Dynamic Attributes Connector

The following topics discuss how to configure and use the Dynamic Attributes Connector.

About the dynamic attributes connector

The dynamic attributes connector enables your access control policy to adapt in real time to the changes in public and private cloud workloads and business-critical software-as-a-service (SaaS) applications. It simplifies policy management by keeping rules up to date without tedious manual updates and policy deployment. Customers require policy rules to be defined based on non-network constructs such as VM name or security group, so that firewall policy is persistent even when the IP address or VLAN changes.

Supported Connectors

Table 1. List of supported connectors by dynamic attributes connector version and platform

CSDAC version

AWS

AWS Security Groups

AWS Service Tags

Azure

Azure Service Tags

Cisco APIC

Cisco Cyber Vision

Cisco Multicl. Defense

Generic text

GitHub

Google Cloud

Microsoft Office 365

Tenable

vCenter

Webex

Zoom

Version 1.1 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

No

No

Yes

No

Yes

No

No

Version 2.0 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

No

Yes

Yes

No

Yes

No

No

Version 2.2 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

Yes

Yes

Yes

No

Yes

No

No

Version 2.3 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

Yes

Yes

Yes

No

Yes

Yes

Yes

Version 3.0 (on-premises)

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Version 3.1 (on-premises)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Cloud-delivered (Security Cloud Control)

Yes

No

No

Yes

Yes

No

No

Yes

No

Yes

Yes

Yes

Yes

No

No

No

Secure Firewall Management Center 7.4.1

Yes

No

No

Yes

Yes

No

No

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Secure Firewall Management Center 7.6

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Secure Firewall Management Center 7.7

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

How Cisco secure dynamic attributes connector works

This topic discusses the architecture of the dynamic attributes connector.

The system functions by querying cloud services and providing attribute information to the secure management center.

Summary

The key components involved in this process are:

  • The system supports certain public cloud providers.

    This topic discusses supported connectors (which are the connections to those providers).

  • The dynamic attributes connector is provided with Secure Firewall Management Center.

Workflow

"The Cisco Secure Dynamic Attributes Connector queries cloud services such as VMware vCenter and provides information such as VLANs, networks, and tags to the secure management center to use as selection criteria in access control rules. This way, you don't have to constantly update network objects when IP address information (for example) in your cloud systems change"

These stages describe how the Cisco Secure Dynamic Attributes Connector processes cloud service information:

  1. Connectors contain the tags and containers to query. For example, typically these tags define dynamically allocated network and IP addresses for which you cannot create access control rules. Persisted feeds from the connectors are stored on the dynamic attributes connector for fast access.
  2. Tag information is persisted on the dynamic attributes connector where you create dynamic attributes filters that define which information is important to use in access control rules. For example, if AWS defines networks for the Accounting and Finance Departments virtual machines, you can create a dynamic attributes filter that specifies only the Finance network.
  3. The Secure Firewall Management Center receives those dynamic attributes filters as dynamic objects and enables you to use them in access control rules.

What’s next

Related topics

System requirements for the Dynamic Attributes Connector

The Dynamic Attributes Connector has specific memory requirements that must be met to ensure proper deployment and operation. These limits apply to both virtual machines and physical machines to avoid deployment issues.

FMCv: Amount of RAM

Secure Firewall Management Center hardware model

Maximum number of (connectors + Azure AD realms)

At least 32 GB

Firepower 1000, Firepower 1600, vFMC

10

At least 64 GB

Firepower 2500, Firepower 2600,vFMC 300

20

At least 128 GB

Firepower 4500, Firepower 4600

30

The preceding limits apply to both virtual machines and physical machines.

The system prevents you from exceeding these limits to avoid deployment issues.

Enable the dynamic attributes connector

Enable the dynamic attributes connector to allow objects from cloud networking products to be used in Secure Firewall Management Center access control rules.

This task discusses how to enable the dynamic attributes connector in the Secure Firewall Management Center. The dynamic attributes connector is an integration that enables objects from cloud networking products to be used in Secure Firewall Management Center access control rules.

Procedure


Step 1

Log in to the Secure Firewall Management Center if you have not done so already.

Step 2

Click Integration > Dynamic Attributes Connector.

Step 3

Slide to Enabled.

Step 4

The system displays messages when the dynamic attributes connector is enabled.

In the event of errors, try again. If errors persist, contact Cisco TAC.

See Connectors.


Configure networks and subnets for Docker containers

The Dynamic Attributes Connector uses Docker containers to retrieve connector data in the Secure Firewall Management Center . You can change Docker IP addresses and ranges to avoid conflicts with the Secure Firewall Management Center management interface and other network IP addresses.

The Docker daemon used by the dynamic attributes connector requires the following networks:

  • docker0 : Used internally by the Docker daemon.

  • IPv6 networks ( vethnumber ): Internal bridge networks used by the dynamic attributes connector .

  • Docker bridge networks ( br-number ): Used by dynamic attributes connector connectors.

