Manage and Migrate Existing IP Tag Collection Configurations

Table of Contents

Manage and Migrate Existing IP Tag Collection Configurations

Collect cloud IP-Tags in Strata Cloud Manager using a credential configuration and a monitor configuration.

If you are migrating from IP-Tag Collection Legacy, onboard a cloud account and complete this procedure under IP-Tag Collection (Recommended). After you save and see a successful connection, confirm that the tags you see match the expected values. Then delete the existing configuration under IP-Tag Collection Legacy so that tag collection and enforcement continue without interruption on the new infrastructure. However, if you want to manage your existing configuration, use this procedure.

The Legacy configuration flow collects IP address-to-tag information from your cloud service provider using two linked objects: a credential configuration, which stores the credentials Strata Cloud Manager uses to reach the provider, and a monitor configuration, which defines what to collect and where to send it. The Recommended flow replaces both with a single cloud account onboarding step.

Use the Legacy flow when you need a capability the Recommended flow does not provide, such as routing collection through a context collector in an air-gapped or restricted environment, or reusing one set of credentials across several monitor configurations.

To collect IP-tag information from your cloud service provider, you must first grant the Cloud Identity Engine the required permissions:

Amazon Web Services (AWS)—Grant the service account the Amazon Role Name (ARN) roles described in the IAM Roles and Permissions for Panorama section of the VM-Series documentation. For more information about the ARN, refer to the AWS documentation.
Microsoft Azure—Grant the read permissions described in the Azure Monitoring section of the VM-Series documentation to the service account.
Google Cloud Platform (GCP)—Grant the IAM roles described in the VM-Series documentation to the service account.

For each region, you can synchronize up to 60,000 IP-tag mappings from a cloud service in a monitoring configuration at one time. Only new or modified mappings are synchronized on each pass. You can view up to 32,000 IP-tag mappings per page.

If you have not already done so, activate User Context and either use the default segment or configure a new segment to receive the mapping information.
Select ConfigurationCloud Identity EngineUser ContextIP-Tag Collection, then select the Legacy tab.
Select the Credential Configuration tab, if it does not already display.
To Set Up a New Credential Configuration, select the cloud service provider you want to use.
Enter a unique and descriptive Name for the configuration.
(AWS only) Configure your AWS connection.
To open your AWS administrator portal in a new window so that you can create or edit any necessary ARNs, select the type of CloudFormation template (CFT) you want to configure and log in with your AWS credentials.
- Open CFT (Application Account Prerequisites) —Configure the application account prerequisites.
- Open CFT (Security Account Prerequisites) —Configure the security account prerequisites.
To enable monitoring using the current account, you only need to configure the application account prerequisites. To use a different account, such as a service account or a cross-account role, configure the application account prerequisites, the security account prerequisites, and a role ARN for the account.
1. Enter your Access Key ID.
  To learn how to obtain your access key ID and secret access key, refer to the AWS documentation.
2. Enter your Secret Access Key.
3. Reenter your secret access key to Confirm Secret Access Key.
4. Optional Enter a Role ARN Name and Role ARN Value.
  To configure additional Role ARNs, click Add Role ARN for each Role ARN you want to include.
(Azure only) Configure your Azure connection.
1. Enter your Client ID.
  To learn how to obtain the client ID and client secret, refer to the Azure documentation.
2. Enter your Client Secret.
3. Enter your Tenant ID.
  To learn how to obtain the tenant ID and subscription ID, refer to the Azure documentation.
4. Enter your Subscription ID.
(Google Cloud Platform only) Configure your GCP connection.
1. Create credentials for a service account in your Google Cloud console, and then download and save the JSON file in a safe location.
2. Click Browse files and click Open to navigate to the JSON file, or drag and drop the GCP credential JSON file.
3. Optional Select the Region for the instance.
  You can optionally Search for a region. If you do not select a region, the Cloud Identity Engine uses the us-west-2 region. You can select one region per instance.
Verify the connection by clicking Test Connection.

(AWS and Google Cloud Platform only) You can optionally select the Region before you test the connection. By default, the Cloud Identity Engine selects the US West region; if this region does not enable API requests, select a region that does.

Even if the connection test is not successful, you can still submit your configuration. Until you resolve the connectivity issues, the configuration status is Not connected. You must resolve the connection issues before the configuration can retrieve IP address-to-tag mappings.
Submit the configuration.

To collect and view your IP-tag mappings, you must also configure a monitor configuration.

