Attributes Monitored on Virtual Machines in Cloud Platforms

As you provision or remove virtual machines in the private or public cloud, you can use a Panorama plugin, a VM Monitoring script, or the VM Information Source on the next-gen firewall to monitor changes on virtual machines (VMs) deployed in the virtual environments.
VM Information Sources
—On a hardware or a VM-Series firewall you can monitor virtual machine instances and retrieves changes as you provision or modify the guests configured on the monitored sources—AWS, ESXi or vCenter Server, or AWS. For each firewall (and/or virtual system if your firewall has multiple virtual system capability), you can configure up to 10 sources.For information on how VM Information Sources and Dynamic Address Groups work synchronously and enable you to monitor changes in the virtual environment, refer to the VM-Series Deployment Guide .If your firewalls are configured in a high availability configuration:
  • In an active/passive setup, only the active firewall monitors the VM information sources.
  • In an active/active setup, only the primary firewall monitors the VM information sources.
VM Monitoring Script
—The VM Monitoring script runs on a virtual machine within the Azure public cloud. This script collects the IP address-to-tag mapping for all your Azure assets and uses the API to push the VM information to your Palo Alto Networks® firewall(s). See VM Monitoring on Azure for details.
Panorama Plugin
—On a Panorama —hardware appliance or virtual appliance running version 8.1.3—you can install the plugin for Microsoft Azure and AWS. The plugin allows you to connect Panorama to your Azure public cloud subscriptions or AWS VPCs and retrieve the IP address-to-tag mapping for your virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.
Use the following sections to review the options supported on each cloud vendor and the virtual machine attributes that you can monitor to create Dynamic Address Groups:

VMware ESXi

Learn about the attributes monitored on ESXi instances.
Each VM on a monitored ESXi or vCenter server must have VMware Tools installed and running. VMware Tools provide the capability to glean the IP address(es) and other values assigned to each VM.
When monitoring ESXi hosts that are part of the VM-Series NSX edition solution, use Dynamic Address Groups (instead of using VM Information Sources) to learn about changes in the virtual environment. For the VM-Series NSX edition solution, the NSX Manager provides Panorama with information on the NSX security group to which an IP address belongs. The information from the NSX Manager provides the full context for defining the match criteria in a Dynamic Address Group because it uses the service profile ID as a distinguishing attribute and allows you to properly enforce policy when you have overlapping IP addresses across different NSX security groups.
Up to 32 tags (from vCenter server and NSX Manager) can be registered to an IP address.
To collect the values assigned to the monitored VMs, use the VM Information Sources on the firewall to monitor the following predefined set of ESXi attributes:
Attributes Monitored on a VMware Source
UUID
Name
Guest OS
VM State — the power state can be poweredOff, poweredOn, standBy, and unknown.
Annotation
Version
Network — Virtual Switch Name, Port Group Name, and VLAN ID
Container Name —vCenter Name, Data Center Object Name, Resource Pool Name, Cluster Name, Host, Host IP address.

Amazon Web Services (AWS)

Learn about the attributes monitored on AWS instances.
As you provision or modify virtual machines in your AWS VPCs, you have two ways of monitoring these instances and retrieving the tags for use as match criteria in dynamic address groups.
  • VM Information Source
    —On a next-gen firewall, you can monitor up to a total of 32 tags—14 pre-defined and 18 user-defined key-value pairs (tags). The following attributes (or tag names) are available as match criteria for dynamic address groups.
  • AWS Plugin on Panorama
    —The Panorama plugin for AWS allows you to connect Panorama to your Azure public cloud subscriptions and retrieve the IP address-to-tag mapping for your Azure virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification. With the plugin, Panorama can retrieve a total of 32 tags for each virtual machine, 11 predefined tags and up to 21 user-defined tags.
Attributes Monitored on the AWS-VPC
VM Information Source on the Firewall
AWS Plugin on Panorama
Architecture
Yes
No
Guest OS
Yes
No
AMI ID
Yes
Yes
IAM Instance Profile
No
Yes
Instance ID
Yes
No
Instance State
Yes
No
Instance Type
Yes
No
Key Name
Yes
Yes
Owner ID
No
Yes
Placement—Tenancy
Yes
Yes
Placement—Group Name
Yes
Yes
Placement—Availability Zone
Yes
Yes
Private DNS Name
Yes
No
Public DNS Name
Yes
Yes
Subnet ID
Yes
Yes
Security Group ID
No
Yes
Security Group Name
No
Yes
VPC ID
Yes
Yes
Tag (key, value)
Yes;
Up to a maximum of 18 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 18 tags are available for use on the firewalls.
Yes;
Up to a maximum of 21 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 21 tags are available for use on Panorama and the firewalls.

Microsoft Azure

Learn about the attributes monitored on Microsoft Azure instances.
For VM Monitoring on Azure you have two ways of collecting the IP address-to-tag mapping to make them available as match criteria in dynamic address groups:
  • VM Monitoring script
    —The VM Monitoring script runs on a virtual machine within the Azure public cloud. This script collects the IP address-to-tag mapping for all your Azure assets and uses the API to push the VM information to your Palo Alto Networks® firewall(s). The solution, posted on GitHub, is released under the community supported policy of Palo Alto Networks.
    You can retrieve a total of 32 tags for each virtual machine, 10 pre-defined and 21 user-defined key-value pairs (tags).
  • Azure plugin on Panorama
    —The Panorama plugin for Microsoft Azure allows you to connect Panorama to your Azure public cloud subscriptions and retrieve the IP address-to-tag mapping for your Azure virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification.
    Panorama can retrieve a total of 26 tags for each virtual machine, 11 predefined tags and up to 15 user-defined tags.
The VM Monitoring script or Panorama monitor the following set of virtual machine attributes within your Microsoft Azure deployment.
Attributes Monitored on Microsoft Azure
VM Monitoring Script
Azure Plugin on Panorama
VM Name
Yes
Yes
VM Size
Yes
No
Network Security Group Name
No
Yes
OS Type
Yes
Yes
OS Publisher
Yes
Yes
OS Offer
Yes
Yes
OS SKU
Yes
Yes
Subnet
Yes
Yes
VNet
Yes
Yes
Azure Region
Yes
Yes
Resource Group Name
Yes
Yes
Subscription ID
No
Yes
User Defined Tags
Yes
Up to a maximum of 21 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 21 tags are available for use on the firewalls.
Yes
Up to a maximum of 15 user defined tags are supported. The user-defined tags aresorted alphabetically, and the first 15 tags are available for use on Panorama and the firewalls.

Google

Learn about the attributes monitored on Google Compute Engine instances.
Using VM Information Sources on the next-gen firewall, you can monitor the following predefined set of Google Compute Engine (GCE) attributes.
High Availability is not supported on the firewalls.
Attributes Monitored on Google Compute Engine
Hostname of the VM
Machine type
Project ID
Source (OS type)
Status
Subnetwork
VPC Network

Related Documentation