Focus

Attributes Monitored on Virtual Machines in Cloud Platforms

Table of Contents

Enable VM Monitoring to Track Changes on the Virtual Network

Attributes Monitored on Virtual Machines in Cloud Platforms

As you provision or remove virtual machines in the private or public cloud, you can use a Panorama plugin, a VM Monitoring script, or the VM Information Source on the next-gen firewall to monitor changes on virtual machines (VMs) deployed in the virtual environments.

VM Information Sources—On a hardware or a VM-Series firewall you can monitor virtual machine instances and retrieves changes as you provision or modify the guests configured on the monitored sources—AWS, ESXi or vCenter Server, or AWS. For each firewall (and/or virtual system if your firewall has multiple virtual system capability), you can configure up to 10 sources.For information on how VM Information Sources and Dynamic Address Groups work synchronously and enable you to monitor changes in the virtual environment, refer to the VM-Series Deployment Guide .If your firewalls are configured in a high availability configuration:

In an active/passive setup, only the active firewall monitors the VM information sources.
In an active/active setup, only the primary firewall monitors the VM information sources.

Panorama Plugin—On a Panorama —hardware appliance or virtual appliance running version 8.1.3—you can install the plugin for Microsoft Azure and AWS. The plugin allows you to connect Panorama to your Azure public cloud subscriptions or AWS VPCs and retrieve the IP address-to-tag mapping for your virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.

Use the following sections to review the options supported on each cloud vendor and the virtual machine attributes that you can monitor to create Dynamic Address Groups:

VMware ESXi
Amazon Web Services (AWS)
Microsoft Azure
Google

VMware ESXi

Learn about the attributes monitored on ESXi instances.

Each VM on a monitored ESXi or vCenter server must have VMware Tools installed and running. VMware Tools provide the capability to glean the IP address(es) and other values assigned to each VM.

When monitoring ESXi hosts that are part of the VM-Series NSX edition solution, use Dynamic Address Groups (instead of using VM Information Sources) to learn about changes in the virtual environment. For the VM-Series NSX edition solution, the NSX Manager provides Panorama with information on the NSX security group to which an IP address belongs. The information from the NSX Manager provides the full context for defining the match criteria in a Dynamic Address Group because it uses the service profile ID as a distinguishing attribute and allows you to properly enforce policy when you have overlapping IP addresses across different NSX security groups.

Up to 32 tags (from vCenter server and NSX Manager) can be registered to an IP address.

To collect the values assigned to the monitored VMs, use the VM Information Sources on the firewall to monitor the following predefined set of ESXi attributes:

Attributes Monitored on a VMware Source
UUID
Name
Guest OS
VM State — the power state can be poweredOff, poweredOn, standBy, and unknown.
Annotation
Version
Network — Virtual Switch Name, Port Group Name, and VLAN ID
Container Name —vCenter Name, Data Center Object Name, Resource Pool Name, Cluster Name, Host, Host IP address.

Amazon Web Services (AWS)

Learn about the attributes monitored on AWS instances.

As you provision or modify virtual machines in your AWS VPCs, you have two ways of monitoring these instances and retrieving the tags for use as match criteria in dynamic address groups.

VM Information Source—On a next-gen firewall, you can monitor up to a total of 32 tags—14 pre-defined and 18 user-defined key-value pairs (tags). The following attributes (or tag names) are available as match criteria for dynamic address groups.
AWS Plugin on Panorama—The Panorama plugin for AWS allows you to connect Panorama to your AWS VPCs and retrieve the IP address-to-tag mapping for your AWS virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification. With the plugin, Panorama can retrieve a total of 32 tags for each virtual machine, 11 predefined tags and up to 21 user-defined tags.

Attributes Monitored on the AWS-VPC	VM Information Source on the Firewall	AWS Plugin on Panorama
Architecture	Yes	No
Guest OS	Yes	No
AMI ID	Yes	Yes
IAM Instance Profile	No	Yes
Instance ID	Yes	No
Instance State	Yes	No
Instance Type	Yes	No
Key Name	Yes	Yes
Owner ID	No	Yes
Placement—Tenancy	Yes	Yes
Placement—Group Name	Yes	Yes
Placement—Availability Zone	Yes	Yes
Private DNS Name	Yes	No
Public DNS Name	Yes	Yes
Subnet ID	Yes	Yes
Security Group ID	No	Yes
Security Group Name	No	Yes
VPC ID	Yes	Yes
Tag (key, value)	Yes; Up to a maximum of 18 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 18 tags are available for use on the firewalls.	Yes; Up to a maximum of 21 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 21 tags are available for use on Panorama and the firewalls.

Microsoft Azure

Learn about the attributes monitored on Microsoft Azure instances.

For VM Monitoring on Azure you need to retrieve the IP address-to-tag mapping for your Azure VMs and make it available as match criteria in dynamic address groups. The Panorama plugin for Microsoft Azure allows you to connect Panorama to your Azure public cloud subscriptions and retrieve the IP address-to-tag mapping for your Azure virtual machines. Panorama can retrieve a total of 26 tags for each virtual machine, 11 predefined tags and up to 15 user-defined tags and registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.

With the Panorama plugin for Azure, you can monitor the following set of virtual machine attributes within your Microsoft Azure deployment.

Attributes Monitored on Microsoft Azure	Azure Plugin on Panorama
VM Name	Yes
VM Size	No
Network Security Group Name	Yes
OS Type	Yes
OS Publisher	Yes
OS Offer	Yes
OS SKU	Yes
Subnet	Yes
VNet	Yes
Azure Region	Yes
Resource Group Name	Yes
Subscription ID	Yes
User Defined Tags	Yes Up to a maximum of 15 user defined tags are supported. The user-defined tags aresorted alphabetically, and the first 15 tags are available for use on Panorama and the firewalls.

Google

Learn about the attributes monitored on Google Compute Engine instances.

Using VM Information Sources on the next-gen firewall, you can monitor the following predefined set of Google Compute Engine (GCE) attributes.

High Availability is not supported on the firewalls.

Attributes Monitored on Google Compute Engine
Hostname of the VM
Machine type
Project ID
Source (OS type)
Status
Subnetwork
VPC Network

Enable VM Monitoring to Track Changes on the Virtual Network

Use Dynamic Address Groups in Policy