Add Palo Alto Networks devices

Relevant for: AFA Administrators

This topic describes how AFA connects to Palo Alto Panorama and firewall devices.

Palo Alto network connections

The following image shows how an ASMS Central Manager or Remote Agent connects to Palo Alto Panorama and Palo Alto Next Generation Firewalls (NGFWs).

 

Note: Log data can also be forwarded from M100/M500 collectors.

AFA automatically identifies Palo Alto Panorama devices in service-chaining mode when the device has a single interface, or a single one non-management interface.

If your device has multiple non-management interfaces and service-chaining mode is not identified automatically, configure this for your device manually. For details, see Configure one-armed mode manually.

Once added, AFA identifies and analyzes individual VRs/VWires for the firewalls managed by Panorama, in addition to analyzing each VSYS. The VSYS analysis aggregates the information provided for its VRs/VWires, and should be used for most AFA analysis features, such as policy optimization recommendations.

VR/VWire analysis data provides the ability to troubleshoot routing and topology issues, such as traffic simulation query results, manage risks, and determine which risky rules to trust.

Although the VSYS analysis aggregates the information for each VR/VWire under it, the VSYS analysis does not contain all the data provided in the VR Report/Analysis.

AFA supports all inter-VR and inter-VSYS cases, whether they are by shared VR or an explicit inter-VR, by doing the following:

  • Using shared VRs
  • Using the VR as a next-hop router
  • Including the inter-VSYS using the external zones

Note: Shared Gateways are partially supported, only when the virtual router is already included in the devices tree.

When AFA detects either of these inter-VR routing configurations, it adds fake, or back-plane interfaces to the firewall's VR URT file to simulate these connections. These connections can then be displayed on the AFA network map and in traffic/routing query results.

Panorama device permissions

ASMS requires the following device permissions to connect to Palo Alto Panorama devices:

ASMS requires a Panorama REST API account configured with Configuration and Operational Requests permissions.

For example:

When ActiveChange is enabled, ASMS requires the Export permission.
When PanoramaActiveChangeCommit ="Panorama", "Full", or "Selected", the Commit permission must be enabled as well. (For more details see PanoramaActiveChangeCommit)
For more about these FireFlow modes, see Configuring ActiveChange Implementation Behavior for Palo Alto Panorama Devices.

Example 1
Permissions selection without implementing the FireFlow modes mentioned above:

Example 2

Permissions selection when implementing one of the FireFlow modes mentioned above:

Palo Alto Networks Firewall device permissions

To connect to Palo Alto firewall devices, ASMS requires one of the following types of users:

  • Superuser (read-only)
  • Device Admin
  • Device Admin (read-only)

If the Palo Alto firewall is a version earlier than 4.1.7, is managed by Panorama, but is defined directly in AFA, ASMS requires one of the following types of users:

  • SuperUser (read/write)
  • Admin (read/write)

Add a Palo Alto Networks Panorama

This procedure describes how to add a Palo Alto Networks Panorama device to AFA.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor and device selection page, select Palo Alto Networks > Panorama.

    The Access Permission page opens.

  3. Complete the fields as needed.

    Host

    Enter the host name or IP address of the device.

    User name

    Enter the administrative username to use for REST API access to the device.

    For more details, see Panorama device permissions.

    Password

    Enter the associated password.

    High Availability

    Select this option to configure a High Availability cluster.

    If selected, you must also enter a value for the Secondary field.

    Secondary Panorama

    Type the host name or IP address for the secondary device.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    Select this option to enable ActiveChange for the device. For more details, see Implement changes with ActiveChange.

    Syslog-ng server

    Specify the syslog-ng server. For details, see Specify a Syslog server.

    Log collection frequency

    Type the interval of time in minutes, at which AFA should collect logs for the device.

    You must also configure the device to send syslog messages. For more details, see Configure log collection on a Panorama device.

    Note: To process logs from the devices managed by the Panorama, you may need to specify additional device identifiers, especially when the sub-device is represented by multiple or non-standard device identifiers in the logs. This may be relevant, for example, with firewall clusters or non-standard logging systems.

    For more details, see Add additional device identifiers for sub-systems.

