Early availability features

Enable ActiveChange for MSO- and NDO-managed Cisco ACI tenants

ActiveChange for Cisco ACI tenants managed by a Cisco MSO (Multi-Site Orchestrator) and NDO (Network Data Orchestrator) is available as an early availability feature.

With this early availability feature enabled, you can add, modify and remove rules from the policy directly from FireFlow.

When Cisco ACI tenants are managed by an MSO/NDO, each APIC in turn can manage one or more tenants. Each tenant contains one schema, with one or more associated templates. Schemas and templates are configured in FireFlow in order to implement ActiveChange on the device.

To enable/disable early availability ActiveChange for MSO- and NDO-managed Cisco ACI in AFA

1. In the AFA Administration area, navigate to the Options > Advanced Configuration tab.

   

2. Click ADD to add a new configuration parameter, and enter the following details

   Name	AlgoSec_EA_MSO_ActiveChange
   Value	Enter one of the following: true = Enable MSO-and NDO-managed Cisco ACI tenants ActiveChange support false (default) = Disable MSO-and NDO-managed Cisco ACI tenants ActiveChange support

3. Click OK

Palo Alto Networks Prisma Access devices in ASMS

This section describes the ASMS Early Availability support for Palo Alto Networks Prisma Access devices:

• Supported features in Early Availability
• Limitations
• Network connectivity
• Device permissions
• Prisma Access visibility in the device tree
• Enable / Disable early availability support for Prisma Access
• Configure a Panorama device that manages a Prisma Access

Supported features in Early Availability

ASMS supports Prisma Access devices as follows:

• Policy visibility

• Risk analysis

• Traffic Simulation Query

• Remote Networks and Service Connections

• Mobile users

The following functionality is not supported:

• Changes

• Policy optimization recommendations based on traffic like Intelligent Policy Tuner (IPT) and unused rules

• FireFlow support

Limitations

Panorama Prisma Access has the following limitations:

• Basic Search: Possible inaccurate results from RuleBase searches when using exact match.

Network connectivity

The connection to Prisma Access is done via the Panorama device that manages it:

Device permissions

Use same permissions required for Palo Alto Panorama devices. See Panorama device permissions.

Prisma Access visibility in the device tree

Prisma Access is added under the existing Panorama tree as follows:

1. Level 1 Panorama Host (IP/Name )

2. Level 2 Cloud_Services (Prisma Access) managed by single Panorama devices

3. Level 3 Cloud_Services_Remote_Networks / Cloud_Services_Service_Connections / Cloud_Services_Mobile_Users

4. Level 4 Cloud_Services_Remote_Networks_<Remote_Network_Name> / Cloud_Services_Service_Connections_<Remote_Network_Name> / Cloud_services_Mobile_users_<Portal_Host-Name or Host>

Enable / Disable early availability support for Prisma Access

By default Prisma Access is disabled. This procedure describes how to enable support for Prisma Access devices in ASMS.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter. For more details, see Advanced Configuration.

3. Define the parameter value as follows:

   Name	AlgoSec_EA_Panorama_Prisma_Support
   Value	One of the following: yes = Enable Prisma Access device support no = Disable Prisma Access device support

4. Logout from ASMS and then login again.

5. If you already have Panorama device(s) that manage Prisma Access onboarded to ASMS, run Edit-Next (Edit device wizard) on this/these Panorama(s). If you do not have Panorama device(s) that manage Prisma Access onboarded, onboard them. See Add Palo Alto Networks devices.

6. Continue with Configure a Panorama device that manages a Prisma Access .

Configure a Panorama device that manages a Prisma Access

This procedure describes how to configure Panorama device that manages a Prisma Access in AFA.

Do the following:

Create visualizations

For Risks reports and Changes Summary reports (on the Risks tab): individual and grouped devices

For Policy Optimization reports: grouped devices only

You can define a range of data to include in a new custom visualization. This is helpful when you want to create a graph from a specific set of data, and can even be used to visualize data that doesn't include numeric data.

Do the following:

1. From the list, drag to select the rows and columns to use for the visualization.

2. Right click in the selection to bring up a popup menu.

3. Select Chart range and visualization style you require.

   Your custom visualization appears.

Add/Update/Delete devices in bulk from xslx file

This section describes the ASMS Early Availability support for Add/Update/Delete devices in bulk from xslx file:

• Enable / Disable early availability support for Bulk Add/Update/Delete devices

• How to perform bulk Add/Update/Delete devices

• How to use the sample files

This Early Availability feature allows you to Add/Update/Delete devices in bulk from an xlsx file and offers you the following advantages:

• Support for bulk delete devices.

