Managed Firewall Service for NC K-12 PSUs

All NC K-12 PSUs are eligible for this service.
Migration for PSUs that are currently using the NCDIT Cisco Firewall platform and PSUs pending bandwidth upgrades > 2 Gbps will be prioritized to this new service.
PSUs not currently utilizing the NCDIT Cisco Firewall platform can enroll in this service by contacting MCNC and PSU will be added to the onboarding schedule prioritized on a case by case basis.

Palo Alto Networks firewalls classify network traffic by the application’s identity in order to grant access to users and provide visibility and control of all types of applications to admins, including web applications, software-as-a-service (SaaS) applications and legacy applications. The PAN approach uses the application, not the port, as the basis for all safe enablement policy decisions, so firewall administrator can allow, deny, schedule, inspect and apply traffic-shaping.

Service includes a physical/on-premise based Palo Alto Networks Next-Generation Firewall (NGFW).

Service includes the PAN Advanced Threat Prevention license

Palo Alto Networks Threat Prevention service protects your network by providing multiple layers of security, confronting threats at each phase of an attack. It includes comprehensive exploit, malware, and command-and-control protection, and Palo Alto Networks frequently publishes updates that equip the firewall with the very latest threat intelligence.

This service is fully managed by MCNC 24x7x365. PSU will be granted read-only access to the Palo Alto Networks Panorama management tool to review logs and device configuration information. This level of access will ensure a standard level of security will be maintained. A PSU self-managed service offering is not currently available but is under consideration. A co-managed solution is not under consideration at this time.

At this time, no additional PAN licenses, including the URL filtering license can be added to MCNC’s managed service offering. Through MCNC and NCDPI, PSUs have access to additional no-cost solutions to address additional security controls. For example, SSL decryption and URL filtering can be managed via MCNC’s Zscaler solution. Endpoint security protection can be provided by MCNC’s Managed Endpoint Protection service powered by CrowdStrike. Please reach out to securityservices@mcnc.org to discuss utilizing any of the other MCNC security services to address these other security controls.

MCNC managing a PSU owned firewalls is not under consideration at this time due MCNC prioritizing the DIT Cisco ASA service migration. MCNC may consider this option after the migration project is complete, and will communicate if this becomes available in coordination with NCDPI.

1 year of NGFW Event Logs stored off-site from PSU premise and available for review by PSU via Palo Alto Networks Panorama Platform.