Dynamic Address Group (DAG) PAN-OS / DAGPusher prototype

[danilo.souza]

Hi guys,

I'm trying to use the the DAGPusher prototype but, unhappily, I'm dealing with some problems. May be some of you could help me with it.

My scenario:

I use a generic miner to extract IPv4 (/32) from a specific location (that is working). Then it is sent to the DAGPusher node (that is working). Now I want to push them to Firewall/Panorama (it is not working).

My configuration:

In my local DAGPusher prototype, I use the configuration showed in figure 1 (green arrow). You can see that I only set the "tag_prefix":"agencias" parameter.

The status tab (figure 3) in the node cloned from this prototype, I have the indicators been received. Fine! And the Handled_Device tab show the Firewall destination (figure 2). Although I have multiplus devices and manage all of them through Panorama I choose to test DAGPusher with only one of them, at first.

Monitoring the traffic log I can see that my MM VM is trying to communicate with the device, and this traffic is allowed.

In Panorama I created a shared DAG with only one match: 'agencias' (figure 3).

Status/Questions:

At this point my DAG is not populated. Through the CLI, using the command "show object registered-ip all" I got nothing.
Could you guys identify something wrong? The syntax and the tags I used are corrects?
The fact that I created a shared DAG in Panorama could be the problem? Can I populate a shared DAG only in one Firewall?

Thank you in advanced.
Best regards.

[danilo.souza]

Hi @xhoms

I executed the procedure, but you explicited lines with a successful registration and unregistration IP. Wich logs should I observe to get the details of a failed attempt to register an IP?

Best regards.

[jmora]

The solution is to create "tags" that associate to the vsys under the address group. This is created in each vsys.