VM-Series Deployment Guide
    : Configure VM Monitoring with the Panorama Plugin for GCP
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Deployment Guide
    4. Set Up the VM-Series Firewall on Google Cloud Platform
    5. VM Monitoring with the Panorama Plugin for GCP
    6. Configure VM Monitoring with the Panorama Plugin for GCP
    Download PDF

    VM-Series Deployment Guide

    Configure VM Monitoring with the Panorama Plugin for GCP

    Table of Contents

    Configure VM Monitoring with the Panorama Plugin for GCP

    Before you configure the Google Cloud Platform plugin for Panorama for VM Monitoring, complete GCP and Panorama preparation tasks.
    This topic describes the steps to prepare your GCP assets for VM monitoring, review the required Panorama elements, and describes how to configure VM Monitoring in the Panorama plugin for Google Cloud Platform (GCP).

    Configure GCP Assets for VM Monitoring

    You can monitor VM-Series firewalls you deployed from the GCP marketplace, firewalls you deployed with auto scaling Firewall templates, GCE instances you created from to the GCP console or the gcloud command line, or other virtual machines deployed in GCP. If you deploy PAN-OS VMs from the Marketplace, follow the instructions in Set Up the VM-Series Firewall on Google Cloud Platform.

    Review IAM Roles

    Ensure that you have the following minimum permissions for VM Monitoring tasks:
    • In GCP console, create service accounts for your project and grant the permission project owner or editor.
      Service account creation cannot be automated. If you do not have permission to create a service account you can ask an administrator to create it and assign an appropriate role to you.
    • View your service accounts: read-only.
    • View PAN-OS VMs deployed from the Google Marketplace: Compute viewer.
    • Assign a user-defined tag to an instance: Project owner, editor or Instance Admin.

    Create a Service Account

    Before you use the GCP plugin on Panorama to configure VM Monitoring, you must use the GCP console to create service accounts that grant permissions to access your GCP project, VM-Series firewalls deployed within it, any other VMs that you want Panorama to manage, and related networks and subnetworks. The GCP plugin for Panorama retrieves pre-defined attributes for Google assets, user defined VM labels, and user-defined network tags.
    From Panorama Plugin for GCP version 3.1.0 or later, in a shared VPC set up, you can create service accounts for host projects, and grant permissions to the service projects. For more information, see creating cross project service account in GCP. This service account credentials must be used in Monitoring Definition to retrieve tags for multiple attached service projects.
    Every project has a default service account that was automatically created when the project was created. If you create a separate service account specifically for VM Monitoring you have greater control of users and their roles. You can configure up to 100 service accounts per project.
    1. In the Google Cloud Platform console, select the project you want to monitor.
    2. Select IAM & AdminService accounts and choose +Create Service Account.
      Enter the service account name and description, and click Create.
    3. Select a role type from the drop menu, and on the right, select an appropriate access level.
      For example, select Project > Editor. You can select multiple roles for a service account.
      When you are finished, click Continue.
    4. Grant specific users permission to access this service account. Select members from the Permissions column on the right to give them permission to access the roles in the previous step.
    5. (Optional) Click +CREATE KEY to create a credential that allows you to authenticate with the Google Cloud CLI to access VM-Series firewalls, networks, and other VMs associated with this service account.
      The key is downloaded automatically. Be sure to store it in a secure location. The JSON format for the generated private key is as follows:
      {
  "type": "service_account",
  "project_id": "gcp-xxx",
  "private_key_id": "<private-key-id>",
  "private_key": "-----BEGIN PRIVATE KEY-----<private-key-value>-----END PRIVATE KEY-----\n",
  "client_email": "<client-email>",
  "client_id": "<client-id>",
  "auth_uri": "<auth-uri>",
  "token_uri": "<token-uri>",
  "auth_provider_x509_cert_url": "<auth-provider-x509-cert-url>",
  "client_x509_cert_url": "<client-x509-cert-url>"
}

