Set Up the Azure Plugin for Monitoring on Panorama
To start collecting IP address-to-tag mapping, set up
the Monitoring agent to execute as a cron task.
To find all the workloads that your organization
has deployed in the Azure cloud, you need to install the Azure plugin
on Panorama and configure Monitoring Definitions that enable Panorama
to authenticate to your Azure subscription(s) and retrieve information
on the Azure workloads. Panorama retrieves the primary private IP
address of Azure resources and the associated tags. For a list of
the metadata elements that Panorama supports, see Attributes Monitored
Using the Panorama Plugin on Azure.
After Panorama
fetches the attributes, to push the resource information from Panorama
to the firewalls, you must add the firewalls (hardware or VM-Series)
as managed devices on Panorama, and group the firewalls into one
or more Device Groups. You can then specify which device groups
are part of the Notify Group, which is a configuration element
in a Monitoring Definition, that Panorama uses to register the IP
address-to-tag mapping it retrieves from Azure.
Finally, to
consistently enforce Security policies across your Azure workloads,
you must set up Dynamic Address Groups and reference them
in policy rules that allow or deny traffic to the IP addresses of
the Azure resources. For streamlining your configuration and managing policies
and objects centrally from Panorama, you can define the Dynamic
Address Groups and Security policy rules on Panorama and push them
to the firewalls instead of managing the Dynamic Address Groups
and Security policy rules locally on each firewall.
The
Azure plugin is for monitoring Azure resources on the Azure public
cloud. Azure Government or Azure China are not supported.
Planning
Checklist for VM Monitoring with the Azure Plugin
Install the Azure Plugin
Configure the Azure Plugin for Monitoring
Planning Checklist for Monitoring with the Azure Plugin
Set up the
Active Directory application and a Service Principal to enable API access—For
Panorama to interact with the Azure APIs and collect information
on your workloads, you need to create an Azure Active Directory
Service Principal. This Service Principal has the permissions required
to authenticate to the Azure AD and access the resources within
your subscription.
To complete this set up, you must have
permissions to register an application with your Azure AD tenant,
and assign the application to a role in your subscription. If you
don't have the necessary permissions, ask your Azure AD or subscription
administrator to create a Service Principal with an IAM role of reader or the custom permissions
specified in VM-Series on Azure Service Principal Permissions.
Make sure that the subscription ID is unique across Service
Principals. Panorama allows you to use only one service principal
to monitor an Azure subscription. You can monitor up to 100 Azure
subscriptions, with 100 Service principal resources. Starting with
Panorama plugin for Azure version 3.2.0, you can monitor up to 500
Azure subscriptions. Take note of the processing times described
in the table below.
Number of Subscriptions
100
200
300
400
500
System Resources Utilization
CPU: 22%
Memory: 0.025 MB
CPU: 23.8%
Memory: 0.025 MB
CPU: 31.8%
Memory: 0.025 MB
CPU: 28.6%
Memory: 0.025 MB
CPU: 39.2%
Memory: 0.025 MB
Average Time to Process All Monitoring Definitions
1 Hour, 15 Minutes
2 Hours, 30 Minutes
3 Hours, 30 Minutes
4 Hours
5 Hours
Average Tag Update Processing Time
5 minutes
10 minutes
15 minutes
20 minutes
25 minutes
The information in the table above was
captured on an instance with 8 vCPUs and 32GB of memory.
Panorama can push up to 8000 IP address-to tag mappings to
the firewalls or virtual system assigned to a device group. Review
the requirements for Panorama and the managed firewalls:
Minimum
system requirements (see the Panorama Plugin information
in the Compatibility Matrix):
Panorama virtual appliance or
hardware-based Panorama appliance running Panorama 8.1.3 or later,
with an active support license and a device management license for
managing firewalls.
Licensed next-generation firewalls running
PAN-OS 8.0 or 8.1.
You must add the firewalls as managed devices on
Panorama and create Device Groups so that you can configure
Panorama to notify these groups with the information it retrieves.
Device groups can include VM-Series firewalls or virtual systems
on the hardware firewalls.
The number of tags that the Panorama plugin can retrieve
and register is as follows:
On Panorama running 8.1.3 or
later managing firewalls running PAN-OS 8.1.3 or lower, the firewalls
or virtual systems included within a device group can have 7000
IP addresses with 10 tags each, or 6500 IP addresses with 15 tags
each.
