9.2 Host Information Profile (HIP) & Dynamic Split Tunneling

9.2 Host Information Profile (HIP) & Dynamic Split Tunneling

Host Information Profile (HIP) Architecture

In a Zero Trust security model, user identity alone is insufficient to grant access to sensitive enterprise assets. An authenticated user operating a compromised, unpatched, or unencrypted endpoint presents a severe risk of lateral malware infection and data exfiltration. Host Information Profile (HIP) is Palo Alto Networks' endpoint posture assessment framework that continuously evaluates device health and enforces policy compliance directly at the firewall dataplane.

+-----------------------------------------------------------------------------------+
|                             HIP TELEMETRY PIPELINE                                |
|                                                                                   |
| 1. Endpoint Sensor   --> GlobalProtect app scans local OS via OPSWAT APIs         |
| 2. XML Compilation   --> Compiles hardware, patch, EDR, and encryption state      |
| 3. Submission        --> Sends encrypted HIP XML report to Gateway over TLS       |
| 4. Ingestion         --> Gateway parses XML and matches against HIP Objects       |
| 5. Profile Synthesis --> Evaluates Boolean expressions (AND / OR / NOT)           |
| 6. Rule Matching     --> Dataplane matches Security Policy rules using HIP Profile|
| 7. Enforcement       --> Grants access to sensitive tier; quarantines non-complian|
+-----------------------------------------------------------------------------------+

The HIP Telemetry Pipeline

1. Data Collection: The GlobalProtect application contains an integrated endpoint posture engine (leveraging OPSWAT multi-platform libraries and native OS APIs). It scans the local host to discover installed software, active processes, registry entries, and security configurations.
2. Report Generation: The app generates a structured, encrypted XML document known as the HIP Report. This report contains comprehensive telemetry:
   • Computer name, domain name, host ID, and network interface MAC addresses
   • OS vendor, kernel version, build number, and service pack level
   • Anti-malware software vendor, engine version, real-time protection state, and signature definition timestamp
   • Disk encryption vendor, drive letters, and volume encryption status
   • Personal firewall status and active network profiles
   • Patch management state and missing security updates
   • Custom Windows registry keys/values, macOS plist entries, or installed digital certificates
3. Submission to Gateway: The GlobalProtect app transmits the encrypted HIP report to the connected GlobalProtect Gateway over the established management control channel.
4. Report Evaluation & Profile Matching: The Gateway decrypts and parses the XML report. It evaluates the raw data against administrator-defined HIP Objects. It then synthesizes these objects into HIP Profiles using Boolean logic.
5. Dataplane Session Binding: The firewall dynamically binds the matched HIP Profiles to the client's active session state in the dataplane session table.
6. Periodic Refresh: The GlobalProtect app automatically resubmits a refreshed HIP report on a configurable schedule (default every 60 minutes) or immediately upon detecting a network configuration change (such as an IP address change or adapter reconnect).

---

HIP Objects: Granular Compliance Criteria

A HIP Object defines the specific criteria that an endpoint must satisfy within a distinct operational category. PAN-OS provides broad categories for granular inspection:

Best-Practice Definition Verification

A frequent vulnerability in endpoint compliance is accepting an anti-virus agent that is installed but functionally dormant or carrying severely outdated threat signatures. In PAN-OS, an Anti-Malware HIP Object should always be configured with dual requirements: Real-Time Protection: Enabled and Version: Updated within 3 days (or 72 hours). This prevents devices with expired signatures from passing posture validation.

---

HIP Profiles: Boolean Logic & Zero Trust Enforcement

While HIP Objects define single-attribute checks, real-world zero-trust policies require multi-attribute compliance. A HIP Profile evaluates one or more HIP Objects using Boolean operators (AND, OR, NOT).

                               +----------------------------+
                               |  HIP Profile: Corp-Secure  |
                               +----------------------------+
                                             |
                   +-------------------------+-------------------------+
                   |                         |                         |
                   v                         v                         v
        [HIP Object: Win11-OS]    [HIP Object: BitLocker]   [HIP Object: CrowdStrike]
                   |                         |                         |
                   +------------ AND --------+----------- AND ---------+
                                             |
                                             v
                                   AND NOT [Jailbroken-OS]

Boolean Expression Mechanics

• Conjunction (AND): Requires the endpoint to satisfy all specified objects:
  [ Win11-Enterprise AND BitLocker-Encrypted AND EDR-Active ]
• Disjunction (OR): Permits alternative compliance paths (e.g., accommodating multi-platform environments):
  [ (Win11-Enterprise AND BitLocker-Encrypted) OR (macOS-Sonoma AND FileVault-Encrypted) ]
• Negation (NOT): Explicitly disqualifies endpoints exhibiting prohibited attributes:
  [ Corp-Approved-Laptop AND NOT (Missing-Critical-Patches OR P2P-Software-Installed) ]

Enforcing Zero Trust in Security Policy Rules

Once configured, HIP Profiles are referenced directly within PAN-OS Security Policy Rules in the Source > Device / HIP Profile criteria tab:

Rule 1: Allow-Finance-PCI
  Source Zone:      VPN-Remote-Access
  Source User:      finance-team
  HIP Profile:      Corp-Compliant-Finance-Profile  <-- Strict Posture Check
  Destination Zone: PCI-Cardholder-Data
  Application:      oracle-financials, ssl
  Action:           ALLOW

Rule 2: Quarantine-NonCompliant
  Source Zone:      VPN-Remote-Access
  Source User:      finance-team
  HIP Profile:      any (or Non-Compliant-Profile)
  Destination Zone: Remediation-VLAN
  Application:      web-browsing, ssl, ms-update
  Action:           ALLOW (Redirect to IT remediation portal)

Rule 3: Deny-All-Other-VPN
  Source Zone:      VPN-Remote-Access
  Destination Zone: Any
  Action:           DENY

Dynamic Enforcement & User Notifications

HIP enforcement operates dynamically in real time:

• If an employee connects to GlobalProtect while fully compliant, they immediately hit Rule 1 and access financial databases.
• If the employee subsequently disables their Windows Defender Firewall or their EDR agent crashes, the next scheduled or event-driven HIP report notifies the Gateway.
• The Gateway instantly removes the Corp-Compliant-Finance-Profile tag from the client's session state. Subsequent packets sent toward the PCI zone immediately fail Rule 1, falling through to Rule 2 (quarantine/remediation) or Rule 3 (deny).
• User Notification Messages: Administrators can configure custom pop-up dialog messages within the GlobalProtect Portal and Gateway. When access is denied due to a HIP failure, the app displays a specific message explaining why the device is blocked (e.g., "Access denied: Your BitLocker disk encryption is currently disabled. Please enable BitLocker and retry.").

---

Dynamic Split Tunneling: Bandwidth Optimization

Full Tunneling vs. Split Tunneling Dilemma

Historically, enterprise remote access enforced Full Tunneling, routing 100% of remote user traffic through the corporate firewall. While providing total security visibility, full tunneling creates severe network inefficiencies in the cloud and SaaS era: high-bandwidth entertainment traffic (Netflix, YouTube) and latency-sensitive collaboration streams (Zoom, Microsoft Teams, WebEx) traverse corporate Internet pipes, saturating firewall bandwidth, driving up transit costs, and degrading call quality.

Traditional split tunneling relied exclusively on static destination IP/CIDR inclusion or exclusion lists. However, modern SaaS platforms and CDN networks utilize thousands of dynamically changing IP addresses across globally distributed networks, rendering static IP access lists unmaintainable.

Dynamic Split Tunneling Architecture

Palo Alto Networks resolves this challenge with Dynamic Split Tunneling, allowing granular traffic steering based on four distinct mechanisms:

                              +--------------------------+
                              |   GlobalProtect Client   |
                              +--------------------------+
                                     /     |     \
      +-----------------------------+      |      +---------------------------+
      | (Split by App Process)             | (Split by Domain)                | (Included Subnets)
      v                                    v                                  v
[zoom.exe / teams.exe]             [*.sharepoint.com]                 [10.0.0.0/8, 172.16.0.0/12]
Direct to Local ISP Router         Direct to Local ISP Router         Encapsulated in IPsec/SSL
(Bypasses Gateway)                 (Bypasses Gateway)                 Terminates at Corporate GW

Application Process Split Tunneling Mechanics

Application process split tunneling operates at the endpoint operating system level through the GlobalProtect virtual network driver:

1. The administrator specifies client binary names in the Portal Client Configuration (e.g., zoom.exe, teams.exe for Windows; zoom.us for macOS).
2. When the user starts a Zoom meeting, the GlobalProtect driver inspects the local process that opened the network socket.
3. Recognizing zoom.exe, the driver binds the socket to the endpoint's physical network adapter rather than the GlobalProtect virtual adapter.
4. All voice and video media packets flow directly across the user's local ISP Internet connection, achieving the lowest possible latency while completely offloading corporate gateway resources.

Exam Trap Alert: Domain-based split tunneling (FQDN) is resolved directly on the client endpoint, not by the firewall. When a remote worker queries an excluded FQDN like *.dropbox.com, the GlobalProtect app intercepts the DNS response returned by the DNS server, reads the resolved IP address, and dynamically adds a temporary host route pointing to the local physical gateway. If an enterprise uses an internal DNS proxy that alters or redirects public domain resolutions, domain split tunneling may fail to steer traffic correctly.

---

Diagnostic Verification & CLI Inspection

# Display detailed HIP report telemetry submitted by a specific endpoint
admin@PA-3410> debug user-id dump hip-report computer LAPTOP-104 user corp\jsmith

# View the parsed HIP attributes and active profile matches for a host
admin@PA-3410> debug user-id dump hip-profile-database

# Verify active security policy rules and associated HIP profile constraints
admin@PA-3410> show running security-policy

# Check connected GlobalProtect users and their current assigned IP and client OS
admin@PA-3410> show globalprotect-gateway current-users gateway GP-GW-External