Configure a Monitor Configuration

A monitor configuration defines what the Cloud Identity Engine collects from the cloud service provider and which segment receives the mappings. Configure one for monitoring purposes, such as audits, or to share IP address-to-tag mapping information with your firewalls using a segment.

There are four states for the connection to the cloud service provider:

Connected—The Cloud Identity Engine has successfully established a connection with the cloud service provider and can collect IP-tag mapping information.
Partially connected—The Cloud Identity Engine established a connection to some aspects of the configuration, such as the region for AWS, but not all of them. The Cloud Identity Engine receives IP-tag mappings from connected sources only.
Connection pending—The Cloud Identity Engine established a connection but has not completed the sync for the IP-tag mappings from one or more regions. For more information about the connection status, select Click to see details.
Not connected—The Cloud Identity Engine could not establish a connection with the cloud service provider using the current configuration.

Select the Monitor & Status tab.
Set Up a New Monitor Configuration and select the monitor configuration for the cloud service provider that you configured for the credential configuration.
Enter a unique and descriptive Name for the configuration.
Select the Credential Configuration that you configured.
(AWS only) Optional Select the Role ARN you want to use.
Select whether you want to configure the connection for All Regions, All VPCs (AWS only), or All Project IDs (GCP only).
To select a specific region or virtual private cloud (VPC), deselect the All Regions or All VPCs check box, wait for the list of regions or VPCs to populate, and then select the region or VPC you want to include. To select a specific VPC, you must first select one or more regions, or select all regions.
(Azure only) Select whether you want to Fetch Service Tags.

Azure service tags simplify security for Azure virtual machines and Azure virtual networks because you can restrict network access to just the Azure services you want to use. A service tag represents a group of IP address prefixes for a particular Azure service. For example, a tag can represent all storage IP addresses.
Optional To route IP-tag collection through a context collector deployed in an air-gapped or restricted environment, select a context collector or Context Collector Folder from the list of onboarded collectors.
Selecting a folder routes collection through any context collector in that folder. If you do not select a collector, the Cloud Identity Engine collects IP-tag data directly from the cloud service provider.
Define the Polling Interval (in seconds) to specify how frequently the Cloud Identity Engine checks for new data.
The default is 60 seconds and the range is 60–1800 seconds.
If you want to share the mappings, select the segment you configured. Otherwise, to create this configuration only for monitoring, without sending mappings to any firewalls, select None.

If you need to change the segment after you submit the configuration, you must create a new configuration and select the segment you want to use.
Submit the configuration.

Monitor and Manage Your Configurations

Select the Monitor & Status tab.
Use the filters to highlight the information you want to find.
- Name—Enter the name of a configuration to filter results to that configuration. The search query does not need to be an exact match.
- Vendor—Select the vendor type of the cloud service provider to filter the results to that vendor type.
- Status—Select the status type, such as Connected or Partially Connected, to filter the results to that status type.
- Segment—Select the segment name to view the monitor configurations that send mappings to that segment.
- Associated Credential—Select the name of the credential configuration to view the monitor configurations that use it.
Optional To remove the filter, click Reset.
Optional To sync all new IP-tag mappings and use them in Security policy immediately, or to resolve any discrepancies in the IP-tag mappings, click Full Sync.

The Sync Status displays the time and date of the last sync.
Optional To change the IP-Tag Collection configuration, click Edit.
Optional To remove the IP-Tag Collection configuration, click Delete and confirm the deletion.

When you confirm the deletion, the Cloud Identity Engine removes all IP-tag mappings from the cloud service provider and from any firewalls that collect those mappings to enforce Security policy.

View IP Address-to-Tag Mappings

Options vary depending on your configuration type.

Select the name of the configuration that you want to view from the IP-Tag Collection page.
On the Monitor & Status page, review the Connection Details to view information such as the connection status.
(AWS only) On the VPC tab, Search by VPC ID to view information for a specific VPC, or select the number in the IPs column to view the IP addresses associated with the VPC ID in that row.
Select the Tag To IP tab and Search by Tag to view all IP addresses that contain the tag you specify.
You can view the results for an exact or partial match for your query. You can optionally limit the search to a specific region or select All Regions.
Select the number in the IPs column to view the IP addresses that the Cloud Identity Engine has collected for the selected Tag, then Search by IP Address.
Close the window or click Cancel after you review the IP addresses.
Select the IP To Tag tab to Search by IP Address.

For an AWS-based configuration, you can also search by VPC ID.
Click the number in the Tags column to view the tags associated with the IP Address of that row, then Search by Tag.
Close the window or click Cancel after you review the tags.