  4. If you enabled ActiveChange, the ActiveChange License Agreement dialog is displayed.

    Select I Agree and click OK.

  5. Click Next to continue to the Managed Devices page.

    This page lists the devices that are managed by the Panorama, including standalone devices and virtual systems.

  6. (Optional) To exclude a device, clear its check box in the table.

  7. device

    Do the following:

    1. Double-click on the row of the device to edit.

    2. Enter Host IP, User Name, and Password in the appropriate fields.

    3. (Optional) Select options from the following dropdowns.

      Log Collection Method

      Select one of the following to determine log functionality for a selected device:

      • None (default): Disable logging.
      • Standard: Enable logging.
      • Extensive: Enable logging and the Intelligent Policy Tuner.

      This enables AFA to detect policy optimization data, such as unused rules, and display them in the Policy Optimization section of the AFA report. For details, see POLICY OPTIMIZATION page.

      Note: Completing log collection and monitoring details on the Access Permission page enables the Log Collection Method dropdown.
      Baseline Profile

      Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device.

      The drop-down list includes all the relevant baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles

      Select None (default) to disable Baseline Compliance Report generation for this device.

      Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF.

      Tip: Selecting a baseline profile other than None automatically allows you to edit the Host IP, User Name, and Password fields.

    4. Click Test Connectivity to test connectivity to the defined device.

      Note: This triggers a direct SSH connection to the device.

    devices in bulk

    Do the following:

    1. Click .

      The Bulk Update window appears.

    2. Select the checkboxes of the credentials and settings you want to update and enter appropriate values.

      Log Collection Method

      Select one of the following to determine log functionality for a selected device:

      • None (default): Disable logging.
      • Standard: Enable logging.
      • Extensive: Enable logging and the Intelligent Policy Tuner.

      This enables AFA to detect policy optimization data, such as unused rules, and display them in the Policy Optimization section of the AFA report. For details, see POLICY OPTIMIZATION page.

      Note: Completing log collection and monitoring details on the Access Permission page enables the Log Collection Method dropdown.
      Baseline Profile

      Select the baseline compliance profile to use, in order to enable generation of Baseline Compliance Reports for this device.

      The drop-down list includes all relevant baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles

      Select None (default) to disable Baseline Compliance Report generation for this device.

      Note: If this router is divided into VRF modules, Baseline Compliance Reports will only be generated for the root/default VRF.

      Tip: Selecting a baseline profile other than None automatically allows you to edit the Host IP, User Name, and Password fields.
      User Name User name associated with the device
      Password Pasword associated with the device

    3. Click Update All.

    4. Click Test Connectivity to test connectivity to the defined device.

      Note: This triggers a direct SSH connection to the device.

      A message informs you whether AFA connected to the device successfully.

  8. Select the remaining options as needed:

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes.

    For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for this device.

  9. Click Finish. The new device is added to the device tree.

    In the device tree, Panoramas are represented with a four tier hierarchy: Panorama, PA firewall, VSYS, and VR/Vwire.

    Passive-Active clusters, including VSYSs and firewalls display as follows:

    • Display as a single node on the tree and on the map.
    • Cluster display names in the device tree, report, and so on, represent both names of the cluster members. For example: NODE1_NODE2
    • Sub-nodes of the device, such as a VSYS, follow afterward. For example: NODE1_NODE2_VSYS1
    • Baseline compliance: Define the active node details in the device definition wizard.
    • For Active-Active clusters, AFA includes both nodes in the tree.

  10. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

A success message appears to confirm that the device is added.

ASMS can collect log data by receiving syslog messages from the Panorama device, or by collecting syslog messages from a remote syslog-ng server.

This procedure describes how to configure the Panorama device to send syslog messages to ASMS. For more details, see Log Collection and Monitoring.

On the Panorama device, do the following:

  1. Configure a new Syslog Server Profile for the syslog server. For details, see Palo Alto KnowledgeBase.

  2. Configure the log settings by selecting all severities. For example:

See Configure a Panorama device that manages a Prisma Access

Configure one-armed mode manually

AFA automatically identifies Palo Alto Panorama devices in one-armed mode when the device has a single interface, or a single one non-management interface. If your device has multiple non-management interfaces and one-armed mode is not identified automatically, configure this for your device manually.