    Review and Create Tags

    Set up tagging in GCP
    “Tag” is a general term for predefined attributes, user-defined labels, and user-defined network tags.
    • Predefined tags (attributes) are automatically created for Google VMs. When you configure VM Monitoring you can choose to monitor all 8 of the predefined attributes, or you can create a customized list of attributes to monitor.
    • You can define your own tags for VM labels and network tags.
    Tag VMs and networks so that you can identify and group them so that you can structure rules to enforce Security policy. You can tag any VM deployed in your Google project—for example, a VM-Series firewall, a web server, an application server, or a load balancer.
    • Tags must be associated with a VM. This also applies to networks and subnetworks.
    • If there are multiple IP addresses associated with an instance (for example if you tagged the VM-Series firewall trust and untrust interfaces), Panorama generates multiple sets of tag information.
    The total number of tags that the Panorama plugin can retrieve and register depends on the PAN-OS version Panorama is running and the version of the managed VM-Series firewalls.
    Google zone, Google region, VPC name, and Subnet name are used to tag network interfaces on VMs with multiple interfaces. specific to network interface.

    Predefined Attributes

    The Google Cloud Platform plugin for Panorama retrieves the following predefined tags from any managed VM:
    • Project ID—For example: google.project-id.myProjectId.
      To find your project information in the Google console, select your project, then select IAM & AdminSettings.
    • Service account—Your service account in the form of an email address. For example: google.svc-accnt.sa-name@project-id.iam.gserviceaccount.com.
      To find your Service account, view the VM instance details.
    • VPC name—The name of the VPC network for a managed VM. For example: google.vpc-name.myvnet.
    • Subnet name—The name of a subnet you created for a managed VM interface. For example, for the VM-Series firewall untrust interface, the name of the subnet you created for the untrust interface: google.subnet-name-untrust.web.
    • OS SKU—The operating system you chose when you deployed the managed VM. For example: google.os-sku.centos-7.
      This attribute is not supported if the VM uses a custom image.
    • Google zone—The zone you selected when you deployed the VM. For example: google.zone.us-east1-c.
    • Google region—The region containing the zone you selected. For example: google.region.us-east1.
    • Instance group name—For example: google.instance-group.myInstanceGroup. To view or create an instance group in the Google console, select Compute EngineInstance Group.

    User-defined Labels

    Panorama uses up to 16 user-defined labels. If you have more than 16 labels, Panorama sorts your user-defined labels alphabetically and uses the first 16 tags.
    Review the Google requirements for label key-value pairs: Keys have a minimum length of 1 character and a maximum length of 63 characters, and cannot be empty. Values can be empty, and have a maximum length of 63 characters.
    To create or view labels in the GCP console, go to Compute EngineVM Instances and select Show Info Panel. Select one or more VMs and in the Info Panel, select Labels. Click +Add a label, add a key and value, and click Save.

    User-defined Network Tags

    Panorama uses up to 8 user-defined network tags, If you have more than 8 tags, Panorama sorts your user-defined labels alphabetically and uses the first 8 tags.
    Note that Google limits network tags as follows:
    • Maximum 63 characters per tag.
    • You can use lowercase letters, numbers, and dashes; a tag must start with a lowercase letter, and end with a number or a lowercase letter.
    To create or view network tags in the GCP console, go to Compute EngineVM Instances and select an instance. Edit the instance, and scroll down to Network Tags, enter tags (separated by commas), and Save. See Configuring Network Tags.

    Configure VM Monitoring with the Panorama Plugin for GCP

    After you tag your GCP assets and create service accounts, make your assets available to Panorama so you can set up VM monitoring.

    Prepare Panorama to Configure VM Monitoring

    Follow these steps to enable Panorama to manage and monitor your GCP assets. Any VM deployed in GCP can be a managed device in Panorama.
    1. In Panorama, add the VM-Series firewalls and other VMs associated with your GCP project as managed devices.
    2. Add a Device Group and assign managed devices to it. A Device Group is a group of firewalls or virtual systems that you want to manage as a group.
      A VM can be a member of only one Device Group. Plan your Device Groups carefully.
    3. Add a template. Name the template and accept the default VPC.
    4. Add a template stack. Add the stack, Add the template you just created, and select your devices.
    5. Commit the changes.

