Early availability features

This topic describes features available as Early Availability (EA) and how to enable ASMS's Early Availability features.

ASMS's Early Availability features enable you to access new functionality and support earlier than general availability. Customers partaking of Early Availability often provide invaluable feedback on the design and implementation of these features. Early Availability features have shorter QA cycles than GA features, and therefore are disabled by default.

Configure ActiveChange behavior for MSO- and NDO-managed Cisco ACI tenants in FireFlow

In ACI MSO/NDO, there is no default value for the schema and template. In order to implement ActiveChange for the MSO- and NDO- managed Cisco ACI tenants, user-defined schema and templates are required for each tenant.

{ <Apic ID/Name> : {<tenant Name> : 

{ "schema":<Schema name>, "templates":[<template1>,<template2>...]}

}}

To configure ActiveChange behavior for MSO- and NDO-managed Cisco ACI tenants:

1. Switch to FireFlow.

2. Click the Advanced Configuration tab.

   The Advanced Configuration page is displayed.

3. In FireFlow Configuration, Click ActiveChange and filter for CiscoACIMSOActiveChangePolicyTargets or just scroll to find it.

4. Click on the edit icon next to the current value field. Define the schema and templates for one tenant.

   For example:

   Copy

   {
                               "10_20_30_40": {
                               "10_20_30_40_ActiveChangeEA": {
                               "schema": "Payroll",
                               "templates": [
                               "Detroit",
                               "Baltimore",
                               "Abu Dhabi"
                               ]
                               }
                               }
                           }

5. Click Update below the current value field to update the value.

6. Filter for CiscoMsoActiverChangeCommit or just scroll to find it.

   Assign a value to this parameter to determine whether or not ActiveChange deploys changes to APICs.

7. Click Update below the current value field to update the value.

8. Click Store Changes at the top of the page.
9. Restart FireFlow.

Support for NSX-T deployed on AWS (VMC)

This section describes the ASMS Early Availability support for NSX-T deployed on AWS (VMC).

• Supported Features
• Unsupported Functionality
• Limitations
• Network connectivity
• Device permissions
• Enable / Disable early availability support for NSX-T deployed in AWS
• Add a VMware NSX-T to AFA

Supported Features

ASMS supports NSX-T deployed in AWS (VMC) as follows:

• VRFs separation

• Rules visibility

• Report Generation

• Topology

• Change History

• Risks Calculation

• Map Visibility

• Regulatory Compliance

• Traffic Simulation Query

• Monitor Cycle

Unsupported Functionality

The following functionality is not supported:

• ActiveChange

• L2 Rules
  

• Changed by (Audit Logs collection)

• Traffic-related recommendations

• IPT and unused rules (Traffic Logs collection)

• IPV6 rules and NSGroups with IPV6 content

Limitations

NSX-T on AWS has the same limitations as NSX-T on-premise, e. g.:​​

• NSX-T is shown only in TSQ result mini map​

• ASMS supports only Distributed Firewall (for East-West traffic)

Network connectivity

VMware Cloud on AWS uses NSX-T to create and manage internal SDDC networks and provide endpoints for VPN connections from your on-premises network infrastructure.

Device permissions

Device analysis on NSX-T that is hosted on AWS (VMC)

ASMS requires minimal, read-only access permissions to access VMware NSX-T data centers and perform data collection.

The user accessing the VMware NSX-T Data Center for analysis and monitoring must have one of the following NSX-T roles:

• EA - Enterprise Administrator
• A - Auditor
• Custom role/permissions (use R flag for all features/components)

Note: If you are using the NSX Manager, we recommend using the built-in NSX Manager user to connect from ACE.

Enable / Disable early availability support for NSX-T deployed in AWS

This procedure describes how to enable or disable support for NSX-T deployed in AWS in ASMS.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter value as follows:

   Name	AlgoSec_EA_NSXT_Cloud
   Value	One of the following: yes = Enable NSX-T deployed in AWS device support no = Disable NSX-T deployed in AWS device support

For more details, see hidAdvanced Configuration. Continue with Add a VMware NSX-T to AFA.

Add a VMware NSX-T to AFA

This procedure describes how to add a VMware NSX-T that is hosted on AWS (VMC) to AFA.