Do the following:

  1. On the AFA machine, access your device configuration meta file as follows:

    /home/afa/.fa/firewalls/<device_name>/fwa.meta

    where <device_name> is the name of the device listed. If you device is listed multiple times, enter the longer name.

  2. On a new line, enter:

    is_steering_device=yes

  3. Run an analysis on the device to update the device data in AFA.

Add a Palo Alto Networks firewall

This procedure describes how to add a Palo Alto Networks firewall to AFA.

Note: Palo Alto Networks firewalls defined directly in AFA do not support the advanced routing analysis provided for Palo Alto Networks devices defined at the Panorama level. AFA does not identify individual VR/Vwires and therefore does not benefit from the routing information they provide.

For more details, see Add a Palo Alto Networks Panorama.

Do the following:

  1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

  2. In the vendor device selection page, select Palo Alto Networks > Firewall.

  3. Complete the fields as needed.

    Host

    Type the host name or IP address of the device.

    User Name

    Type the administrative username to use for SSH access to the device.

    If the device is managed by Panorama and Panorama is used to push all or part of the device's configuration, you must provide a user of the Superuser type.

    If the device is either not managed by Panorama, or it is managed by Panorama but no configuration is pushed from Panorama towards the device, then you can specify a username of any of the following types: Superuser, Superuser (Read Only), Device Admin, or Device Admin (Read-Only).

    Password

    Type the password to use for SSH access to the device.

    Select the remote agent that should perform data collection for the device.

    To specify that the device is managed locally, select Central Manager.

    This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

    To enable generation of Baseline Compliance Reports for this device, select the baseline compliance profile to use.

    The drop-down list includes all baseline compliance profiles in the system. For more information on baseline compliance profiles and instructions for adding new baseline compliance profiles, see Customize baseline configuration profiles.

    To disable Baseline Compliance Report generation for this device, select None.

    Specify how AFA should acquire the device's routing information:

    • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
    • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For more information, see Specify routing data manually.

    Select a method of data collection:

    • SSH (more secure)
    • Telnet

    Then define the following:

    Custom Port

    To specify a custom port, select this option and type the port.

    This option is only relevant when SSH is selected.

    Number of allowed encryption keys

    Enter the permitted number of different RSA keys received from this device's IP address.

    Different RSA keys may be sent from the same IP address in cases of cluster fail-over, device operating system upgrades, etc. For example, if a cluster fail-over occurs, the secondary node will send a new RSA key from the same IP address to AFA. If this number is set to 1, the connection to the node will fail, resulting in a failed analysis.

    Specify whether AFA should collect logs for the device, by selecting one of the following:

    • None: Do not collect logs.
    • Standard: Enable log collection.
    • Extensive: Enable log collection and the Intelligent Policy Tuner.

    The default value is Extensive.

    Additionally, define the following values:

    Syslog-ng server

    If you selected Standard or Extensive in the Log collection method field, you must specify the syslog-ng server. For details, see Specify a Syslog server.

    Additional firewall identifiers

    Enter any additional IP addresses or host names that identify the device.

    When adding multiple entries, separate values by a colon (:). For example: 1.1.1.1:2.2.2.2:ServerName

    This is relevant when the device is represented by multiple or non-standard device identifiers in the logs, for example, in cases of firewall clusters or non-standard logging settings. If AFA receives logs with an identifier it does not recognize, the logs will not be processed.

    Note: This field is not supported for sub-systems (Juniper VSYS/LSYS, Fortinet VDOM, Cisco security context, etc.). To configure additional identifiers for sub-systems, see Add additional device identifiers for sub-systems.

    Log collection frequency

    Type the interval of time in minutes, at which AFA should collect logs for the device.

    Real-time change monitoring

    Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.

    Set user permissions

    Select this option to set user permissions for the device.

  4. Click Finish.

    The new device is added to the device tree, with a two tier hierarchy: firewall and VSYS.

  5. If you selected Set user permissions, the Edit users dialog box appears.

    In the list of users displayed, select one or more users to provide access to reports for this account.

    1. To select multiple users, press the CTRL button while selecting.

    1. Click OK to close the dialog.

    6. A success message appears to confirm that the device is added.

 

â See also: