Topic starter
11/07/2026 1:57 pm
TL;DR: Manual Dynamic Address Group maintenance turns firewall teams into a human API between discovery and policy enforcement, and industry data cited by Elisity shows 70-80% of large-enterprise firewall rules are outdated or redundant. Identity-based classification changes the control model, but only if device identity is enriched continuously across tools and lifecycle states.
Editorial analysis by NHI Mgmt Group, based on content published by Elisity: “How to Automate Palo Alto Networks Dynamic Address Groups with Identity-Based Classification”.
By the numbers:
- 70-80% of firewall rules in large enterprises are outdated, redundant, or no longer serving their original purpose, based on firewall optimization vendor data cited by Elisity.
- Elisity says organizations automating DAG population with identity-based classification reported a 75% reduction in firewall management overhead.
- CrowdStrike's 2025 Global Threat Report puts the average eCrime breakout time at 29 minutes from initial compromise to lateral movement.
Key questions
Q: What breaks when Dynamic Address Groups are updated manually?
A: Manual updates fail when device mobility, DHCP, and asset churn outpace the change window.
Q: Why do unmanaged devices create so much segmentation risk in firewall environments?
A: Unmanaged devices often lack reliable records in EDR, AD, or CMDB systems, so IP-based grouping becomes a weak proxy for real identity.
Q: How do you know if automated DAG population is actually working?
A: Look for synchronized group membership across discovery sources, low rates of stale or orphaned devices, and fewer manual exceptions in firewall operations.
Practitioner guidance
- Define device identity sources before automating DAGs Inventory which systems can contribute trustworthy attributes for managed endpoints, OT assets, IoMT devices, and shadow devices before you map anything into firewall policy groups.
- Set a minimum confidence threshold for classification Require corroboration from more than one source for devices that will be placed into enforcement-critical groups, especially where unmanaged assets or shared devices are involved.
- Separate policy authorship from group maintenance Keep rule design in the firewall workflow, but move group population to a classification layer so analysts stop performing manual IP-to-device updates as a recurring task.
Bottom line: Manual DAG upkeep creates a gap between what the firewall thinks a device is and what it actually is on the network.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:07 pm
Identity-based classification is now a governance problem, not just a firewall automation problem. The real issue is whether device identity can be kept current enough for segmentation to remain trustworthy. When firewall policy depends on manual mapping, the organisation is effectively asking humans to perform continuous identity resolution at machine speed. Practitioners should treat DAG population as an identity lifecycle control, not an operational convenience.
A question worth separating out:
Q: Should security teams keep Panorama centralised or push DAGs directly to firewalls?
A: Use Panorama when you need consistent inheritance across many firewalls and already operate a central management model. Use direct firewall publication when edge or standalone sites need local control. The right answer depends on whether consistency or per-site independence is the stronger operational requirement.
👉 Read our full editorial: Identity-based classification is reshaping Palo Alto DAG automation