To change Docker networks and subnets, run the following command as a user with root privileges: /usr/local/sf/bin/change_docker_subnet.sh -b CIDR-network -s address-pool-size

  • -b CIDR-network : Sets a network base address pool in CIDR notation.

  • -s address-pool-size : Sets a netmask for the network base address to limit the number of addresses and ensure compatibility with available system RAM.


Important


The networks you assign to Docker must be in an internal network range and must not conflict with networks used by the Secure Firewall Management Center or by other devices in your internal network.


Table 2. Recommended Docker Network Settings

Secure Firewall Management Center model

Recommended -s value

Sample -b value

Dynamic Attributes Connector container addresses used

Firepower 1000, Firepower 1600, vFMC

27 (netmask 255.255.255.224)

172.19.0.0/16

30 IP addresses

Firepower 2500, Firepower 2600, vFMC 300

26 (netmask 255.255.255.192)

192.168.0.0/16

62 IP addresses

Firepower 4500, Firepower 4600

25 (netmask 255.255.255.128)

192.168.0.0/16

126 IP addresses

sudo /usr/local/sf/bin/change_docker_subnet.sh -b 172.19.0.0/16 -s 27
        sudo /usr/local/sf/bin/change_docker_subnet.sh -b 192.168.0.0/16 -s 26
        sudo /usr/local/sf/bin/change_docker_subnet.sh -b 192.168.0.0/16 -s 25

Troubleshooting

Table 3. Common Docker Network Errors

Error

Solution

Pull subnet value can not be greater than size

Change the value of -s so it is less than the CIDR network value.

For example,

INCORRECT: sudo /usr/local/sf/bin/change_docker_subnet.sh -b 172.19.0.0/16 -s 8

CORRECT: sudo /usr/local/sf/bin/change_docker_subnet.sh -b 172.19.0.0/16 -s 20

Docker networks are wrong

Restart the Docker daemon: sudo pmtool restartbyid docker

Cannot connect to the Docker daemon

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Restart Docker: pmtool restartbyid docker

Input can't be empty

The -s parameter is required.

Dashboard

Dashboard capabilities include:

  • Add, edit, and delete connectors and dynamic attributes filters.

  • See how connectors and dynamic attributes filters are related to each other.

  • View warnings and errors.

Dashboard access and functionality

To access the dynamic attributes connector dashboard, log in to the Secure Firewall Manager and click Integration > Dynamic Attributes Connector at the top of the page.

If the dynamic attributes connector is not enabled, move the slider to enable it. This process could take several minutes to complete.

The dynamic attributes connector Dashboard page displays an example of an unconfigured system:

The Cisco Secure Dynamic Attributes Connector dashboard displays at-a-glance information about configured connectors, filters, and adapters

Dashboard of an unconfigured system

This sample dynamic attributes connector Dashboard page shows how an unconfigured system appears initially.

The Cisco Secure Dynamic Attributes Connector dashboard displays at-a-glance information about configured connectors, filters, and adapters

The Dashboard initially displays all the types of connectors you can configure for your system. You can do any interaction:

  • Hover the mouse pointer over a connector and click The Dashboard shows the available connectors and adapters for configuration in the system, allowing users to interact by hovering and clicking to create or manage them. to create a new one.

  • Click Go to Connectors to add, edit, or delete connectors (good for creating, editing, or deleting multiple connectors at the same time).

    For more information, see Connectors.

Related Topics:

Dashboard of a configured system

Sample dynamic attributes connector Dashboard page of a configured system displays at-a-glance information about configured connectors, filters, and adapters.

Click an area in the figure to learn more about it or click one of the links that follow the figure.

The Cisco Dynamic Attributes Connector dashboard displays at-a-glance information about configured connectors and filters Connectors Create dynamic attributes filters

The Dashboard shows the following (from left to right):

Connectors column

Filters column

List of connectors with a number indicating how many of each type are configured. Connectors collect dynamic attributes that could be sent to the Secure Firewall Manager. Dynamic attributes filters specify what data is sent.

Click The dashboard displays a list of configured connectors and their associated dynamic attributes filters, indicating the number of each type present in the system. to view more information about all configured connectors. You can also click the name of a connector to add, edit, or delete connectors; or to view detailed information about them. For more information, see Add, edit, or delete connectors.

List of dynamic attributes filters associated with each connector with a number indicating how many of each filter are associated with a connector.

Click The dashboard displays an overview of the configured system, highlighting the connectors and their associated dynamic attributes filters, along with options to manage them. to view more information about all configured filters. You can also click the name of a filter to add, edit, or delete filters; or to view detailed information about them. For more information, see Add, edit, or delete dynamic attributes filters.


Note


Some connectors, such as Outlook 365 and Azure Service tags, automatically pull available dynamic objects without the need for a dynamic attributes filters. Those connectors display Auto in the column.


The Dashboard indicates whether or not an object is available. The Dashboard page is refreshed every 15 seconds but you can click Refresh (refresh icon) at the top of the page at any time to refresh immediately. If issues persist, check your network connection.