Do the following:

1. From the Administration area, access the Devices Setup page. For details, see Access the DEVICES SETUP page

2. Click New > Devices > VMware > NSX-T. In the vendor device selection page, click VMware > NSX-T.

3. For NSX-T that is hosted on AWS (VMC), select In Cloud.

   

4. Complete the fields as needed.

   Access Information NSX-T that is hosted on AWS (VMC)

   Device name	Give the device a name. This is the name that will be displayed in the devices tree. Tip: To avoid future confusion, we recommend you use the SDDC name for the device name.
   Organization ID	Organization ID (from VMware Cloud interface)
   SDDC ID	Software-Defined Data Center (SDDC) ID number (from VMware Cloud interface). Each SDDC needs to be added separately.
   API Token	API token. Generate a token from your VMware Cloud services account. Specify the roles required for on-boarding:

   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Additional Information

   Select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked.

   In reality, the default behavior for NSX-T devices is to allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device.

   Note: Learning mode is supported for NSX-T versions 3.0 and above.

   Route Collection

   Specify how AFA should acquire the device's routing information:

   • Automatic. AFA will automatically generate the device's routing information upon analysis or monitoring.
   • Static Routing Table (URT). AFA will take the device's routing information from a static file you provide. For details, see Specify routing data manually.
   Options

   Real-time change monitoring	Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.
   Learning mode	You can select the Learning mode option to specify that AFA traffic simulation should treat traffic that is not specified in a rule as blocked. By default, DBWs allow all traffic that is not explicitly blocked. Learning mode enables you to better understand the specific traffic that needs to be allowed on the device. Note: Learning mode is not supported for NSX-T versions below 3.0.

5. Click Finish. The new device is added to the device tree.

6. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   1. To select multiple users, press the CTRL button while selecting.

   2. Click OK to close the dialog.

A success message appears to confirm that the device is added.

Data visualizations for reports

This Early Availability feature allows you to see report data in a customizable graph.

• View data visualizations

• Create visualizations

• Work with visualizations

View data visualizations

For Risks reports and Changes Summary reports (on the Risks tab)

To view visualizations:

• Click Graphs on the relevant report page. The section expands to show the graphs.

  

Work with visualizations

1. To change the layout and style, click the arrow on the right side of a graph.

   

   A tabbed menu of options appears where you can change the appearance and select which data is graphed.

   

2. To change the title of the visualization, double click the title text.

   Note: If you don't see a title, you can enable it as follows:

   1. Click the arrow on the right side of the graph.

      The layout and style options appear.

   2. Select the Format tab.

   3. Click Chart to expand the chart options.

   4. Click Enabled.

3. Click to save a copy of the displayed visualization onto your computer as a PNG file.

4. Click to link / unlink the visualization to the list below. When linked, the relevant columns in the list are highlighted, and any rearrangement, filtering, and sorting of the highlighted list columns also update the data visualization.

How to use the sample files

Tips:

• To comment out rows from the sample file: (add a ‘#’ to the Exclude column of the row ) if you want to avoid executing a bulk operation from that row.

  

  1. Note or instruction is excluded.

  2. The device will not be considered in the add/update/delete operation.

• Required fields are shown in blue in the header of the sample files.

For Bulk add or update operations

• All brands have their designated sample file. Each brand has its own set of parameters.

  You can also use the Others.xlsx to add or update the following device brands in one place. (You can combine several brands together in the file):

  • F5

  • Cisco Identity Services Engine (ISE)

  • Cisco Application Centric Infrastructure (ACI)

  • Fortinet Fortigate

  • Juniper SRX

  • VMWare NSX-V

  • Palo Alto Firewall.

• For all device types: The same single template file can be used for both add or update operation. However, you need to run the add and update operations separately.

• For Management Devices (PV1, CMA, Juniper Space, Panorama, and Fortimanager): Fill out both the parent and children tabs. The expected behavior for working with child devices for management devices varies per brand.

  Expected behavior per brand

  Brand	Adding Children		Instructions
  	Add all children automatically	Add only selected children
  Panorama	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Juniper space	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. Selection of children is optional.
  Cisco Secure Firewall	NA	YES	In Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet. When set, you cannot add only the parent without specifying child devices.
  Fortimanager	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child devices to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Check Point Smart Center	YES	YES	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add child device to Children Sheet). To add selected children, in Parent Sheet, set apply_children=yes and specify the child device details on the Children Sheet.
  Check Point PV1	YES	NO	To add all children automatically, in Parent Sheet, set apply_children=yes (no need to add children to Children Sheet).

