Deploy AI Runtime Security: Network Intercept for Panorama Managed Firewall

Deploy AI Runtime Security: Network Intercept for Panorama Managed Firewall

1. Log in to Strata Cloud Manager.
2. Select Insights → AI Runtime Security
3. Select Network from the AI Runtime Security drop-down list at the top.
4. Select Add Protections ("+" icon).
5. Refer to Deploy AI Runtime Security: Network Intercept for the configurations as per your cloud deployment.
6. Select "Manage by Panorama" option (You can configure the deployment configuration for both Panorama standalone and Panorama High Availability (HA).

   

   • Enter an Active Panorama IP address. (Copy the Panorama active/passive IP addresses by navigating to Panorama web interface → PANORAMA→ High availability.
   • Optional Enter the Passive Panorama IP address.
   • Enter the Panorama VM auth code (Generate the VM Auth Key on Panorama).
   • Enter Device Group.
   • Enter the Template Stack name.
7. Select Next.
8. In Review Architecture screen:

   • Enter a unique Terraform template name. (Use only lowercase letters, numbers, and hyphens. Don't use a hyphen at the beginning or end, and limit the name under 19 characters).
   • Create terraform template.
   • Save and Download Terraform Template.
   • Close the deployment workflow to exit.
9. Unzip the downloaded file. Navigate to <unzipped-folder> with 2 directories: `architecture` and `modules`. Deploy the Terraform templates in your cloud environment following the `README.md` file in the `architecture` folder.
10. Initialize and apply the Terraform for the security_project.

    The security_project contains the Terraform plan to create an AI network intercept (AI firewall) architecture. This Terraform plan creates the required resources to deploy network intercept inline prevention, including the managed instance groups, load balancers, and health checks.

    cd architecture //Change directory to architecture/security_project
    
    cd security_project
    terraform init
    terraform plan
    terraform apply
    
11. Run the application Terraform to peer the application VPCs.

    cd ../application_project
    terraform init
    terraform plan
    terraform apply

    The application_security Terraform generates the following output:

    Apply complete! Resources: 12 added, 0 changed, 0 destroyed.
12. Configure Panorama to Secure VM Workloads and Kubernetes Clusters. Configure interfaces, zones, NAT policy, routers, and security policy rules.
13. Optional Enable AI network intercept to connect with Panorama. See the section below.

    The Panorama deployment doesn't need IP-tags configuration. Panorama uses the existing Panorama Plugin for Kubernetes to pull the IP-tags and notify Device Groups to push the IP-tags to the managed firewalls.