Add, edit, or delete connectors

The Dashboard enables you to manage connectors by viewing, adding, editing, or deleting them. You can also view error information for connectors and troubleshoot issues.

Use the dynamic attributes connector dashboard when you need to manage connectors for your network security infrastructure. The dashboard provides comprehensive options for connector management and troubleshooting.

Procedure


Step 1

Access the connector dashboard and select your desired action.

The Dashboard enables you to view or edit connectors. You can click the name of a connector to view all instances of that connector or you can click The dynamic attributes connector dashboard displays options for managing and troubleshooting connectors in a network security infrastructure. Users can view, edit, add, or delete connectors directly from this interface. for the following additional options:

  • Go to Connectors to view all connectors at the same time; you can add, edit, and delete connectors from there.

  • Add Connector > type to add a connector of the indicated type.

Step 2

Click any connector in the connectors column (The image illustrates the process of adding, editing, or deleting connectors within the Connectors interface, highlighting the available options for managing connector types.) to display more information about it.

An example follows:

Displaying more information about connectors from the dashboard

Step 3

Choose from the following management options.

  • Click the Edit icon (edit icon) to edit this connector.

  • Click the More icon (more icon) for additional options.

  • Click The image illustrates the user interface options for managing connectors, including buttons for editing, accessing additional options, closing the panel, and displaying the version information. to close the panel.

  • Click Version to display the version of the . You can optionally copy the version to the clipboard if necessary for Cisco TAC.

Step 4

Use the table at the bottom of the panel to add dynamic attributes filters or to edit or delete connectors.

A sample follows:

At the bottom of the page you can add, edit, or delete dynamic attributes filters

Click the Add icon (add icon) to add a dynamic attributes filter for this connector. For more information, see Create dynamic attributes filters.

Hover the mouse pointer over the Actions column to either edit or delete the indicated connector.

Step 5

To view error information for a connector, click the name of the connector that is displaying the error.

Step 6

In the right pane, click Information (information icon).

An example follows.

Click the "I" button to view warnings about a connector

Step 7

To resolve this issue, edit the connector settings as discussed in Create an office 365 connector.

Step 8

If you cannot resolve the issue, click Version and copy the version to a text file.


What to do next

Provide all of this information to Cisco TAC.

Add, edit, or delete dynamic attributes filters

The dashboard enables you to add, edit, or delete dynamic attributes filters. You can click the name of a filter to view all instances of that filter or you can click The dynamic attributes connector dashboard displays options for managing dynamic attributes filters, including adding, editing, and deleting filters. for additional options.

You can click the name of a filter to view all instances of that filter or you can click The dynamic attributes connector dashboard displays options for managing dynamic attributes filters, including adding, editing, and deleting filters. for the following additional options:

  • Go to Dynamic Attributes Filters to view all configured dynamic attributes filters. You can add, edit, or delete dynamic attributes filters from there.

  • Add Dynamic Attributes Filters to add a filter.

For more information about adding dynamic attributes filters, see Create dynamic attributes filters.

An example follows:

Displaying information about a dynamic attributes filter from the dashboard


Note


Some connectors, such as Outlook 365 and Azure Service tags, automatically pull available dynamic objects without the need for a dynamic attributes filters. Those connectors display Auto in the column.


You have these options:

  • Click a filter instance to view summary information about dynamic attributes filters associated with a connector.

  • Click the Add icon (add icon) to add a new dynamic attributes filter.

    For more information, see Create dynamic attributes filters.

  • Click The interface displays options for managing dynamic attributes filters, including viewing summaries, adding new filters, and indicating connectors without associated filters. in the filters column (The image illustrates the interface for managing dynamic attributes filters, showing options to add, edit, or delete filters associated with a connector.) indicates the indicated connector has no associated dynamic attributes filters. Without associated filters, the connector can send nothing to Firewall Management Center.

    One way to resolve the issue is to click The image illustrates a sample interface for adding, editing, or deleting dynamic attributes filters in a management center, highlighting the filters column and the action buttons available for managing filters. in the filters column and click Add Dynamic Attributes Filter. A sample follows.

    Add a dynamic attributes filter so the management center can start receiving dynamic objects

  • Click The image illustrates a user interface for adding, editing, or deleting dynamic attributes filters in a management center, highlighting the relevant buttons and options available in the filters column. to add, edit, or delete filters.

  • Click The image illustrates a sample interface for adding, editing, or deleting dynamic attributes filters in a management center, highlighting the filters column and the relevant action buttons. to close the panel.

Connectors

A connector is an interface with a cloud service. It retrieves network information from the cloud service to enable the network information to be used in policies on the Secure Firewall Management Center. It supports both air gap mode and network download mode configurations.

Supported connectors

We support these connectors:

Table 4. List of supported connectors by dynamic attributes connector version and platform

CSDAC version

AWS

AWS Security Groups

AWS Service Tags

Azure

Azure Service Tags

Cisco APIC

Cisco Cyber Vision

Cisco Multicl. Defense

Generic text

GitHub

Google Cloud

Microsoft Office 365

Tenable

vCenter

Webex

Zoom

Version 1.1 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

No

No

Yes

No

Yes

No

No

Version 2.0 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

No

Yes

Yes

No

Yes

No

No

Version 2.2 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

Yes

Yes

Yes

No

Yes

No

No

Version 2.3 (on-premises)

Yes

No

No

Yes

Yes

No

No

No

No

Yes

Yes

Yes

No

Yes

Yes

Yes

Version 3.0 (on-premises)

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Version 3.1 (on-premises)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Cloud-delivered (Security Cloud Control)

Yes

No

No

Yes

Yes

No

No

Yes

No

Yes

Yes

Yes

Yes

No

No

No

Secure Firewall Management Center 7.4.1

Yes

No

No

Yes

Yes

No

No

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Secure Firewall Management Center 7.6

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Secure Firewall Management Center 7.7

Yes

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Yes

Yes

Yes

No

Yes

Yes

Yes

Amazon Web Services connector user permissions and imported data

The dynamic attributes connector imports dynamic attributes from Amazon Web Services (AWS) to Secure Firewall Management Center for use in policies.

Dynamic attributes imported

The connector imports these dynamic attributes from AWS:

  • Tags, user-defined key-value pairs you can use to organize your AWS EC2 resources.

    For more information, see Tag your EC2 Resources in the AWS documentation

  • IP addresses of virtual machines in AWS.

Minimum permissions required

The dynamic attributes connector requires a user at minimum with a policy that permits ec2:DescribeTags, ec2:DescribeVpcs, and ec2:DescribeInstances to be able to import dynamic attributes.

Create an AWS user with minimal permissions for the dynamic attributes connector

This task creates a service account with minimum permissions to send dynamic attributes to Secure Firewall Management Center .

For a list of the dynamic attributes that can be sent, refer to Amazon Web Services connector user permissions and imported data.

Before you begin

You must already have set up your Amazon Web Services (AWS) account. For more information about doing that, see this article in the AWS documentation.

Follow these steps to create an AWS user with minimal permissions for the dynamic attributes connector:

Procedure

Step 1

Log in to the AWS console as a user with the admin role.

Step 2

From the Dashboard, click Security, Identity & Compliance > IAM.

Step 3

Click Access Management > Users.

Step 4

Click Add Users.

  1. In the User Name field, enter a name to identify the user.

  2. Click Access Key - Programmatic Access.

  3. At the Set permissions page, click Next without granting the user access to anything. You can grant user access later.

  4. Add tags to the user if desired.

  5. Click Create User.

  6. Click Download .csv to download the user's key to your computer.

    Note

     

    This is the only opportunity you have to retrieve the user's key.

  7. Click Close.

Step 5

At the Identity and Access Management (IAM) page in the left column, click Access Management > Policies.

Step 6

Click Create Policy.

  1. On the Create Policy page, click JSON.

    Create a JSON policy

  2. Enter the following policy in the field:

    {
    	"Version": "2012-10-17",
    	"Statement": [
    		{
    			"Effect": "Allow",
    			"Action": [
    				"ec2:DescribeTags",
    				"ec2:DescribeInstances",
    				"ec2:DescribeVpcs"
    			],
    			"Resource": "*"
    		}
    	]
    }
    
  3. Click Next.

Step 7

Click Review.

On the Review Policy page, enter the requested information and click Create Policy.

Step 8

Attach your policy

  1. On the Policies page, enter all or part of the policy name in the search field and press Enter.

  2. Click the policy you just created.

  3. Click Actions > Attach.

  4. If necessary, enter all or part of the user name in the search field and press Enter.

  5. Click Attach Policy.


What to do next

Create an AWS connector.

Create an AWS connector

Create a connector to send dynamic objects from AWS to the firewall for use in security policies.

This task discusses how to configure a connector that sends data from AWS to the Secure Firewall Management Center for use in policies.

Before you begin

Create a user with at least the privileges discussed in Create an AWS user with minimal permissions for the dynamic attributes connector.

Follow these steps to create an AWS connector:

Procedure

Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of these actions:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the required information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from AWS.

Region

(Required.) Enter your AWS region code.

Access Key

(Required.) Enter your access key.

Secret Key

(Required.) Enter your secret key.

  1. Click Save.

    The Status column displays Ok.


Amazon Web Services security groups connector—About user permissions

The dynamic attributes connector imports dynamic attributes from AWS to Secure Firewall Management Center for use in policies.

Minimum permissions required

The dynamic attributes connector requires a user at minimum with a policy that permits ec2:DescribeTags, ec2:DescribeVpcs, and ec2:DescribeInstances to be able to import dynamic attributes.

Create an AWS user with minimal permissions for the dynamic attributes connector

This task creates a service account with minimum permissions to send dynamic attributes to Secure Firewall Management Center .

For a list of the dynamic attributes that can be sent, refer to Amazon Web Services connector user permissions and imported data.

Before you begin

You must already have set up your Amazon Web Services (AWS) account. For more information about doing that, see this article in the AWS documentation.

Follow these steps to create an AWS user with minimal permissions for the dynamic attributes connector:

Procedure

Step 1

Log in to the AWS console as a user with the admin role.

Step 2

From the Dashboard, click Security, Identity & Compliance > IAM.

Step 3

Click Access Management > Users.

Step 4

Click Add Users.

  1. In the User Name field, enter a name to identify the user.

  2. Click Access Key - Programmatic Access.

  3. At the Set permissions page, click Next without granting the user access to anything. You can grant user access later.

  4. Add tags to the user if desired.

  5. Click Create User.

  6. Click Download .csv to download the user's key to your computer.

    Note

     

    This is the only opportunity you have to retrieve the user's key.

  7. Click Close.

Step 5

At the Identity and Access Management (IAM) page in the left column, click Access Management > Policies.

Step 6

Click Create Policy.

  1. On the Create Policy page, click JSON.

    Create a JSON policy

  2. Enter the following policy in the field:

    {
    	"Version": "2012-10-17",
    	"Statement": [
    		{
    			"Effect": "Allow",
    			"Action": [
    				"ec2:DescribeTags",
    				"ec2:DescribeInstances",
    				"ec2:DescribeVpcs"
    			],
    			"Resource": "*"
    		}
    	]
    }
    
  3. Click Next.

Step 7

Click Review.

On the Review Policy page, enter the requested information and click Create Policy.

Step 8

Attach your policy

  1. On the Policies page, enter all or part of the policy name in the search field and press Enter.

  2. Click the policy you just created.

  3. Click Actions > Attach.

  4. If necessary, enter all or part of the user name in the search field and press Enter.

  5. Click Attach Policy.


What to do next

Create an AWS connector.

Create an AWS security groups connector

This task creates a connector that sends AWS security groups data to the Secure Firewall Management Center for use in policies.

This task discusses how to configure a connector that sends AWS security groups data to the Secure Firewall Management Center for use in policies.

Before you begin

Complete these steps:

Follow these steps to create an AWS Security Groups connector:

Procedure

Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from AWS.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Region

(Required.) Enter your AWS region code.

AWS Access Key

(Required.) Enter your access key.

AWS Secret Key

(Required.) Enter your secret key.

  1. Click Save.

    The Status column displays Ok.


Create an AWS service tags connector

Create a connector for Amazon Web Services (AWS) service tags to the Secure Firewall Management Center for use in policies.

For more information, see resources like the following on the AWS documentation site:

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the necessary information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

URL

(Required.) Do not change the URL unless advised to do so.

  1. Click Save.

    The Status column displays Ok.


Azure connector—About user permissions and imported data

The dynamic attributes connector imports dynamic attributes from Azure to Secure Firewall Management Center for use in policies.

Dynamic attributes imported

We import these dynamic attributes from Azure:

  • Tags, key-value pairs associated with resources, resource groups, and subscriptions.

    For more information, see this page in the Microsoft documentation.

  • IP addresses of virtual machines in Azure.

Minimum permissions required

The dynamic attributes connector requires a user at minimum with the Reader permission to be able to import dynamic attributes.

Create an Azure user with minimal permissions for the dynamic attributes connector

Create an Azure service account with minimal permissions to send dynamic attributes to Secure Firewall Management Center.

This task discusses how to set up a service account with minimum permissions to send dynamic attributes to Secure Firewall Management Center. For a list of these attributes, see Azure connector—About user permissions and imported data.

Before you begin

You must already have a Microsoft Azure account. To set one up, see this page on the Azure documentation site.

Follow these steps to create an Azure user with minimal permissions for the dynamic attributes connector:

Procedure

Step 1

Log in to the Azure Portal as the owner of the subscription.

Step 2

Click Azure Active Directory.

Find the instance of Azure Active Directory for the application you want to set up.

Step 3

Click Add > App registration.

  1. In the Name field, enter a name to identify this application.

  2. Enter other information on this page as required by your organization.

  3. Click Register.

Step 4

On the next page, write down or copy the Client ID (also referred to as application ID) and the tenant ID (also referred to as the directory ID).

Here is a sample:

Make note of the application and tenant ID

Step 5

Next to Client Credentials, click Add a certificate or secret.

Step 6

Click New Client Secret.

  1. Enter the requested information and click Add.

  2. Copy the value of the Value field to the clipboard. This value, and not the Secret ID, is the client secret.

    Copy the client secret to the clipboard now because you will not see it again

Step 7

Go back to the main Azure Portal page and click Subscriptions.

  1. Click the name of your subscription.

  2. Copy the subscription ID to the clipboard.

    Copy the subscription ID to the keyboard

Step 8

Click Access Control (IAM).

  1. Click Add > Add role assignment.

  2. Click Reader and click Next.

  3. Click Select Members.

  4. On the right side of the page, click the name of the app you registered and click Select.

    Associate the role with your app

  5. Click Review + Assign and follow the prompts to complete the action.

    Also see Create an Azure connector.