On Panorama 8.1.3 or later managing firewalls running
PAN-OS 8.0.x, 2500 IP addresses with 10 tags each.
If
your Panorama appliances are in a high availability configuration,
you must manually install the same version of the Azure plugin on
both Panorama peers.
You configure the Azure plugin
on the active Panorama peer only. On commit, the configuration is
synced to the passive Panorama peer. Only the active Panorama peer
polls the Azure subscriptions you have configured for Monitoring.
Install the Azure Plugin
To get started with Monitoring on Azure, you
need to download and install the Azure plugin on Panorama. If you
have a Panorama HA configuration, repeat this installation process
on each Panorama peer.
If you currently have installed
a Panorama plugin, the process of installing (or uninstalling) another
plugin requires a Panorama reboot to enable you to commit changes.
So, install additional plugins during a planned maintenance window
to allow for a reboot.
If you have a standalone Panorama
or two Panorama appliances installed in an HA pair with multiple
plugins installed, plugins might not receive updated IP-tag information
if one or more of the plugins is not configured. This occurs because
Panorama will not forward IP-tag information to unconfigured plugins.
Additionally, this issue can occur if one or more of the Panorama
plugins is not in the Registered or Success state (positive state
differs on each plugin). Ensure that your plugins are in the positive
state before continuing or executing the commands described below.
If
you encounter this issue, there are two workarounds:
Uninstall
the unconfigured plugin or plugins. It is recommended that you do
not install a plugin that you do not plan to configure right away
You can use the following commands to work around this issue.
Execute the following command for each unconfigured plugin on each
Panorama instance to prevent Panorama from waiting to send updates.
If you do not, your firewalls may lose some IP-tag information.
request plugins dau plugin-name <plugin-name> unblock-device-push yes
You
can cancel this command by executing:
request plugins dau plugin-name <plugin-name> unblock-device-push no
The
commands described are not persistent across reboots and must be
used again for any subsequent reboots. For Panorama in HA pair,
the commands must be executed on each Panorama.
Log in to the Panorama Web Interface, select PanoramaPlugins and
click Check Now to get the list of available
plugins.
Select Download and Install the
plugin.
After you successfully install, Panorama refreshes and
the Azure plugin displays on the Panorama tab.
Restart Panorama.
Select PanoramaSetupOperationsReboot Panorama
Configure the Azure Plugin for Monitoring
Retrieve information for your Azure workloads, use the
match criteria filters to define Dynamic Address groups and enforce
Security policy.
To begin monitoring the resources in your
Azure public cloud deployment, after you
Install
the Azure Plugin
you must create a Monitoring Definition.
This definition specifies the Service Principal that is authorized
to access the resources within the Azure subscription you want to
monitor and the Notify Group that includes the firewalls to which
Panorama should push all the IP-address-to-tag mappings it retrieves.
In order to enforce policy, you must then create Dynamic Address
Groups and reference them in Security policy. The Dynamic Address
Groups enable you to filter the tags you want to match on, so that
the firewall can get the primary private IP address registered for
the tags, and then allow or deny access to traffic to and from the
workloads based on the policy rules you define.
Log in to the Panorama web interface.
Set up the following objects for enabling Monitoring
on Azure.
Add a Service Principal.
The
Service Principal is the service account that you created on the
Azure portal. This account is attached to the Azure AD and has limited
permissions to access and monitor the resources in your Azure subscription.
Enter a Name and optionally a Description to
identify the service account.
Enter the Subscription ID for the
Azure subscription you want to monitor. You must login to your Azure
portal to get this subscription ID.
Enter the Client Secret and re-enter
it to confirm.
Enter the Tenant ID. The tenant ID
is the Directory ID you saved when you set up the Active Directory
application.
Click Validate to verify that the
keys and IDs you entered are valid ,and Panorama can communicate
with the Azure subscription using the API.
Add a notify group.
Select PanoramaPluginsAzureSetupNotify GroupsAdd.
While configuring the monitoring definition, ensure
that you attach the parent DG to the plugin
notify-group and that all children DGs are
unattached from the notify group.
