Notifications
Clear all
Topic starter
11/07/2026 1:57 pm
TL;DR: Manual Dynamic Address Group maintenance turns firewall teams into a human API between discovery and policy enforcement, and industry data cited by Elisity shows 70-80% of large-enterprise firewall rules are outdated or redundant. Identity-based classification changes the control model, but only if device identity is enriched continuously across tools and lifecycle states.
NHIMG editorial — based on content published by Elisity: How to Automate Palo Alto Networks Dynamic Address Groups with Identity-Based Classification
By the numbers:
- 70-80% of firewall rules in large enterprises are outdated, redundant, or no longer serving their original purpose, based on firewall optimization vendor data.
- 29 minutes : average eCrime breakout time from initial compromise to lateral movement.
- 75% reduction in firewall management overhead reported by organizations automating DAG population with identity-based classification.
Questions worth separating out
Q: How should security teams automate Dynamic Address Groups without losing policy control?
A: Automate Dynamic Address Groups by separating discovery, classification, and publication.
Q: Why do unmanaged devices create so much segmentation risk in firewall environments?
A: Unmanaged devices often lack reliable records in EDR, AD, or CMDB systems, so IP-based grouping becomes a weak proxy for real identity.
Q: What breaks when Dynamic Address Groups are updated manually?
A: Manual updates fail when device mobility, DHCP, and asset churn outpace the change window.
Practitioner guidance
- Map every device class to an authoritative identity source Document which platform owns each identity attribute used for classification, including model, owner, posture, location, and trust.
- Separate policy design from address maintenance Keep security policy ownership with firewall teams, but move group membership maintenance into automated identity enrichment so administrators are not manually reconciling IP changes.
- Set approval rules for auto-published groups Require explicit governance for which Policy Groups can be synchronized into Panorama or directly to firewalls, especially when those groups influence production segmentation boundaries.
What's in the full article
Elisity's full post covers the operational detail this analysis intentionally leaves for the source:
- Step-by-step workflow for discovery, enrichment, classification, and DAG synchronization across Palo Alto Networks environments.
- Practical integration choices between Panorama and direct firewall publishing for different deployment shapes.
- Examples of identity, location, and trust attributes used to build Policy Groups from multiple source systems.
- Operational guidance for reducing manual DAG maintenance without replacing existing firewall policy architecture.
👉 Read Elisity's analysis of automating Palo Alto Networks Dynamic Address Groups →
Palo Alto DAG automation: what identity-based classification changes?
Explore further
11/07/2026 2:07 pm
Identity-based firewall automation is really a governance problem, not a firewall problem. The firewalls are already capable of enforcing segmentation, but the manual work of keeping Dynamic Address Groups current turns identity mapping into a lagging control. That lag creates stale policy, which is where operational risk accumulates. Practitioners should read this as a lifecycle issue for device identity, not a tooling convenience.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: What should teams review before publishing identity-based groups to firewalls?
A: Teams should review the trust model behind each group, the source systems feeding classification, and the approval boundary for publishing tags. If a group can alter segmentation without a clear owner or audit trail, the automation has moved faster than governance.
👉 Read our full editorial: Identity-based classification is reshaping Palo Alto DAG automation
