Early availability features

This topic describes features available as Early Availability (EA) and how to enable ASMS's Early Availability features.

ASMS's Early Availability features enable you to access new functionality and support earlier than general availability. Customers partaking of Early Availability often provide invaluable feedback on the design and implementation of these features. Early Availability features have shorter QA cycles than GA features, and therefore are disabled by default.

Enable ActiveChange for MSO- and NDO-managed Cisco ACI tenants

ActiveChange for Cisco ACI tenants managed by a Cisco MSO (Multi-Site Orchestrator) and NDO (Network Data Orchestrator) is available as an early availability feature.

With this early availability feature enabled, you can add, modify and remove rules from the policy directly from FireFlow.

When Cisco ACI tenants are managed by an MSO/NDO, each APIC in turn can manage one or more tenants. Each tenant contains one schema, with one or more associated templates. Schemas and templates are configured in FireFlow in order to implement ActiveChange on the device.

To enable/disable early availability ActiveChange for MSO- and NDO-managed Cisco ACI in AFA

1. In the AFA Administration area, navigate to the Options > Advanced Configuration tab.

   

2. Click ADD to add a new configuration parameter, and enter the following details

   Name	AlgoSec_EA_MSO_ActiveChange
   Value	Enter one of the following: true = Enable MSO-and NDO-managed Cisco ACI tenants ActiveChange support false (default) = Disable MSO-and NDO-managed Cisco ACI tenants ActiveChange support

3. Click OK

Configure ActiveChange behavior for MSO- and NDO-managed Cisco ACI tenants in FireFlow

In ACI MSO/NDO, there is no default value for the schema and template. In order to implement ActiveChange for the MSO- and NDO- managed Cisco ACI tenants, user-defined schema and templates are required for each tenant.

{ <Apic ID/Name> : {<tenant Name> : 

{ "schema":<Schema name>, "templates":[<template1>,<template2>...]}

}}

To configure ActiveChange behavior for MSO- and NDO-managed Cisco ACI tenants:

1. Switch to FireFlow.

2. Click the Advanced Configuration tab.

   The Advanced Configuration page is displayed.

3. In FireFlow Configuration, Click ActiveChange and filter for CiscoACIMSOActiveChangePolicyTargets or just scroll to find it.

4. Click on the edit icon next to the current value field. Define the schema and templates for one tenant.

   For example:

   Copy

   {
                               "10_20_30_40": {
                               "10_20_30_40_ActiveChangeEA": {
                               "schema": "Payroll",
                               "templates": [
                               "Detroit",
                               "Baltimore",
                               "Abu Dhabi"
                               ]
                               }
                               }
                           }

5. Click Update below the current value field to update the value.

6. Filter for CiscoMsoActiverChangeCommit or just scroll to find it.

   Assign a value to this parameter to determine whether or not ActiveChange deploys changes to APICs.

7. Click Update below the current value field to update the value.

8. Click Store Changes at the top of the page.
9. Restart FireFlow.

Support for NSX-T deployed on AWS (VMC)

This section describes the ASMS Early Availability support for NSX-T deployed on AWS (VMC).

• Supported Features
• Unsupported Functionality
• Limitations
• Network connectivity
• Device permissions
• Enable / Disable early availability support for NSX-T deployed in AWS
• Add a VMware NSX-T to AFA

Supported Features

ASMS supports NSX-T deployed in AWS (VMC) as follows:

• VRFs separation

• Rules visibility

• Report Generation

• Topology

• Change History

• Risks Calculation

• Map Visibility

• Regulatory Compliance

• Traffic Simulation Query

• Monitor Cycle

Unsupported Functionality

The following functionality is not supported:

• ActiveChange

• L2 Rules
  

• Changed by (Audit Logs collection)

• Traffic-related recommendations

• IPT and unused rules (Traffic Logs collection)

• IPV6 rules and NSGroups with IPV6 content

Limitations

NSX-T on AWS has the same limitations as NSX-T on-premise, e. g.:​​

• NSX-T is shown only in TSQ result mini map​

• ASMS supports only Distributed Firewall (for East-West traffic)

Network connectivity

VMware Cloud on AWS uses NSX-T to create and manage internal SDDC networks and provide endpoints for VPN connections from your on-premises network infrastructure.

Device permissions

Device analysis on NSX-T that is hosted on AWS (VMC)

ASMS requires minimal, read-only access permissions to access VMware NSX-T data centers and perform data collection.

The user accessing the VMware NSX-T Data Center for analysis and monitoring must have one of the following NSX-T roles:

• EA - Enterprise Administrator
• A - Auditor
• Custom role/permissions (use R flag for all features/components)

Note: If you are using the NSX Manager, we recommend using the built-in NSX Manager user to connect from ASMS.

Enable / Disable early availability support for NSX-T deployed in AWS

This procedure describes how to enable or disable support for NSX-T deployed in AWS in ASMS.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter value as follows:

   Name	AlgoSec_EA_NSXT_Cloud
   Value	One of the following: yes = Enable NSX-T deployed in AWS device support no = Disable NSX-T deployed in AWS device support

For more details, see Advanced Configuration. Continue with Add a VMware NSX-T to AFA.

Add a VMware NSX-T to AFA

This procedure describes how to add a VMware NSX-T that is hosted on AWS (VMC) to AFA.

