Configure Device Onboarding Rules for Cloud NGFW for AWS

Table of Contents

Migrate an AWS Network Firewall Policy to Cloud NGFW for AWS

Configure Device Onboarding Rules for Cloud NGFW for AWS

Configure Strata Cloud Manager onboarding rules to automatically assign Cloud NGFW for AWS endpoints to a folder and apply snippet configurations at first connection.

Where Can I Use This?	What Do I Need?
Cloud NGFW for AWS	Cloud NGFW subscription Strata Cloud Manager access Network Administrator or Administrator role

Device onboarding rules let you automatically assign Cloud NGFW for AWS endpoints to a Strata™ Cloud Manager folder and apply snippet configurations when they first connect. Without onboarding rules, you must manually associate each Cloud NGFW endpoint with a folder and snippets after it comes online.

When the first Cloud NGFW endpoint in a resource group connects to Strata Cloud Manager, it is evaluated against active onboarding rules. When a rule matches, Strata Cloud Manager assigns the endpoint to the configured folder and applies the associated snippets. Subsequent endpoints from the same resource group inherit the same configuration without additional evaluation. If folder assignment fails, onboarding stops; if snippet association fails, onboarding continues with the folder assignment completed.

Match criteria can include the firewall model alone or the model combined with labels. Labels are optional tags you configure in Strata Cloud Manager and attach to Cloud NGFW endpoints before they first connect. Create all labels before configuring onboarding rules so that endpoints are tagged correctly at connection time. When you create a Cloud NGFW from Strata Cloud Manager, you can optionally select labels for it. If you don't select a label, the endpoint is evaluated against rules that match on model only. If you select a label, the endpoint is evaluated against rules that match that label.

Label matching is only available when you onboard through Strata Cloud Manager. When onboarding through the Cloud NGFW console, match criteria are evaluated by model only—label matching is not available. Policy push from device onboarding rules is not supported in this release.

Create device labels to use as match criteria.
1. In Strata Cloud Manager, select NGFW & Prisma Access and set the Configuration Scope to All Firewall Folders. Select SetupDevice Onboarding, and then select the settings icon.
  
  When you select Cloud NGFW for AWS as the model, fields that apply only to hardware NGFWs, such as VPN onboarding, User Context Onboarding, and Target Image are not shown. The serial number field is not required for Cloud NGFW for AWS. To narrow the match, optionally select one or more labels from those you created in the previous step.
2. Select Device Labels and select Add Label.
3. Enter a label name and Save.
  
  Repeat to create all labels you plan to use in onboarding rule match criteria. Labels must exist in Strata Cloud Manager before the endpoint first connects.
Create a device onboarding rule.
1. In the Device Onboarding section, select Onboarding Rules and select Add Rule.
2. Under General, add a Name, Description, and select the Onboarding Type as Label-Based.
3. Under Match Criteria, set Models to Cloud NGFW for AWS. Set the Device S/N to Any.
4. Under Action, select a Target Folder to assign matching endpoints to.
5. (Optional) Under Snippet Association, select one or more snippets to apply to matching endpoints.
  
  Snippets are a tool used to standardize a common base configuration for a set of firewalls or deployments. This allows you to quickly onboard a new firewall with a known good configuration and reduces the time required to onboard a new firewall.
6. Save the rule.
  
  Device onboarding rules are processed in a top-down priority. Strata Cloud Manager evaluates each onboarding rule Match Criteria starting with the rule highest in the rule hierarchy until the Palo Alto Networks NGFW meets all Match Criteria. Strata Cloud Manager then takes the Action specified in the matching rule. In the event two rules in the device onboarding rule hierarchy apply to the same firewall, Strata Cloud Manager takes the Action configured in the device onboarding rule higher up in the rule hierarchy.