Tag Based Policies
Table of Contents
Expand all | Collapse all
-
- About Cloud NGFW for AWS
- Getting Started from the AWS Marketplace
- Register Your Cloud NGFW Tenant with a Palo Alto Networks Support Account
- Cloud NGFW for AWS Pricing
- Link Your PAYG Account with Cloud NGFW Credits
- Cloud NGFW for AWS Free Trial
- Cloud NGFW for AWS Limits and Quotas
- Subscribe to Cloud NGFW for AWS
- Locate Your Cloud NGFW for AWS Serial Number
- Cross-Account Role CFT Permissions for Cloud NGFW
- Invite Users to Cloud NGFW for AWS
- Manage Cloud NGFW for AWS Users
- Deploy Cloud NGFW for AWS with the AWS Firewall Manager
- Enable Programmatic Access
- Terraform Support for Cloud NGFW AWS
- Provision Cloud NGFW Resources to your AWS CFT
- Configure Automated Account Onboarding
- Usage Explorer
- Create a Support Case
-
-
- Prepare for Panorama Integration
- Link the Cloud NGFW to Palo Alto Networks Management
- Unlink the Cloud NGFW from Palo Alto Networks Management
- Associate a Linked Panorama to the Cloud NGFW Resource
- Use Panorama for Cloud NGFW Policy Management
- View Cloud NGFW Logs and Activity in Panorama
- View Cloud NGFW Logs in Strata Logging Service
- Tag Based Policies
- Enterprise Data Loss Prevention (E-DLP) Integration with Cloud NGFW for AWS
-
- Strata Cloud Manager Policy Management
Tag Based Policies
You can automatically update the Security Policy on your Palo Alto Networks®
Cloud NGFW resources so that you can secure traffic to these AWS assets as you deploy or
terminate AWS assets (such as EC2 instances) in the AWS public cloud.
To enable this capability from Panorama, you must configure the Panorama AWS
plugin to fetch IP/Tags that your Cloud NGFW tenant harvests from the AWS accounts you
added. Then use the AWS Panorama plugin to push these tags to the Cloud NGFW resources
by configuring the monitoring definition and Notify them to the corresponding Device
Groups corresponding to these Palo Alto Networks firewalls.
You can then create a Panorama Dynamic Address Group objects in those Device
Groups using AWS resource tags. When you reference these tags in Dynamic Address Groups
and match against them in Security policy rules, you can consistently enforce policy
across all assets deployed within your AWS accounts.
Prerequisites
To enable tag based policies for Cloud NGFW for AWS resources, the following are the
minimum system requirements:
- Install AWS plugin 5.1.0 version or above on your Panorama. For more information, see Install or Upgrade the AWS Plugin.
- Using Cloud NGFW console Add AWS Accounts to Cloud NGFW Tenant and Harvest Tags from them.
Key Concepts
Term | Definition |
---|---|
Cloud Asset Tags | AWS tags configured on AWS resources. |
VPC Group | A set of AWS VPCs from one or more AWS accounts. |
Monitoring Definition | Associates a VPC Group with a notify group. |
Notify Group | You can group together a set of Panorama Device Groups that
require the same set of tags. |
To enable tag-based policies for Cloud NGFW for AWS resources, you must prepare
your Panorama appliance for this integration by installing the AWS plugin 5.1.0 version
or above. Using the Cloud NGFW console, add your AWS accounts and harvest tags from the
AWS resources. Then use the Panorama plugin to query tags periodically from your Cloud
NGFW tenant and add it to the Panorama device groups to manage DAG objects and
rules.
To enable Cloud NGFW tag-based policies in your Panorama appliance:
Add AWS Accounts to Cloud NGFW Tenant and Harvest Tags from them
Onboard your AWS account on to your Cloud NGFW tenant. For more
information, see
Step 10
in Cloud NGFW PAYG SaaS Subscription. If you have already onboarded your AWS account on cloud NGFW tenant, you
can directly get started with tag harvesting.