Create an Azure connector

Create a connector to send data from Azure to Secure Firewall Management Center for use in policies.

This connector enables integration between Azure and your security management platform to retrieve dynamic object information for policy implementation.

Before you begin

Create an Azure user with at least the privileges discussed in Create an Azure user with minimal permissions for the dynamic attributes connector.

Procedure

Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from Azure.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Subscription ID

(Required.) Enter your Azure subscription ID.

Tenant ID

(Required.) Enter your tenant ID.

Client ID

(Required.) Enter your client ID.

Client Secret

(Required.) Enter your client secret.

  1. Click Save.

    The Status column displays Ok.


Create an Azure service tags connector

Create a connector for Azure service tags to enable use in policies with automatically updated IP addresses from Microsoft.

This topic discusses how to create a connector for Azure service tags to the Secure Firewall Management Center for use in policies. The IP addresses associated with these tags are updated every week by Microsoft.

For more information, see Virtual network service tags on Microsoft TechNet.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the required information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from Azure.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Subscription ID

(Required.) Enter your Azure subscription ID.

Tenant ID

(Required.) Enter your tenant ID.

Client ID

(Required.) Enter your client ID.

Client Secret

(Required.) Enter your client secret.

  1. Click Save.

    The Status column displays Ok.


Create a Cisco cyber vision connector

This task creates a connector to send data from Cisco Cyber Vision to the firewall, enabling dynamic attribute integration between these systems.

This task discusses how to send data from Cisco Cyber Vision to the Secure Firewall Management Center .

Before you begin

Cisco Cyber Vision must be reachable from the machine on which the dynamic attributes connector is running. You must know its IP address, port, and API key.

To find the API key in the Cyber Vision management console, click Admin > API > Token, then click Show to display the token and The Cisco Cyber Vision management console interface displays the steps to access the API key, including navigation to the Admin section and the option to show and copy the token. to copy the token to the clipboard.

Follow these steps to create a Cisco Cyber Vision connector:

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the required information.

Value

Description

Name

(Required) Enter a name to uniquely identify this connector.

Description

Optional description.

Cyber Vision Prefix

Enter an alphanumeric string to identify dynamic objects from this Cyber Vision's IP address when objects are sent to Secure Firewall Management Center .

If you have one Cyber Vision IP address, you can enter any value such as 1 .

Pull Interval

(Default 60 seconds) Interval at which data mappings are retrieved from Cyber Vision.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Host

(Required) Enter the Cyber Vision fully qualified host name or IP address.

Port

(Required) Enter the Cyber Vision listen port.

Token

(Required) Enter the API token.

  1. Click Test and make sure the test succeeds before you save the connector.

  2. Click Save.

    Status column displays Ok.


Create a generic text connector

Use this task to create a connector that retrieves IP addresses from text files and sends them to the firewall for use in access control rules.

This task discusses how to create an ad hoc list of IP addresses you maintain manually and retrieve at an interval you select (30 seconds by default). You can update the list of addresses anytime you want.

For example, you might have a list of IP addresses for an "allow list" in access control rules and another list of IP addresses for a "block list" in access control rules.

Before you begin

Create text files with IP addresses and put it on a web server that is accessible from the Secure Firewall Management Center . IP addresses can include CIDR notation. The text file must have only one IP address per line.

You can specify up to 10,000 IP addresses per text file.

Follow these steps to create a generic text connector:

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information:

Item

Description

Name

Enter a name to identify the connector.

Description

(Optional.) Enter a description

Pull Interval

Change the frequency, in seconds, at which the dynamic attributes connector retrieves IP addresses from the text file. The default is 30 seconds.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

URLs

Enter a URL from which to retrieve IP addresses.

Add another URL

(Optional.) Click the link to add more URLs to an existing list.

Certificate

(Optional.) If a certificate chain is required for a secure connection to the web server, you have these options:

  • Click Get Certificate > Fetch to automatically fetch the certificate or, if that is not possible, get the certificate manually as discussed in Manually get a certificate authority (CA) chain.

  • Click Get Certificate > Browse from file to upload a certificate chain you downloaded previously.

  1. Click Test and make sure the test succeeds before you save the connector.

  2. Click Save.

  3. Status column displays Ok


Create a GitHub connector

Create a GitHub connector that sends data to the Secure Firewall Management Center for use in policies. The IP addresses associated with these tags are maintained by GitHub.

For more information, see About GitHub's IP addresses.


Note


Do not change the URL because doing so will fail to retrieve any IP addresses.


Before you begin

You do not have to create a dynamic attributes filters.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter a Name and an optional description.

  1. (Optional) In the Pull Interval field, change the frequency, in seconds, at which the dynamic attributes connector retrieves IP addresses from GitHub. The default is 21,600 seconds (6 hours).

  2. Click Save.

    The Status column displays Ok.


Google cloud connector user permissions and imported data

A Google Cloud connector imports dynamic attributes from Google Cloud to Secure Firewall Management Center for use in policies.