• Support for the following management devices:

  • PV1

  • CMA

  • Space

  • Panorama

  • Fortimanager

• Support for these additional brands:

  • AWS

  • Azure

  • Google Cloud

  • Cisco Meraki

  • Device from file (for more information about Device from File, see Alternate data collection methods)

• Support to define optional fields

• Support for commenting out a row: if you want to avoid executing a bulk operation from that row

  Known Issue: Cisco Meraki onboarding with children

  Currently there is no Children tab in the Cisco Meraki Excel template. To onboard children, you can use the 'selected_devices' column. The Children tab will be added in the future.

Enable / Disable early availability support for Bulk Add/Update/Delete devices

This procedure describes how to enable or disable support for Bulk Add/Update/Delete devices.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter value as follows:

   Name	Bulk_Add_Remove_EA
   Value	One of the following: ON = Enable bulk Add/Update/Delete devices support using xlsx files. OFF = Use legacy bulk Add/Update devices support using csv files.

For more details, see Advanced Configuration. Continue with How to perform bulk Add/Update/Delete devices.

How to perform bulk Add/Update/Delete devices

To Add/Update/Delete devices in bulk, use the sample files. You download the sample files as part of the procedure, described in Step 4a below. The sample files are in excel (.xlsx) format.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. Click Bulk.

   

3. Click Add/Update/Delete devices. The Bulk Device Operations dialog appears.

   

4. To use this EA feature:

   1. Click Download sample files to download sample excel files.

   2. Edit the files as required. See How to use the sample files.

   3. XLSX/CSV file: Browse to and select your prepared xlsx file.

   4. Ensure that the devices you plan to change are online and accessible by AFA via SSH.

   5. Select one operation:

      • Add New Devices to bulk add devices

      • Update Devices to bulk update devices

      • Delete Devices to bulk delete devices

   6. Click Add/Update/Delete as required. A confirmation message is displayed when the process is finished.

How to use the sample files

For Bulk add or update operations

• All brands have their designated sample file. Each brand has its own set of parameters.

  You can also use the Others.xlsx to add or update the following device brands in one place. (You can combine several brands together in the file):

  • F5

  • Cisco Identity Services Engine (ISE)

  • Cisco Application Centric Infrastructure (ACI)

  • Fortinet Fortigate

  • Juniper SRX

  • VMWare NSX-V

  • Palo Alto Firewall.

• For all device types: The same single template file can be used for both add or update operation. However, you need to run the add and update operations separately.

• For Management Devices (PV1, CMA, Juniper Space, Panorama, and Fortimanager): Fill out both the parent and children tabs. The expected behavior for working with child devices for management devices varies per brand.

  Expected behavior per brand

  Brand	Adding Children		Instructions
  	Add all children automatically	Add only selected children
  Panorama	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Juniper space	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Cisco Firepower	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. When set, you cannot add only the parent without specifying child devices.
  Fortimanager	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child devices to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Checkpoint Smart Center	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child device to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Checkpoint PV1	YES	NO	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add children to Children Sheet).

  Close ⌃

• Supported device brand values

  Use the following Brand Name code values to indicate device brands:

  Brand	Brand Name code
  Web Services (AWS) EC2	aws
  Azure	azure
  Cisco Application Centric Infrastructure (ACI)	ciscoaci
  Cisco ASA	pix
  Cisco Identity Services Engine (ISE)	ciscoise
  Cisco IOS	ios
  Cisco Nexus Router	nexus
  Checkpoint Smart Center	cma
  Checkpoint Provider 1	pv1
  F5 BIG-IP LTM and AFM	f5bigip_afm
  Device from file	file
  Cisco Firepower	firepower
  Fortinet Fortigate	fortigate
  Fortinet Fortimanager	fortimanager
  Google Cloud Platform	gcp_cloudflow
  Juniper SRX	junos
  Juniper Netscreen	nsc
  Juniper Space	space_security_director
  VMWare NSX-V	nsx
  VMWare NSX-T	nsxt
  Palo Alto Firewall	paloalto
  Palo Alto Panorama	panorama
  Cisco Meraki	ciscomeraki

  Close ⌃

Close ⌃

For Bulk Delete operation

• Use the same file Delete.xlsx for all supported device brands simultaneously.

Close ⌃

Google Cloud Map and Traffic Path

This section describes the ASMS Early Availability support for Google Cloud Map and Traffic Path .