The existing CloudFormation template (CFT) of your onboarded AWS account
must have
Network MonitoringRole Arn
role added to it. The Network
Monitoring role provides visibility to the network performance connecting AWS hosted
applications. For more information, see Manually add a CloudFormation template. Enable Monitoring
In the Cloud NGFW console, you can enable the discovery of AWS resource
tags for the desired regions. Cloud NGFW will periodically collect these tags of
your AWS resources (For example: EC2, SG, and LB) in different AWS accounts and
register the information to your Cloud NGFW tenant. Cloud NGFW displays the
resource tags on resources organized by the VPCs in each AWS account.
For this purpose, you must enable monitoring in the
Inventory
Page to access data for each AWS region, to trigger the tags discovery. The
Enable Region
button under the Discovered VPCs
tab
appears only when you onboard your AWS account for the first time. Select
Region
from the drop-down and click Enable Region
to enable
tag monitoring. Alternatively, you can also select a
Region
from the drop-down
and click Enable
toggle to enable tags monitoring.View the Harvested Tags in the Cloud NGFW console
You can see the total number of discovered tags in the
Inventory
page
under the Discovered Tags
tab. Click the
Tag Name
to list the IPs associated with each tag. Click
Check Associated Tags
to list the different tags
associated with the IP address.In the NGFW console, the tag character limit is
127
for any AWS
resource type (key or value combined). The tags having key/value greater than
127
are not added to the DiscoveredTags
list. For more
information, see Tag Restrictions
. If you do not have the
Inventory Admin Permission
, you cannot
Set VPC group
or Create
New VPC group
. Use the Panorama Plugin to Query Tags and Add them to the Panorama Device
Groups
Use the Panorama AWS plugin to perform the following:
- Create and manage VPC Groups.
- Add tags to Device Groups using monitoring definitions and notify groups.
Install and configure the AWS Plugin 5.1.0 plugin on
Panorama to query AWS asset tags collected in the Cloud NGFW tenants and add
them to the Cloud Device Groups.
Create and Manage VPC Groups
Create and Manage VPC Groups
When you enable monitoring, a
Default
VPC Group is created
automatically. You cannot delete
the Default
VPC group. A newly
discovered VPC is always put into the Default
VPC group. If you want, you
can then move it into a different VPC group. The scope of a VPC group created in a region is applicable for that region
only. For example, VPC group A created in Region X is not accessible in
Region Y.
Alternatively, you can create new VPC groups and move these VPCs to
other VPC groups using the steps below:
If you wish to create a new
non-Default VPC group
on Panorama,
follow the steps covered in the procedure below: - In thePanoramaConsole, go to thePanoramatab, and then clickAWS.
- SelectTenantandRegion.
- Go toAWS>Cloud NGFW>Monitoring Definition>VPC Group>Add.
- Enter VPC GroupNameandDescription.
- ClickOK.
- Go toAWS>Cloud NGFW>Monitoring Definition>Discovered VPC.
- You cannot map aVPC Groupto more than 8 Device Groups. Configure monitoring definitions with VPC Groups such that a given VPC Group has only 8 Device Groups mapped (via Notify Groups) for better performance.
- TheDefaultVPC Group is created automatically. You cannotdeletetheDefaultVPC group. A newly discovered VPC is always put into theDefaultVPC group. If required, VPCs can be moved under a different VPC group.
- ClickSet VPC Group.
- SelectVPC Group.
- ClickSave.
Add tags to Device Groups using Monitoring Definitions and Device
Groups
To push tags learned from Cloud NGFW tenant to the Cloud NGFW
resources, ensure that you configure the
Notify Groups
and Monitoring
definitions
to the corresponding Device Groups corresponding to these
Palo Alto Networks firewalls. You can then view the AWS account tags harvested
from Cloud NGFW tenant in Panorama. Create a
Notify Group
for your cloud device group following the
steps below: - In thePanorama pluginConsole, go toAWS>Notify Group.
- ClickAdd.