Dynamic attributes imported

The connector imports these dynamic attributes from Google Cloud:

  • Labels: Key-value pairs you can use to organize your Google Cloud resources. For more information, see Creating and Managing Labels in the Google Cloud documentation.

  • Network tags: Key-value pairs associated with an organization, folder, or project. For more information, see Creating and Managing Tags in the Google Cloud documentation.

  • IP addresses: Virtual machine addresses in Google Cloud.

The dynamic attributes connector requires a user at minimum with the Basic > Viewer permission to be able to import dynamic attributes.

Create a Google Cloud user with minimal permissions for the dynamic attributes connector

Create a service account with minimum permissions to send dynamic attributes to Secure Firewall Management Center .

This task sets up a service account that provides the minimum permissions necessary for the dynamic attributes connector. For a list of these attributes, see Google cloud connector user permissions and imported data.

Before you begin

You must already have set up your Google Cloud account. For more information about doing that, see Setting Up Your Environment in the Google Cloud documentation.

Procedure

Step 1

Log in to your Google Cloud account as a user with the owner role.

Step 2

Click IAM & Admin > Service Accounts > Create Service Account.

Step 3

Enter the following information:

  • Service account name: A name to identify this account; for example, CSDAC.

  • Service account ID: Should be populated with a unique value after you enter the service account name.

  • Service account description: Enter an optional description.

For more information about service accounts, see Understanding Service Accounts in the Google Cloud documentation.

Click Create and Continue.

Step 4

Follow the prompts on your screen until the Grant users access to this service account section is displayed.

Grant the user the Basic > Viewer role.

Click Done.

A list of service accounts is displayed.

Step 5

Click More (more icon) at the end of the row of the service account you created.

Step 6

Click Manage Keys.

Step 7

Click Add Key > Create New Key.

Create a new key for your user

Step 8

Click JSON.

Step 9

Click Create.

The JSON key is downloaded to your computer.

Keep the key handy when you configure the GCP connector.

See Create a google cloud connector.


Create a google cloud connector

Create a Google Cloud connector to enable data transmission from your Google Cloud environment to the firewall for dynamic security attribute monitoring and management.

The Google Cloud connector allows the firewall to receive real-time data from your Google Cloud infrastructure, enabling dynamic security policies based on cloud resource attributes.

Before you begin

Have your Google Cloud JSON-formatted service account data ready; it's required to set up the connector.

Follow these steps to create a Google Cloud connector:

Procedure

Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from AWS.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

GCP region

(Required.) Enter the GCP region in which your Google Cloud is located. For more information, see Regions and Zones in the Google Cloud documentation.

Service account

Paste the JSON code for your Google Cloud service account.

  1. Click Save.

    The Status column displays Ok.


Create an office 365 connector

Create a connector for Office 365 tags to send data to the Secure Firewall Management Center for use in policies.

The IP addresses associated with these tags are updated every week by Microsoft. You do not have to create a dynamic attributes filter to use the data.

For more information, refer to Office 365 URLs and IP address ranges on docs.microsoft.com.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from Azure.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Base API URL

(Required.) Enter the URL from which to retrieve Office 365 information, if it's different from the default. For more information, see Office 365 IP Address and URL web service on the Microsoft documentation site.

Instance name

(Required.) From the list, click an instance name. For more information, see Office 365 IP Address and URL web service on the Microsoft documentation site.

Disable optional IPs

(Required.) Enter true or false .

Step 5

Click Save.

The Status column displays Ok.


vCenter connector—About user permissions and imported data

The Dynamic Attributes Connector imports dynamic attributes from vCenter to Secure Firewall Management Center for use in policies.

Dynamic attributes imported

We import these dynamic attributes from vCenter:

  • Operating system

  • MAC address

  • IP addresses

  • NSX tags

Minimum permissions required

The Dynamic Attributes Connector requires a user at minimum with the Read Only permission to be able to import dynamic attributes.

Create a vCenter user with minimal permissions for the dynamic attributes connector

Create a service account with minimum permissions to send dynamic attributes to Secure Firewall Management Center .

This task provides the steps to set up a service account with minimum permissions required for the dynamic attributes connector. For a list of these attributes, see vCenter connector—About user permissions and imported data.

Before you begin

You must already have set up your vCenter Server account. For more information about doing that, see About vCenter Server Installation and Setup in the vCenter documentation.

Follow these steps to create a vCenter user with minimal permissions for the dynamic attributes connector:

Procedure

Step 1

Log into vCenter as an administrator.

Step 2

Click Menu > Administration.

Step 3

In the left pane, click Single Sign On > Users and Groups.

Step 4

From the Domain list, click the name of a domain to add the user.

Step 5

Click Add User.

  1. Enter the requested information and click Add.

Step 6

In the left pane, click Access Control > Global Permissions.

Step 7

Click Add(add icon).

  1. From the User field, click the name of the vCenter domain in which you created the user.

  2. In the search field, enter part of the user's name.

  3. From the Role list, click Read-only.

  4. Select the Propagate to children check box.

    When you create the role, make sure you propagate it to its children

Step 8

Click OK.