• Supported device brand values

  Use the following Brand Name code values to indicate device brands:

  Brand	Brand Name code
  Web Services (AWS) EC2	aws
  Azure	azure
  Cisco Application Centric Infrastructure (ACI)	ciscoaci
  Cisco ASA	pix
  Cisco Identity Services Engine (ISE)	ciscoise
  Cisco IOS	ios
  Cisco Nexus Router	nexus
  Check Point Smart Center	cma
  Check Point Provider 1	pv1
  F5 BIG-IP LTM and AFM	f5bigip_afm
  Device from file	file
  Cisco Secure Firewall	firepower
  Fortinet Fortigate	fortigate
  Fortinet Fortimanager	fortimanager
  Google Cloud Platform	gcp_cloudflow
  Juniper SRX	junos
  Juniper Netscreen	nsc
  Juniper Space	space_security_director
  VMWare NSX-V	nsx
  VMWare NSX-T	nsxt
  Palo Alto Firewall	paloalto
  Palo Alto Panorama	panorama
  Cisco Meraki	ciscomeraki

For Bulk Delete operation

• Use the same file Delete.xlsx for all supported device brands simultaneously.

PAN Panorama | EDLs (External Dynamic Lists) in policy destinations

This procedure describes how to enable or disable support for EDLs (External Dynamic Lists) for Palo Alto Panorama devices. This early availability feature works with IP address and URL type lists.

• For IP address type lists: The EDL source will point to a list of IPs (click for an example). You can add it to Source or Destination fields in rules.

• For URL type lists: The EDL source will point to a list of URLs (click for an example). You can add it to URL Category fields in rules only.

  Note: For URL type lists, URLs with wildcards are ignored. For example: *.office365.us/ will not be read.

To enable support for EDLs

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Add the following new parameter and set its value to yes:

   • ALGOSEC_EA_PANORAMA_EDL=yes

   Note: Other configurable parameters that are related to this feature include:

   • PA_URL_CAT_DNS_LIMIT (default=500)

   • DNS_Lookup_Timeout (default=4)

   • PAN_EDL_COLLECT_TIMEOUT (default=10)

   For more details, see hidAdvanced Configuration.

Display VNets with no virtual machines in the ASMS tree and map

Traffic in Azure sometimes passes through VNets which do not contain virtual machines. By default, VNets with no virtual machines do not appear in the ASMS tree. As a result, they are not shown in the map or included in the TSQ results. Use this early availability parameter to determine whether or not to show these VNets in the ASMS tree.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter as follows:

   Name	DisplayVNetWithoutVMs
   Value	One of the following: true = Include VNets with no virtual machines in the ASMS tree false (default) = Exclude VNets with no virtual machines from the ASMS tree

Display AWS Gateway Load Balancers in the device tree and network topology map

This early availability feature enables ASMS to display AWS Gateway Load Balancers in the device tree and network topology map. Requires integrating ASMS with ACE. See Enable ACE - ASMS integration (optional).

Limitations

AWS Gateway Load Balancers have the following limitations:

• Only Palo Alto Panorama firewalls with AWS GWLB are supported. Other firewall brands are untested.​

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define the parameter as follows:

   Name	AlgoSec_EA_AWS_GWLB
   Value	Possible values: true = AWS Gateway Load Balancers will appear in the Device Tree and Network Map. Note: Once enabled, AWS Gateway Load Balancers will appear in the Device Tree and Network Map after the next monitor cycle. false = AWS Gateway Load Balancers will note appear in the Device Tree and Network Map.

Automate rule removal change requests from the Disabled Rules report

You can create change requests in FireFlow to remove rules right from the Disabled rules report of the Policy Optimization page.

To enable the remove rules automation

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Add the following new parameter and set its value to yes:

   • EA_DISABLED_RULES_NEW_UI=yes

4. Click Ok to save the changes.

To use the remove rule automation

Do the following:

1. In AFA, select the device with disabled rules that you want to remove. For more details, see View AFA device data.

2. Click on Latest Report.

3. Click the Policy Optimization tab.

   The Policy Optimization page appears.

4. Click on the Disabled rules report.

   The disabled rules appear.

   

5. Select the check box(es) to the left of the rule(s) to remove.

   Note: Click the check box in the header to select all of the rules.

6. Click the Remove Rule button.

   The change request(s) are created and the Remove Rules Change Requests popup appears.

   

   Understanding the the Remove Rules Change Requests popup:

   • Why are there multiple change requests?

     Change requests contain a maximum number of rules (determined by the Num_of_Rules_Per_AFF_Ticket parameter). When the total number of selected rules exceeds this limit, the rules are split across multiple change requests.

   • Failed requests explanation:

     If there is at least one failed rule in a change request then the entire request fails.

7. Click on the change request number to open the change request in FireFlow.

8. To download an Excel spreadsheet containing detailed information about every successful or failed change request click Detailed XLS.

   • The Successful Requests worksheet contains the list of links to the change request created in FireFlow and associated Rule IDs.

   • The Failed Requests worksheet contains the list of failed Rule IDs and associated error messages.