    Set Up VM Monitoring

    1. If you have not done so, Install the Panorama Plugin for GCP.
    2. Log in to the Panorama web interface and select PanoramaGoogle Cloud Platform.
    3. Set up VM monitoring.
      1. Configure general settings.
        1. Select PanoramaGoogle Cloud PlatformSetupGeneral. To edit the settings, click the gear.
          • Check Enable Monitoring to permit VM monitoring on all projects for which you configure a service account.
          • Enter the Monitoring Interval in seconds. This is the length of time between tag retrieval events.
      2. Add a notify group. A notify group is a list of Device Groups to which Panorama pushes IP-address-to-tag mappings and updates.
        A project can have only one notify group.
        1. Select PanoramaGoogle Cloud PlatformSetupNotify Groups and click Add.
        2. Enter a Name to identify the group of firewalls to which Panorama pushes the VM information (IP address-to-tag mappings) it retrieves.
        3. Select the Device Groups to which Panorama will push the VM information (IP address-to-tag mappings) retrieved from your project. The VM-Series firewalls use the update to determine the current member list for Dynamic Address Groups referenced in Security policy.
          Plan your Device Groups carefully.
        4. Select predefined or custom tags.
          • Select All 8 Predefined Tags—Choose this option to select all predefined attributes (tags).
          • Custom Tags—Choose this option to create tag lists for predefined attributes, user-defined labels, and user-defined network tags.
          • Make sure to include all relevant Device Groups in a single notify group.
          • If you want to deregister the tags that Panorama has pushed to a firewall included in a notify group, you must delete the monitoring definition.
          • To register tags to all virtual systems on a firewall enabled for multiple virtual systems, you must add each virtual system to a separate Device Group on Panorama and assign the Device Groups to the notify group. Panorama will register tags to only one virtual system, if you assign all the virtual systems to one Device Group.
      3. Add GCP Service Account Credential.
        • Name the service account credential.
        • (Optional) Enter a description of the service account.
        • Browse to upload the JSON file generated when you created the service account.
        In Shared VPC Setup, you have to create service accounts for host projects, and grant permissions to the service projects. You can use these service accounts in the GCP Plugin. This will allow you to retrieve tags that are part of service projects attached to the host project
        You must use the Panorama web interface. You cannot use the CLI to add a service account
        You can only use a service account for one credential. Do not create multiple credentials from a single JSON file.
      After you add the service account credential, you can validate the credential from your Panorama command line:
      request plugins gcp validate-service-account <svc-acct-credential-name>
    4. Create a Monitoring Definition.
      A monitoring definition consists of the service account credential for your project and a notify group. All the networking assets in your project are monitored, and the tags retrieved are pushed to the Device Groups you list in your monitoring definition. When you add a new monitoring definition, it is enabled by default.
      A project can have only one monitoring definition, and a monitoring definition can include only one notify group.
      1. Select PanoramaGoogle Cloud PlatformMonitoring Definition and click Add.
      2. Name the monitoring definition.
      3. Enter an optional Description for the project and assets you are monitoring.
      4. Select the Service Account credential you created in the previous step.
      5. Select a Notify Group.
      6. Enable monitoring for the elements associated with this service account.
    5. Commit the changes on Panorama.
      Verify that the status for the Monitoring Definition displays as Success. If it fails, verify that you entered the project ID accurately and provided the correct keys and IDs for the service.
    6. Verify that you can view the VM information on Panorama, and define the match criteria for Dynamic Address Groups.
      On HA failover, the secondary Panorama attempts to reconnect to Google Cloud Platform and retrieve tags for all monitoring definitions. If there is an error with reconnecting even one monitoring definition, Panorama generates a system log message:
      Unable to process subscriptions after HA switch-over; user-intervention required.
      If you see this error, fix the issue in Panorama. For example, remove an invalid subscription or provide valid credentials, and commit your changes to enable Panorama to reconnect and retrieve the tags for all monitoring definitions.
      Even when Panorama is disconnected from Google Cloud Platform, the firewalls have the list of all tags that had been retrieved before failover, and can continue to enforce policy on that list of IP addresses. When you delete a monitoring definition, Panorama removes all tags associated with registered VMs. As a best practice, configure action-oriented log forwarding to an HTTPS destination from Panorama so that you can take immediate action.

    © 2024 Palo Alto Networks, Inc. All rights reserved.