Proactively Enforce Security Checks

If your AIOps for NGFW app has been updated to give you the new Strata Cloud Manager management experience, visit these docs instead. Here's how to switch between the two AIOps for NGFW guides based on the interface you're using:

The

Panorama CloudConnector Plugin

enables you to take proactive measures against suboptimal configurations by blocking commits that do not pass particular best practice checks. When you indicate in

AIOps for NGFW

that you want a check to

Fail Commit

, Panorama automatically blocks commits of any configuration that does not pass that check. Rather than wait to receive an alert about a failed best practice check, use the plugin to keep configuration issues out of your deployment in the first place.

Ensure that you meet all prerequisites, and install the plugin.
Specify the best practice checks that will block commits on failure.
Log in to
AIOps for NGFW
.
Select
Settings
Security Checks
.
Find the check that you want to block commits.
Set
Action on Fail
to
Fail Commit

Verify by attempting to commit a configuration that does not pass the check.
Log in to Panorama.

Violate the best practice check that you specified to

Fail Commit

.



Select

Commit

Commit to Panorama

Validate Configuration

.


You should see a dialog stating that the validation failed because the configuration did not pass the best practice check.

Setting a check to
Fail Commit
causes the check to fail both validation and the actual commit operation.