>
    Attributes Monitored on Virtual Machines in Cloud Platforms
    Focus
    Download PDF
    Focus
    1. Home
    2. Network Security
    3. Network Security: Security Policy
    4. Monitor Changes in the Virtual Environment
    5. Attributes Monitored on Virtual Machines in Cloud Platforms
    Download PDF
    Network Security

    Attributes Monitored on Virtual Machines in Cloud Platforms

    Table of Contents

    Attributes Monitored on Virtual Machines in Cloud Platforms

    Where Can I Use This?What Do I Need?
    • NGFW (PAN-OS & Panorama Managed)
    • Prisma Access (Managed by Panorama)
    Check for any license or role requirements for the products you're using.
    As you provision or remove virtual machines in the private or public cloud, you can use a Panorama plugin, a VM Monitoring script, or the VM Information Source on the next-gen firewall to monitor changes on virtual machines (VMs) deployed in the virtual environments.
    VM Information Sources—On a hardware or a VM-Series firewall you can monitor virtual machine instances and retrieves changes as you provision or modify the guests configured on the monitored sources—AWS, ESXi or vCenter Server, or AWS. For each firewall (and/or virtual system if your firewall has multiple virtual system capability), you can configure up to 10 sources.For information on how VM Information Sources and Dynamic Address Groups work synchronously and enable you to monitor changes in the virtual environment, refer to the VM-Series Deployment Guide .If your firewalls are configured in a high availability configuration:
    • In an active/passive setup, only the active firewall monitors the VM information sources.
    • In an active/active setup, only the primary firewall monitors the VM information sources.
    Panorama Plugin—On a Panorama —hardware appliance or virtual appliance running version 8.1.3—you can install the plugin for Microsoft Azure and AWS. The plugin allows you to connect Panorama to your Azure public cloud subscriptions or AWS VPCs and retrieve the IP address-to-tag mapping for your virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.
    Use the following sections to review the options supported on each cloud vendor and the virtual machine attributes that you can monitor to create Dynamic Address Groups:

    VMware ESXi

    Learn about the attributes monitored on ESXi instances.
    Each VM on a monitored ESXi or vCenter server must have VMware Tools installed and running. VMware Tools provide the capability to glean the IP address(es) and other values assigned to each VM.
    When monitoring ESXi hosts that are part of the VM-Series NSX edition solution, use Dynamic Address Groups (instead of using VM Information Sources) to learn about changes in the virtual environment. For the VM-Series NSX edition solution, the NSX Manager provides Panorama with information on the NSX security group to which an IP address belongs. The information from the NSX Manager provides the full context for defining the match criteria in a Dynamic Address Group because it uses the service profile ID as a distinguishing attribute and allows you to properly enforce policy when you have overlapping IP addresses across different NSX security groups.
    Up to 32 tags (from vCenter server and NSX Manager) can be registered to an IP address.
    To collect the values assigned to the monitored VMs, use the VM Information Sources on the firewall to monitor the following predefined set of ESXi attributes:
    Attributes Monitored on a VMware Source
    UUID
    Name
    Guest OS
    VM State — the power state can be poweredOff, poweredOn, standBy, and unknown.
    Annotation
    Version
    Network — Virtual Switch Name, Port Group Name, and VLAN ID
    Container Name —vCenter Name, Data Center Object Name, Resource Pool Name, Cluster Name, Host, Host IP address.

    Amazon Web Services (AWS)

    Learn about the attributes monitored on AWS instances.
    As you provision or modify virtual machines in your AWS VPCs, you have two ways of monitoring these instances and retrieving the tags for use as match criteria in dynamic address groups.
    • VM Information Source—On a next-gen firewall, you can monitor up to a total of 32 tags—14 pre-defined and 18 user-defined key-value pairs (tags). The following attributes (or tag names) are available as match criteria for dynamic address groups.
    • AWS Plugin on Panorama—The Panorama plugin for AWS allows you to connect Panorama to your AWS VPCs and retrieve the IP address-to-tag mapping for your AWS virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification. With the plugin, Panorama can retrieve a total of 32 tags for each virtual machine, 11 predefined tags and up to 21 user-defined tags.
    Attributes Monitored on the AWS-VPC
    		VM Information Source on the FirewallAWS Plugin on Panorama
    ArchitectureYesNo
    Guest OSYesNo
    AMI IDYesYes
    IAM Instance ProfileNoYes
    Instance IDYesNo
    Instance StateYesNo
    Instance TypeYesNo
    Key NameYesYes
    Owner IDNoYes
    Placement—TenancyYesYes
    Placement—Group NameYesYes
    Placement—Availability ZoneYesYes
    Private DNS NameYesNo
    Public DNS NameYesYes
    Subnet IDYesYes
    Security Group IDNoYes
    Security Group NameNoYes
    VPC IDYesYes
    Tag (key, value)Yes;
    Up to a maximum of 18 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 18 tags are available for use on the firewalls.
    		Yes;
    Up to a maximum of 21 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 21 tags are available for use on Panorama and the firewalls.

    Microsoft Azure

    Learn about the attributes monitored on Microsoft Azure instances.
    For VM Monitoring on Azure you need to retrieve the IP address-to-tag mapping for your Azure VMs and make it available as match criteria in dynamic address groups. The Panorama plugin for Microsoft Azure allows you to connect Panorama to your Azure public cloud subscriptions and retrieve the IP address-to-tag mapping for your Azure virtual machines. Panorama can retrieve a total of 26 tags for each virtual machine, 11 predefined tags and up to 15 user-defined tags and registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.
    With the Panorama plugin for Azure, you can monitor the following set of virtual machine attributes within your Microsoft Azure deployment.
    Attributes Monitored on Microsoft Azure
    		Azure Plugin on Panorama
    VM NameYes
    VM SizeNo
    Network Security Group NameYes
    OS TypeYes
    OS PublisherYes
    OS OfferYes
    OS SKUYes
    SubnetYes
    VNetYes
    Azure RegionYes
    Resource Group NameYes
    Subscription IDYes
    User Defined TagsYes
    Up to a maximum of 15 user defined tags are supported. The user-defined tags aresorted alphabetically, and the first 15 tags are available for use on Panorama and the firewalls.

    Google

    Learn about the attributes monitored on Google Compute Engine instances.
    Using VM Information Sources on the next-gen firewall, you can monitor the following predefined set of Google Compute Engine (GCE) attributes.
    High Availability is not supported on the firewalls.
    Attributes Monitored on Google Compute Engine
    Hostname of the VM
    Machine type
    Project ID
    Source (OS type)
    Status
    Subnetwork
    VPC Network

    © 2024 Palo Alto Networks, Inc. All rights reserved.