Migrate Operations-Centric Configuration to Security-Centric Configuration

Upgrade Panorama.

Update the match criteria format in your dynamic address groups.

Select
Objects
Address Groups
and click the link name for your first dynamic address group.
Delete the existing match criteria entry.
Enter the new match criteria in the following format:
‘_nsx_
<dynamic-address-group-name>’

Click
OK
.
Repeat this process for each dynamic address group.

Change security policy used as NSX-V steering rules to intrazone.

Select
Policies
Security
Pre Rules
and click the link name for your first security policy rule.
On the General tab, change the
Rule Type
to intrazone.

Click
OK
.
Repeat this process for each security policy rule.

Generate new steering rules.

Select

Panorama

VMware

NSX-V

Steering Rules

.

Click

Auto-Generate Steering Rules

.



Commit

your changes.

When you commit your changes, Panorama pushes updates to NSX-V Manager.

Verify that NSX-V Manager created new security groups.

Login to vCenter and select
Networking & Security
Security Groups
.
The new security groups (mapped to the updated dynamic address groups) should appear in the following format:
<service-definition-name> - <dynamic-address-group-name>



Verify that NSX-V Manager created new steering rules.

Select
Networking & Security
Firewall
Configuration
Partner security services
.
The new steering rules (mapped to the security policy rules you create on Panorama) are listed above the old steering rules.



Add match criteria to the newly created security groups to ensure that your VMs are placed in the correct security group.

There two ways to complete this task—recreate the match criteria from the old security group in the new security group or nest the old security group within the new security group.

To recreate the match criteria from the old security group, complete the following procedure.

Select

Network & Security

Service Composer

Security Groups

.

Click on a new security group and select

Edit Security Group

.

Select

Define dynamic membership

and click the plus icon.

Add the same match criteria in the corresponding old security group.

Repeat this process for each new security group.

Delete the old security groups.



To nest the old security group within the new security group, complete the following procedure. In this method, VMs in the old security group are added to the new security group. Additionally, any new VM that meets the criteria of the old security group is automatically added to the new security group.

Select
Network & Security
Service Composer
Security Groups
.
Click on a new security group and select
Edit Security Group
.
Select
Select objects to include
.
Select the
Security Group
Object Type.
Choose the corresponding old security group under Available Objects and move it to Selected Objects by clicking the right arrow icon.
Click
Finish
.



Delete the old steering rules from vCenter.

Select

Networking & Security

Firewall

Configuration

Partner security services

.

Delete the old steering rules. Take care not to delete the Palo Alto Networks rules created by the Security-Centric workflow. These steering rule sections use the following naming convention.

<service-definition-name> - <dynamic-address-group-name>