topic Re: Dynamic Address Group with Azure monitoring in General Topics

Dynamic Address Group with Azure monitoring

raji_toor — Fri, 20 Aug 2021 22:07:51 GMT

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/vm-monitoring-on-azure/set-up-vm-monitoring-on-azure.html

In the end article tells to create DAG but how do I add VM's automatically to this group. Is there a wildcard that i can use like 'azure.vm-name.*'. I tried but its not working. All I can do is manually select each of them clicking plus but that is not dynamic.

Re: Dynamic Address Group with Azure monitoring

BPry — Sun, 22 Aug 2021 04:19:49 GMT

@raji_toor,

When you are creating the DAG/s you would do it with tags generally so that it's actually dynamic.

As an example if I have a bunch of entries tagged SfBFrontEnd I would create a DAG and the Match criteria would simply be the tag entered like so in the Match dialog:

'SfBFrontEnd'

The DAG would then simply be updated whenever an address is added with that tag so that the DAG is actually truly Dynamic.

Re: Dynamic Address Group with Azure monitoring

raji_toor — Mon, 23 Aug 2021 16:46:44 GMT

@BPry I guess you haven't looked at the doc i am referring to. I know objects have to be tagged same to be added to DAG. Here we are talking of objects pulled by panorama plugin from Azure. And all the tags it lists are in full VM type.name notations and are created by panorama itself.

Plugin is just helping pull all the IP's from Azure. If new VMs are created, I still have to keep coming back to manually add individual tags it creates for every Azure VM to the DAG.

If there was a wild card option we could they can be added to DAG by type 'azure.vm-name.*' as an example