Supported Features

AlgoSec already supports visibility, risks calculations, and policy clean-up for Google Cloud Projects. In this Early Availability feature, additional ASMS capabilities include:

• Map topology

• Project hierarchy visibility in the ASMS tree: You will see project levels in the tree see Device tree display of Google Cloud Project.

• Traffic path: When you run a Traffic Simulation Query, relevant Google Cloud VPCs and other virtual cloud firewalls are identified in the path. (In this first phase, Google Cloud VPC traffic is always shown as allowed, ignoring the existing firewall rules in the VPC).

Network connectivity

Enable / Disable early availability support for Google Cloud Map and Traffic Simulation Query

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter value as follows:

   Name	ALGOSEC_EA_GCP
   Value	One of the following: yes = Enable support for Google Cloud Map and Traffic Path. no = Do not enable support for Google Cloud Map and Traffic Path.

Device tree display of Google Cloud Project

in the device tree, Google Cloud has a three-tier hierarchy:

1. Organization

2. Project

3. VPC

Onboard AWS accounts to both ACE and ASMS simultaneously

This early availability feature allows you to onboard AWS accounts from one central location—ACE. Once you add accounts to ACE, they will automatically be onboarded to ASMS, using the permissions set in ACE.

In environments that include Load Distribution Units, set the flag Data_Collection_Slaves=false.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Add the following new parameter and set its value to yes:

   EA_CF_Auto_Onboard=yes

4. In ASMS environments with Load Distribution, add the following new parameter and set its value to false:

   Data_Collection_Slaves=false.

   (In ASMS environments with Load Distribution, this feature will not work unless this flag is set)

5. Integrate ASMS with ACE: If ASMS is not yet integrated with ACE, refer ASMS integration to SaaS services for guidance.

6. In AFA, click your username, and select Administration > Integrations.

   

7. Click Sync Now. This aligns ACE entity inventory including permissions with ASMS.

   Added accounts to ACE, will automatically be onboarded to ASMS, including all associated permissions.

8. For instructions on how to add new accounts, visit AWS Account Management in ACE Tech Docs.

Sync between ASMS and ACE

When you make changes to the status of accounts in ACE, you need to sync these changes to ASMS to ensure alignment.
This is particularly useful:

• After upgrading to A33.00.

• After updating ActiveChange permissions for AWS accounts in ACE.

• After initially connecting ASMS and ACE.

• If there is a discrepancy in account listings between ASMS and ACE.

You can initiate a sync in one of two ways:

• In AFA: click your username, and select Administration > Integrations.

  

  Click Sync Now. This aligns ACE entity inventory including permissions with ASMS.

• Use the Sync AWS Accounts API: by sending a POST request to /aws-accounts/sync. See Sync ACE Resources with ASMS .

Edit AWS accounts onboarded with ACE

After onboarding an AWS account with ACE, you can still update AWS account details directly in ASMS.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. Select the AWS account from the device tree that you want to edit and click Edit.

   The Web Services (AWS) EC2 page opens.

   

3. Complete the fields as needed.

   Access Information	In the Display Name field, enter the name that you want to appear in the device tree for this account. Tip: Use the account's host or route name.
   Active Change	This read-only field displays whether ActiveChange is enabled or not. To update the ActiveChange status of an onboarded AWS account, see Update AWS details.
   Additional Information	Network Elements Collection Source This read-only field displays the source module that collects the network elements of the subject AWS account and updates the network map. The default source is Firewall Analyzer. To switch to ACE for better AWS network element support in the network map, set the AWS_Network_Elements_Parse_From_AFA parameter to false.For instructions on how to modify this parameter, see Configuring the AWS Network Elements Collection Source in Algopedia . Note: When connected with ACE, you no longer need to provide an AWS Access Key ID or AWS Secret Access Key.
   Route Collection	Select one of the following to determine how AFA should acquire the device's routing data. Automatic. Automatically generate routing data upon analysis or monitoring. Static Routing Table (URT). Take the device's routing data from a static file that you provide. For details, see Specify routing data manually.
   Options	Select the following options for your AWS account as needed: Real-time change monitoring.Select this option to enable real-time alerting upon configuration changes. For more details, see Configure real-time monitoring. Set user permissions. Select this option to set user permissions for this device.
   Proxy	Click Set Proxy Server to configure a proxy server to connect all cloud devices defined in AFA, including both AWS and Azure. For more details, see Define a proxy server .

4. Click Edit to save your changes.

5. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   1. To select multiple users, press the CTRL button while selecting.

   2. Click OK to close the dialog.