Enforcing Firewall Policies with Cato SASE Device Attributes: Extending Zero-Trust to Every Device

Introduction

Modern enterprises face a rapidly growing attack surface driven by IoT, OT, and unmanaged endpoints. Traditional user- or location-based security is no longer enough to enforce zero-trust access.
Cato SASE addresses this challenge by enabling administrators to integrate Device Inventory attributes directly into firewall rules. This feature brings device awareness into both WAN and Internet firewall policies, ensuring that every connection is validated based not only on who the user is, but also what device they are using.

Understanding Device Attributes in Cato SASE Firewalls

Cato’s Device Inventory engine passively analyzes network traffic using AI/ML to detect, classify, and profile IT, IoT, and OT devices. These device characteristics can then be enforced in firewall policies to achieve granular control.

Supported Device Attributes

Firewall rules can be built on the following device attributes:

• Category (e.g., IoT, Server, Mobile)
• Type (e.g., Workstation, Printer, IP Camera)
• Model
• Operating System (OS)
• Manufacturer
• OS Version

Licensing Requirement

To enable this feature, organizations must activate the Device Inventory license, which unlocks the Device Inventory page and attribute-based firewall enforcement.

Combining Device Attributes with Posture Profiles

Cato SASE allows security teams to build multi-layered firewall rules by combining:

• Device Attributes (e.g., Manufacturer = Dell)
• Device Posture Profiles (e.g., Anti-Malware enabled AND Disk Encryption enforced)

The rule logic is as follows:

• AND logic across different conditions – traffic must satisfy all configured checks.
• OR logic within a single attribute type – selecting Dell OR HP will match either manufacturer.

This ensures administrators can enforce policies that verify not only the type of device but also its real-time security posture.

Documented Use Cases

Cato documentation highlights several practical scenarios:

• Blocking Internet Access for IoT Devices – e.g., deny all Internet traffic from IP cameras to reduce their attack surface.
• Enforcing Corporate Hardware Standards – allow only approved video conferencing devices from specific manufacturers, blocking others.
• Securing OT Infrastructure – permit access to a business-critical OT device only for specific users on compliant devices.

Operational and Security Impact

Integrating Device Attributes into firewall rules provides several advantages:

• Zero-Trust Enforcement – expands identity verification to include device characteristics.
• Micro-segmentation for IoT/OT – isolates unmanaged devices and limits their communication paths.
• Audit and Compliance Readiness – ensures corporate standards are enforced and documented through firewall policies.
• Reduced Attack Surface – IoT and unmanaged devices can be restricted from Internet or lateral access.

Known Limitations and Dependencies

While powerful, administrators must account for some constraints:

• MAC Address Dependency – rules apply only if the device’s MAC address is detected.
• Protocol Dependency – accurate detection requires traffic over DHCP, HTTP, MAC, TCP/IP, or FTP.
• TLS Inspection & DHCP Best Practices – enabling TLS inspection and using the Cato DHCP service improves accuracy.
• Data Accuracy Issues – devices may appear duplicated or merged if they share IPs, and inactive devices disappear after 3 days.
• Filter Limitation – CIDR notation is not supported in Device Inventory filters.

Strategic Role in Zero-Trust Architecture

By embedding device awareness into firewall enforcement, Cato SASE strengthens its zero-trust network architecture (ZTNA). Security decisions are no longer made solely on user identity but are contextualized with device type, posture, and compliance status, ensuring least-privilege access across IT, IoT, and OT environments.

If You Need Further Details On How To Implement Device Attribute-Based Firewall Policies Or Strengthen Zero-Trust Architecture In Your Organization, Please Feel Free To Schedule a No-Obligation Requirement-Gathering Virtual Meeting With Our Cato SASE Experts. Schedule Now
 

FAQ

How can Cato SASE Device Inventory attributes be used in firewall rules for IoT and OT security?

Cato SASE allows admins to enforce granular policies on IoT/OT devices by using Device Attributes in firewall rules. For example, Internet firewall rules can block IP cameras from accessing the Internet, while WAN rules can restrict OT devices to authorized users.

What types of Device Attributes does Cato SASE support in firewall policies?

Cato supports six key attributes: Category, Type, Manufacturer, Model, OS, and OS Version. These are automatically populated by the Device Inventory engine.

Can Device Attributes from Cato Device Inventory be combined with Device Posture Profiles in firewall rules?

Yes. Administrators can create firewall rules that require both device identity (e.g., Manufacturer = Dell) AND compliance posture (e.g., anti-malware enabled). This layered approach enforces zero-trust verification.

What are the licensing requirements for enabling Device Attributes in Cato SASE firewall rules?

A Device Inventory license is required to access this feature. Without it, the Device Attributes condition will not appear in firewall configuration.

What common use cases does Cato document for Device Attributes in firewall rules?

Documented scenarios include:

• Blocking Internet access for IP cameras (IoT security).
• Enforcing corporate hardware standards for video conferencing devices.
• Allowing OT device access only to specific, compliant users.

Are there limitations or accuracy issues with Device Attributes in Cato SASE firewall rules?

Yes. Limitations include MAC address dependency, protocol restrictions, data merging/duplication, and device removal after inactivity.

How do DHCP settings and TLS inspection improve Device Inventory accuracy for Cato SASE enforcement?

Using Cato DHCP ensures MAC address visibility, while TLS inspection enables deeper traffic analysis for accurate device classification. Both are best practices recommended by Cato.

How does using Device Attributes in firewall rules strengthen zero-trust enforcement in Cato SASE?

By combining device identity with posture and user conditions, Cato SASE enforces strict least-privilege policies. This ensures only trusted, compliant devices gain access to corporate resources, a cornerstone of Zero Trust.