IP/CIDR format.
status Associated, Multizone or Unassociated as described above.
zone_names All zones in which the object is fully contained.
subnets All subnets in which the object is fully contained.
management_type One or more vendors with a device that has a network object defining this IP address.
management_name Name specified in TOS of one or more devices that have a network object defining this IP address.

display

One or more names of network objects defining this IP address, as retrieved by TOS from the device(s).

comment

One or more comments of network objects defining this IP address, as retrieved by TOS from the device(s).

Example

Recommended best practices

  • Use this data to help you understand which objects are clearly associated with a single zone, which are not associated with any zone, and which are multizone and therefore deviate from best-practice guidelines to associate objects with a single zone.

  • Make sure that every network object is fully contained in one subnet only.

File subnet_relations.csv

Contains the list of overlapping subnets i.e. subnet pairs each associated with a different zone that contain one or more of the same IPs.

Column

Description

zone

 The name of a zone in which all or part of the subnet appears (zone A).
subnet The subnet IP address in IP/CIDR format (subnet A).
zone_relation The name of another zone in which all or part of the subnet appears (zone B).
subnet_relation The other subnet IP address in IP/CIDR format (subnet B).
relation_type The relationship between the two subnets = equal or contained.

Example

Recommended best practices

  • Use this data to help you identify overlapping ranges, duplicate subnet ownership, and whether the overlap is related to a parent-child hierarchy.

  • Make sure subnet definitions don't overlap i.e. don't contain IP addresses defined in any other subnets.

  • If you do have overlapping subnets, make sure they are all defined for the same zone.

File zones_hierarchy.csv

Maps zone hierarchy by listing all defined zones, showing parent, root, and child zones.

Column

Description

zone_name

 The zone name.
parents_names The zone’s parent zones. Empty for a top-level zone.
root_parents_names The top-level ancestor or ancestors of this zone. A top-level zone lists itself.
is_root_parent TRUE when the zone has no parent, meaning it is a top-level zone, whether or not it has children.
max_depth

The level of this zone in the hierarchy i.e. its distance from the top. 0 for a top-level zone.

multi_path

TRUE when the zone has more than one parent zone.

is_single_root

TRUE when the zone has exactly one top-level ancestor.

children_names

All direct child zones.

Example

Recommended best practices

  • Use this data to help you identify overlapping ranges, duplicate subnet ownership, and whether the overlap is related to a parent-child hierarchy.

  • Make sure subnet definitions don't overlap i.e. don't contain IP addresses defined in any other subnets.

  • If you do have overlapping subnets, make sure they are all defined for the same zone.

File zone_setup.csv

Lists every zone that has subnets defined, at the top of a separate column, and beneath it, all subnets defined for it either directly or indirectly from the zone hierarchy. For zones that have other zones beneath them in the hierarchy, the parent zone appears in an adjacent column with the suffix _inherited_zone_source and beneath it, its child zones, where every subnet is adjacent to the zone it is associated with.

Example

Recommended best practices

Use this data to help you understand:

  • How zones are associated with network objects: Associated with exactly one zone, associated with more than one zone, or not associated with any zone.

  • How objects and subnets are spread across zones and identify root zones that are overly large or too small to be meaningful.

File zone_distribution_by_entities.csv

Lists the zones in which the same unique group of objects exists. Each row represents a unique group of objects together with the names of one or more zones that contain that group.

Column

Description

zone_names

 The name of one or more zones, separated by commas, in which the same group of objects exists.
objects The number of objects in the group.
n_zones The number of zones appearing in the column zone_names cell.

Example

Recommended best practices

Use this data to help you understand how objects and subnets are spread across zones and identify root zones that are overly large or too small to be meaningful.

File zone_prefix_summary.csv

Lists all zones with the number of subnets in each range of prefixes (subnet sizes).

Column

Description

name

 The name of a zone.
total_subnets The total number of subnets in the zone.
<= 19 The total number of subnets in the zone that are equal to or less than CIDR /19.
20-23 The total number of subnets in the zone that are in the CIDR range /20 to /23.
24-27 The total number of subnets in the zone that are in the CIDR range /24 to /27.

28-29

 The total number of subnets in the zone that are in the CIDR range /28 to /29.

>= 30

 The total number of subnets in the zone that are equal to or greater than CIDR /30.

public_ips

The number of subnets containing public IPs.

associated_single_zone

The number of network objects in the zone that are unique to that zone.

associated_multi_zone

The number of network objects in the zone that appear also in other zones.

associated_objects

The total number of network objects in the zone.

Example

Recommended best practices

Use this data to help you:

  • Understand how objects and subnets are spread across zones and identify root zones that are overly large or too small to be meaningful.

  • See whether subnet definitions are too broad and where finer segmentation may improve precision.

File subnets_set_up_report.csv

Lists all subnets defined in all zones, providing the number of objects contained in each and the names of the zones the subnet is associated with.

Column

Description

subnet

 The subnet definition as defined in TOS.
total_objects The number of network objects in the subnet.
zones The names of all the zones in which the subnet appears.

n_zones

The number of zones appearing in the zones cell.

prefix

The prefix of the subnet that appears in the subnet cell.

Example

Recommended best practices

Use this data to help you identify subnets that contain no objects or are otherwise not contributing meaningful value to the current segmentation model.