--- title: "Tigera Secure Enterprise Edition 2.4 Extends Firewalls to Secure Dynamic Kubernetes Workloads" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/tigera-secure-enterprise-edition-2-4-enables-firewalls-to-secure-dynamic-kubernetes-workloads/" --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) # Tigera Secure Enterprise Edition 2.4 Extends Firewalls to Secure Dynamic Kubernetes Workloads By [Vince Lau](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/vincetigera-io/) on May 15, 2019 • 4 min read We are excited to announce the new security capabilities of[Tigera Secure Enterprise Edition](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/compare-products/) 2.4. This release enables enterprise security teams to extend their firewalls and existing zone-based architectures to Kubernetes and enable fine-grained access controls to external resources. Tigera Secure 2.4 solves three major network security problems that security teams run into when deploying alongside firewalls. *![Tigera Secure 2.4 diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/05/fw1.png)* *Figure 1 –Three major network security problems with Kubernetes in a zone-based model* - Existing zone-based security architectures cannot be extended to Kubernetes because the workloads use ephemeral, dynamic IP addresses that cannot be used to identify a workload. Security teams resort to opening large IP ranges within their inline firewalls between security zones, allowing all Kubernetes traffic to flow through the architecture. - Modern applications often integrate with third-party APIs like Twilio, SaaS services like Zuora and Salesforce, and resources outside the cluster like AWS RDS databases and VMs. To enable those integrations to work, security teams must allow large IP ranges to egress through the firewall and are unable to provide fine-grained access to specific workloads. - Without the ability to recognize a workload identity, network flows cannot be logged properly. The data misses context that is unique to Kubernetes, such as namespace, pod name, labels, and container ID. Without this information, debugging service issues and performing forensic analysis is not possible. While Kubernetes workloads are growing rapidly they currently represent a small fraction of the workloads that a security team has to secure. Consequently, redesigning existing security architecture isn’t a feasible option since a significant investment has gone into acquiring technology, designing processes, and training teams. With Tigera Secure 2.4, security teams can now extend their current investments in technology and processes to support new Kubernetes workloads. Tigera Secure 2.4 solves these three major network security constraints with the following three simple steps. The process starts with implementing Zero Trust Network Security that forms a micro-firewall around each Kubernetes workload, providing visibility and enforcement within the zone. Next, Tigera Secure filters zone-to-zone traffic at the source to prevent any unintended traffic. Finally, North-South policies are applied to filter traffic to your APIs, Cloud Services, and SaaS platforms. With this approach, Tigera monitors all connection attempts and logs whether they were accepted or denied at the pod level to provide accurate visibility into all Kuberenetes workloads. The data is all integrated into your SIEM and provides the visibility and controls security teams were lacking for Kubernetes deployments within their security architecture. *![security architecture diagram](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/05/fw2.png)* *Figure 2 –Tigera 2.4 extends firewalls to Kubernetes in a zone-based network using either physical or logical zone architectures*   The highlights from this release include DNS Policies, Threat Defense, Compliance Dashboard and Reporting, and easier installation options. ## DNS Policies DNS Policies enable fine-grained access controls between individual Kubernetes pods and resources outside the cluster—on-prem and in the cloud. Teams can easily enable egress access to third-party APIs like Twilio, SaaS services like Zuora and Salesforce, and resources outside the cluster like ElastiCache, RDS databases, and VMs. ![DNS Policies screenshot](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/05/2.4-f1.png) *Figure 3 – Egress policy rule to external resources within Tigera Secure Enterprise Edition 2.4*   ## Threat Defense Threat Defense ingests your Threat Intelligence Feed and blocks traffic from leaving your Kubernetes pods to IPs known for malicious activity. Attacks involving malware are unable to phone home for data exfiltration. *![Suspicious IP screen](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/05/2.4-f2.png)* *Figure 4 – Detailed Kubernetes flow logs about suspicious IP connection*   ## Compliance Dashboard and Reporting Tigera Secure can be used to implement an organizations security controls and prevent tampering with those controls. Those security controls and evidence that those controls are enforced are mapped to compliance requirements that auditors need to see in order to complete an audit or issue a certificate. Compliance framework can be internal to the business based on their own risk profiles, or external frameworks such as PCI, SOC 2, and others. With Tigera Secure 2.4, evidence reports are easier to customize and generate based on the security controls defined by your business. Teams can define in-scope workloads and generate inventory, network access, and policy audit reports that quickly provide evidence auditors request. In addition, the dashboard offers graphical reporting features to help organizations quickly understand their security status. Tigera Secure implements Continuous Compliance enabling you to pull historical evidence reports to prove compliance at any given point in time, and actively monitors for adherence to security controls to alert immediately when there is a potential violation of those controls. ![Compliance Reports screen](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2019/05/2.4-f3.png) *Figure 5 – Compliance dashboard displaying protected assets within Tigera Secure Enterprise Edition 2.4* ## Easy Installation Options Enables easier and quicker deployments with Helm charts. Helm charts enable the customization of settings that allow the installation of the product with one simple command. ————————————————- [**Free Online Training**](https://wordpress-1075849-4005834.cloudwaysapps.com/events/) Access Live and On-Demand Kubernetes Tutorials [**Calico Enterprise – Free Trial**](https://www.calicocloud.io/home) Solve Common Kubernetes Roadblocks and Advance Your Enterprise Adoption [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/)[Announcements](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/announcements/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Kubecon-Euro-2026-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) #### [Join Calico at KubeCon Europe 2026: AI Agents, Silent Discos, and Dutch Delights!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 25, 2026 The cloud-native community is heading to the historic canals and vibrant tech scene of Amsterdam for KubeCon + CloudNativeCon Europe 2026! From March 23–26, Amsterdam will be buzzing with the latest in Kubernetes, platform engineering,... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/calico-at-kubecon-cloudnativecon-europe2026/) [![Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/02/Blog-Hackathon-.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) #### [Project Calico 3.30+ Hackathon: Show Us What You Can Build!](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Feb 17, 2026 Build the Future of Cloud-Native Networking! 🚀 The Calico community moves fast. With the releases of Calico 3.30 and 3.31, brings improvements in scalability, network security, and visibility. Now, we want to see what YOU... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/project-calico-3-30-hackathon-show-us-what-you-can-build/) [![Introducing the New Tigera & Calico Brand](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2026/01/New-logo-blog-1200x628-1.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/) #### [Introducing the New Tigera & Calico Brand](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Jan 30, 2026 Same community. A clearer, more unified look. Today, we are excited to share a refresh of the Tigera and Calico visual identity! This update better reflects who we are, who we serve, and where we... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/introducing-the-new-tigera-calico-brand/)