- EnterName.
- Select theDevice GroupandTags.
- ClickOk.
Create a cloud
monitoring definition
associating the required
VPC group
and Notify group
for tags learned from Cloud NGFW. - In thePanoramaConsole, go toAWS>Cloud NGFW>Monitoring Definition.
- ClickAdd.
- Enter yourNameandDescription.
- Select the required VPC Group from theVPC Groupdrop-down menu.
- Select the required notify group from theNotify Groupdrop-down menu.
- ClickOK.
- CommitandPushyour changes on Panorama.
- Select aMonitoring Definitionand ClickDashboardto view the tags harvested from Cloud NGFW tenant.You can now view the tags harvested in Cloud NGFW tenant.
Configure Dynamic Address Group (DAG) objects with Tags in Device Groups
You can create Dynamic Address Groups with harvested Cloud NGFW tags for
your cloud device group. For more information, see Create Dynamic Address Groups.
Following are the steps to add match criteria for your dynamic address
groups:
- In thePanoramaConsole, go toObjectstab
- On the left pane, go toAddress Groups.
- ClickAdd.
- Enter theNameof your Address Group and select TypeDynamic.
- ClickAdd match Criteria.
You can now create
dynamic address group policies
referencing above
created DAGs for cloud device groups. You can add tags from different regions on your DAG object. To use tags from
different regions, you must create a cloud device group of the same name in other
regions. Also, you must create a monitoring definition in other regions mapping the
Notify Group to VPC Group of that region. For more information, see Cross-Region Tag Based Policies.
The following is an example of how DAGs are created using
AND
operator:The Address Group displays the list of addresses that match with both
matching criteria.
The following is an example of how DAGs are created using
OR
operator:The Address Group displays the list of addresses that match with any one of
the given matching criteria.
Following are the steps to create Dynamic Address policies referencing DAGs
for cloud device groups:
- In thePanoramaConsole, go to thePoliciestab.
- Go toSecurity>Pre/Post/Default Rules.
- ClickAdd.
- In the Security Policy Rule dialog box, enter aNamefor the security policy rule.
- In theSourcetab, select the DAG for theSource Address fieldand clickAdd.
- In theDestinationtab, select the DAG for theDestination Address fieldand clickAdd.
- ClickOK.
- CommitandPushyour changes to the Cloud NGFW device group.
For more information on
Commit
and Push
the configuration
changes to the firewalls, see Preview, Validate, or Commit Configuration
Changes.Return to the
Cloud NGFW
console to verify an XML file containing
dynamic address policies pushed from Panorama to the respective cloud device group.
Click View XML
to display information on newly added dynamic address
policies to the cloud device group. Add a new subnet to the client account. For more information, see Create Subnet on AWS console.
Cross-Region Tag Based Policies
You can populate tags from two different regions to your cloud device groups.
For example:
Region X and Region Y are your desired regions to enable the discovery of
AWS resource tags. If CNGFW resource is present in region X that needs to learn the
tags from Region Y, and then use it for the cloud DG in region X, perform the
following steps:
- Add AWS Accounts to Cloud NGFW Tenant and Harvest Tags from them.
- Use the Panorama Plugin to Query Tags and Add them to the Panorama Device Groups.
- Configure Dynamic Address Group (DAG) objects with Tags in Device Groups.You will be able to see only the Region X tags available for configuring your DAG objects.
- In Region Y, create the cloud device group of the same name as in Region X. Commit and Push your changes on Panorama. If required, create a VPC group and assign appropriate VPCs or use the default VPC group in Region Y.
- Create a monitoring Definition in Region Y, and then select the VPC group and Notify Group (where the Cloud DG is already mapped).
- Configure Dynamic Address Group (DAG) objects with Tags in Device Groups.You can now see that both Region X and Region Y tags are available for configuring your DAG objects.
- Committhe configuration in Panorama.
In the Cloud Device Group, you can now see the tags from Region Y to configure, and
you can create a dynamic address group.