Configure the Broker VM

In
Cortex
XDR
, select
Settings
Configurations
Data Broker
Broker VMs
.
Download
and install the broker VM images for your corresponding infrastructure:
Amazon Web Services (AWS)—Use the
VMDK
to Create a Broker VM Amazon Machine Image (AMI).
Google Cloud Platform—Use the
VMDK
image to Set up the Broker VM on Google Cloud Platform (GCP).
Microsoft Hyper-V 2012—Use the
VHD
image.
Microsoft Azure—Use the
VHD (Azure)
image to Create a Broker VM Azure Image.
Alibaba Cloud—Use the
QCOW2
image to Create a Broker VM Image for Alibaba Cloud.
Nutanix Hypervisor—Use the
QCOW2
image to Create a Broker VM Image for a Nutanix Hypervisor.
Ubuntu—Use the
QCOW2
image to Create a Broker VM Image for Ubuntu.
VMware ESXi—Use the
OVA
image.
Generate Token
and copy to your clipboard.
The token is valid only for 24 hours. A new token is generated each time you select
Generate Token
.
Navigate to
https://<broker_vm_ip_address>/
.
When DHCP is not enabled in your network and you don’t have an IP address for your broker VM, you need to configure the broker VM with a static IP using the serial console menu of the broker VM.
Log in with the default password
!nitialPassw0rd
and then define your own unique password.
The password must contain a minimum of eight characters, contain letters and numbers, and at least one capital letter and one special character.
Configure your broker VM settings:
In the
Network Interface
section, review the pre-configured
Name
,
IP
address, and
MAC Address
, select the
Address Allocation
:
DHCP
(default) or
Static
, and select to either to
Disable
or set as
Admin
the network address as the broker VM web interface.
If you choose
Static
, define the following and
Save
your configurations:
Static
IP
address
Netmask
Default Gateway
DNS Server
(
Requires Broker VM 14.0.42 and later
) (
Optional
)
Internal Network
Specify a network subnet to avoid the broker VM dockers colliding with your internal network. By default, the
Network Subnet
is set to
172.17.0.1/16
.
Internal IP must be:
Formatted as
prefix/mask
, for example
192.0.2.1/24
.
Must be within
/8
to
/24
range.
Cannot be configured to end with a zero.
For Broker VM version 9.0 and lower,
Cortex
XDR
will accept only
172.17.0.0/16
.
(
Optional
) Configure a
Proxy Server
address and other related details to route broker VM communication.
Select the proxy
Type
as
HTTP
,
SOCKS4
, or
SOCKS5
.
You can configure another broker VM as a
Proxy Server
for this broker VM by selecting the
HTTP
type. When selecting
HTTP
to route broker VM communication, you need to add the IP
Address
and
Port
number (set when activating the Agent Proxy) for the other broker VM registered in your tenant that you want to designate as a proxy for this broker VM.
Specify the proxy
Address
(IP or FQDN),
Port
, and an optional
User
and
Password
. Select the pencil icon to specify the password.
Save
your configurations.
(
Optional
) (
Requires Broker VM 8.0 and later
) Configure your
NTP
servers.
Specify the required server addresses using the FQDN or IP address of the server.
(
Requires Broker VM 8.0 and later
) (
Optional
) In the
SSH Access
section,
Enable
or
Disable
SSH connections to the broker VM. SSH access is authenticated using a public key, provided by the user. Using a public key grants remote access to colleagues and
Cortex
XDR
support who the private key. You must have Instance Administrator role permissions to configure SSH access.
To enable connection, generate an RSA Key Pair, enter the public key in the
SSH Public Key
section. Once one SSH public key is added, you can
+Add Another
. When you are finished,
Save
your configuration.
When using PuTTYgen to create your public and private key pairs, you need to copy the public key generated in the
Public key for pasting into OpenSSH authorized_keys file
box, and paste it in the broker VM
SSH Public Key
section as explained above. This public key is only available when the PuTTYgen console is open after the public key is generated. If you close the PuTTYgen console before pasting the public key, you will need to generate a new public key.
(
Requires Broker VM 10.1.9 and later
) (
Optional
) In the
SSL Server Certificate
section, upload your signed server certificate and key to establish a validated secure SSL connection between your endpoints and the broker VM. When you configure the server certificate and the key files in the Broker VM UI,
Cortex
XDR
automatically updates them in the tenant UI.
Cortex
XDR
validates that the certificate and key match, but does not validate the Certificate Authority (CA).
The Palo Alto Networks Broker supports only strong cipher SHA256-based certificates. MD5/SHA1-based certificates are not supported.
In the
Trusted CA Certificate
section, upload your signed Certificate Authority (CA) certificate or Certificate Authority chain file in a PEM format. If you use SSL decryption in your firewalls, you need to add a trusted self-signed CA certificate on the broker VM to prevent any difficulties with SSL decryption. For example, when configuring Palo Alto Networks NGFW to decrypt SSL using a self-signed certificate, you need to ensure the broker VM can validate a self-signed CA by uploading the
cert_ssl-decrypt.crt
file on the broker VM.
If adding a CA certificate to the broker is not possible, ensure that you’ve added the Broker Service FQDNs to the SSL Decryption Exclusion list on your firewalls. See Enable Access to Cortex XDR.
(
Requires Broker VM 8.0 and later
) (
Optional
) Collect and
Generate New Logs
. Your
Cortex
XDR
logs will download automatically after approximately 30 seconds.
Register
and enter your unique
Token
, created in the Cortex XDR console.
Registration of the Broker VM can take up to 30 seconds.
After a successful registration,
Cortex
XDR
displays a notification.
You are directed in
Cortex
XDR
to
Settings
Configurations
Data Broker
Broker VMs
. The
Broker VMs
page displays your broker VM details and allows you to edit the defined configurations.