Do the following:

1. From the Administration area, access the Devices Setup page. For details, see Access the DEVICES SETUP page

2. Click New > Devices > VMware > NSX-T. In the vendor device selection page, click VMware > NSX-T.

3. For NSX-T that is hosted on AWS (VMC), select In Cloud.

   

4. Complete the fields as needed.

   Access Information NSX-T that is hosted on AWS (VMC)

   Device name	Give the device a name. This is the name that will be displayed in the devices tree. Tip: To avoid future confusion, we recommend you use the SDDC name for the device name.
   Organization ID	Organization ID (from VMware Cloud interface)
   SDDC ID	Software-Defined Data Center (SDDC) ID number (from VMware Cloud interface). Each SDDC needs to be added separately.
   API Token	API token. Generate a token from your VMware Cloud services account. Specify the roles required for on-boarding:

   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Additional Information

   Select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked.

   In reality, the default behavior for NSX-T devices is to allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device.

   Note: Learning mode is supported for NSX-T versions 3.0 and above.

   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.
   Options

   Real-time change monitoring	Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.
   Learning mode	You can select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked. By default, DBWs allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device. Note: Learning mode is not supported for NSX-T versions below 3.0.

5. Click Finish. The new device is added to the device tree.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   1. To select multiple users, press the CTRL button while selecting.

   2. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Data visualizations for reports

This Early Availability feature allows you to see report data in a customizable graph.

• View data visualizations

• Create visualizations

• Work with visualizations

View data visualizations

For Risks reports and Changes Summary reports (on the Risks tab)

To view visualizations:

• Click Graphs on the relevant report page. The section expands to show the graphs.

  

Work with visualizations

1. To change the layout and style, click the arrow on the right side of a graph.

   

   A tabbed menu of options appears where you can change the appearance and select which data is graphed.

   

2. To change the title of the visualization, double click the title text.

   Note: If you don't see a title, you can enable it as follows:

   1. Click the arrow on the right side of the graph.

      The layout and style options appear.

   2. Select the Format tab.

   3. Click Chart to expand the chart options.

   4. Click Enabled.

3. Click to save a copy of the displayed visualization onto your computer as a PNG file.

4. Click to link / unlink the visualization to the list below. When linked, the relevant columns in the list are highlighted, and any rearrangement, filtering, and sorting of the highlighted list columns also update the data visualization.

How to use the sample files

Tips:

• To comment out rows from the sample file: (add a ‘#’ to the Exclude column of the row ) if you want to avoid executing a bulk operation from that row.

  

  1. Note or instruction is excluded.

  2. The device will not be considered in the add/update/delete operation.

• Required fields are shown in blue in the header of the sample files.

For Bulk add or update operations

• All brands have their designated sample file. Each brand has its own set of parameters.

  You can also use the Others.xlsx to add or update the following device brands in one place. (You can combine several brands together in the file):

  • F5

  • Cisco Identity Services Engine (ISE)

  • Cisco Application Centric Infrastructure (ACI)

  • Fortinet Fortigate

  • Juniper SRX

  • VMWare NSX-V

  • Palo Alto Firewall.

• For all device types: The same single template file can be used for both add or update operation. However, you need to run the add and update operations separately.

• For Management Devices (PV1, CMA, Juniper Space, Panorama, and Fortimanager): Fill out both the parent and children tabs. The expected behavior for working with child devices for management devices varies per brand.

  Expected behavior per brand

  Brand	Adding Children		Instructions
  	Add all children automatically	Add only selected children
  Panorama	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Juniper space	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Cisco Firepower	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. When set, you cannot add only the parent without specifying child devices.
  Fortimanager	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child devices to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Checkpoint Smart Center	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child device to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Checkpoint PV1	YES	NO	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add children to Children Sheet).

• Supported device brand values

  Use the following Brand Name code values to indicate device brands:

  Brand	Brand Name code
  Web Services (AWS) EC2	aws
  Azure	azure
  Cisco Application Centric Infrastructure (ACI)	ciscoaci
  Cisco ASA	pix
  Cisco Identity Services Engine (ISE)	ciscoise
  Cisco IOS	ios
  Cisco Nexus Router	nexus
  Checkpoint Smart Center	cma
  Checkpoint Provider 1	pv1
  F5 BIG-IP LTM and AFM	f5bigip_afm
  Device from file	file
  Cisco Firepower	firepower
  Fortinet Fortigate	fortigate
  Fortinet Fortimanager	fortimanager
  Google Cloud Platform	gcp_cloudflow
  Juniper SRX	junos
  Juniper Netscreen	nsc
  Juniper Space	space_security_director
  VMWare NSX-V	nsx
  VMWare NSX-T	nsxt
  Palo Alto Firewall	paloalto
  Palo Alto Panorama	panorama
  Cisco Meraki	ciscomeraki

For Bulk Delete operation

• Use the same file Delete.xlsx for all supported device brands simultaneously.

PAN Panorama | EDLs (External Dynamic Lists) in policy destinations

This procedure describes how to enable or disable support for EDLs (External Dynamic Lists) for Palo Alto Panorama devices. This early availability feature works with IP address and URL type lists.

• For IP address type lists: The EDL source will point to a list of IPs (click for an example). You can add it to Source or Destination fields in rules.

• For URL type lists: The EDL source will point to a list of URLs (click for an example). You can add it to URL Category fields in rules only.

  Note: For URL type lists, URLs with wildcards are ignored. For example: *.office365.us/ will not be read.

To enable support for EDLs

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Add the following new parameter and set its value to yes:

   • ALGOSEC_EA_PANORAMA_EDL=yes

   Note: Other configurable parameters that are related to this feature include:

   • PA_URL_CAT_DNS_LIMIT (default=500)

   • DNS_Lookup_Timeout (default=4)

   • PAN_EDL_COLLECT_TIMEOUT (default=10)

   For more details, see Advanced Configuration.