To ensure that the DAU propagates all IP tags from
parent DG to children DGs that are connected to the
firewall, run the command debug dau settings
device-group recursive yes on Panorama CLI
Enter a Name and optionally a Description to
identify the group of firewalls to which Panorama pushes the information
it retrieves.
Select the Device Groups, which are
a group of firewalls or virtual systems, to which Panorama will
push the information (IP address-to-tag mapping) it retrieves from
your Azure subscriptions. The firewalls use the update to determine
the most current list of members that constitute dynamic address
groups referenced in policy.
Select the option Select All Tags or Custom
Tags.
bles you to specify the labels that you prefer
and generate required tags. You must enter the key of
the user tag to configure the user tags.
For example:
If your virtual machine (VM) on Azure cloud is
tagged as UserID with a value
SampleValue, enter
UserID under the user
tags. You can then see that
azure.tag.UserID.SampleValue
is populated as the user tag.
You must think through your Device Groups carefully
because a Monitoring Definition can include only one
notify group, make sure to select all the relevant
Device Groups within your notify group. If you want
to deregister the tags that Panorama has pushed to a
firewall included in a notify group, you must delete
the Monitoring Definition.
To register tags to all virtual systems on a firewall
enabled for multiple virtual systems, you must add
each virtual system to a separate device group on
Panorama and assign the device groups to the notify
group. Panorama will register tags to only one
virtual system, if you assign all the virtual
systems to one device group.
Click OK.
Verify that monitoring is enabled on the plugin. This setting
must be enabled for Panorama to communicate with the Azure public
cloud for Monitoring.
The checkbox for Enable Monitoring is
on PanoramaPluginsAzureSetupGeneral.
Create a Monitoring Definition.
When you
add a new Monitoring definition, it is enabled by default.
Select PanoramaPluginsAzureMonitoring Definition,
to Add a new definition.
Enter a Name and optionally a Description to
identify the Azure subscription for which you use this definition.
Select the Service Principal and Notify
Group.
Panorama requires the keys and IDs that
you specify in the Service Principal configuration to generate an
Azure Bearer Token which is used in the header of the API call to
collect information on your workloads.
The Panorama plugin for Azure 5.1.0
supports one service principal for multiple
monitoring definitions.
The Panorama plugin for Azure 5.0.0 or
below version, does not support one service
principal for multiple monitoring definitions.
Select the Azure Regions
.
No two monitoring definitions can
have exactly the same Service Principal and Region
configured. The plugin will fail the commit operation
for monitoring definitions that have the same Service
Principal and Region configured.
Commit the changes on Panorama.
Verify that the status for the Monitoring Definition displays
as Success. If it fails, verify that you entered the Azure Subscription
ID accurately and provided the correct keys and IDs for the Service
Principal.
You can select a monitoring definition and click Dashboard
to view the tag details of a monitoring definition.
The location filter on the Monitoring Definition Detailed
Status dialogue box filters the dashboard details by location.
Click more to view the IP address of the tag and then go
to Associated tags to view all tags associated with this IP
address.
Verify that you can view the information on Panorama,
and define the match criteria for Dynamic Address Groups.
Some browser extensions may block API calls between
Panorama and Azure which prevents Panorama from receiving match
criteria. If Panorama displays no match criteria and you are using
browser extensions, disable the extensions and Synchronize Dynamic
Objects to populate the tags available to Panorama.
On
HA failover, the newly active Panorama attempts to reconnect to
the Azure cloud and retrieve tags for all monitoring definitions.
If there is an error with reconnecting even one monitoring definition,
Panorama generates a system log message
Unable to process subscriptions after HA switch-over; user-intervention required.
When
you see this error, you must log in to Panorama and fix the issue,
for example remove an invalid subscription or provide valid credentials,
and commit your changes to enable Panorama to reconnect and retrieve
the tags for all monitoring definitions. Even when Panorama is disconnected
from the Azure cloud, the firewalls have the list of all tags that
had been retrieved before failover, and can continue to enforce policy
on that list of IP addresses. Panorama removes all tags associated
with the subscription only when you delete a monitoring definition.
As a best practice, to monitor this issue, configure action-oriented log forwarding to an HTTPS destination from
Panorama so that you can take immediate action.