What to do next

See Create a vCenter connector.

Create a vCenter connector

Create a connector for VMware vCenter to send data to the Secure Firewall Management Center for use in policies.

This connector enables the management center to receive dynamic attribute information from vCenter Server for use in security policies and monitoring.

Before you begin

If you use non-trusted certificates to communicate with vCenter, see Manually get a certificate authority (CA) chain.

Procedure

Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Enter an optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from vCenter.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Host

(Required.) Enter any of the following:

  • vCenter's fully qualified host name

  • vCenter's IP address

  • (Optional.) A port

Do not enter a scheme (such as https://) or trailing slash.

For example, myvcenter.example.com or 192.0.2.100:9090

User

(Required.) Enter the user name of a user with the Read-only role at minimum. User names are case-sensitive.

Password

(Required.) Enter the user's password.

NSX IP

If you use vCenter Network Security Visualization (NSX), enter its IP address.

NSX User

Enter the user name of an NSX user with the Auditor role at minimum.

NSX Type

Enter NSX-T.

NSX Password

Enter the NSX user's password.

vCenter Certificate

You have the following options:

Following is an example of successfully fetching a certificate chain:

Sample of fetching a CA certificate for a vCenter connector

Expanding the certificate CA chain at the top of the dialog box displays the certificates similar to the following.

You can see the certificates in the chain if you expand the certificates

If it's not possible to fetch the certificate this way, you can get the certificate chain manually as discussed in Manually get a certificate authority (CA) chain.

Step 5

Click Save.


Create a Webex connector

This task creates a Webex connector that sends IP addresses to the management system for use in policies. The IP addresses associated with these tags are maintained by Webex.

This section discusses how to create a Webex connector that sends data to the Secure Firewall Management Center for use in policies. The IP addresses associated with these tags are maintained by Webex. You do not have to create a dynamic attributes filters.

For more information, see Port Reference for Webex Calling.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter the following information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from Webex.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Provider Reserved IPs

(Required.) (Required.) Slide to enabled to retrieve any reserved IP addresses.

  1. Click Test and make sure the test succeeds before you save the connector.

  2. Click Save.

  3. The Status column displays Ok.


Create a Zoom connector

Create a Zoom connector that sends data to the Secure Firewall Management Center for use in policies.

The IP addresses associated with these tags are maintained by Zoom. You do not have to create a dynamic attributes filters.

For more information, see Zoom network firewall or proxy server settings.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click Integration > Dynamic Attributes Connector > Connectors.

Step 3

Do any of the following:

  • Add a new connector: click Add icon (add icon), then click the name of the connector.

  • Edit or delete a connector: Click More (more icon), then click Edit or Delete at the end of the row.

Step 4

Enter this information.

Value

Description

Name

(Required.) Enter a name to uniquely identify this connector.

Description

Optional description.

Pull Interval

(Default 30 seconds.) Interval at which IP mappings are retrieved from Zoom.

The minimum value for Pull Interval is 1 second. You can set the maximum to any value you want. We recommend against setting the minimum to a low value because it can generate a lot of traffic, and, when applicable, can result in your being billed for the traffic.

Provider Reserved IPs

(Required.) Slide to enabled to retrieve any reserved IP addresses.

  1. Click Test and make sure the test succeeds before you save the connector.

  2. Click Save.

    The Status column displays Ok.


Create dynamic attributes filters

Create dynamic attributes filters to expose them as dynamic objects in Secure Firewall Management Center for use in access control policies.

Dynamic attributes filters that you define using the Dynamic Attributes Connector are exposed in the Secure Firewall Management Center as dynamic objects that can be used in access control policies. For example, restrict access to an AWS server for the Finance Department to only members of the Finance group defined in Microsoft Active Directory.


Note


You cannot create dynamic attributes filters for Generic Text, Office 365, Azure Service Tags, Webex, or Zoom. These types of cloud objects provide their own IP addresses.


For more information about access control rules, see Create access control rules using dynamic attributes filters.

Before you begin

Connectors

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Click Integration > Dynamic Attributes Connector > Dynamic Attributes Filters.

Step 2

Do any of the following:

  • Add a new filter: click Add (add icon).

  • Edit or delete a filter: Click More (more icon), then click Edit or Delete at the end of the row.

Step 3

Enter the following information.

Item

Description

Name

Unique name to identify the dynamic filter (as a dynamic object) in a policy and in the Secure Firewall Management Center Object Manager (External Attributes > Dynamic Object).

Connector

From the list, click the name of a connector to use.

Query

Click Add add icon.

Step 4

To add or edit a query, enter the following information.

Item Description

Key

Click a key from the list. Keys are fetched from the connector.

Operation

Click one of the following:
  • Equals to exactly match the key to the value.

  • Contains to match the key to the value if any part of the value matches.

Values

Click either Any or All and click one or more values from the list. Click Add another value to add values to your query.

Step 5

Click Show Preview to display a list of networks or IP addresses returned by your query.

Step 6

When you're finished, click Save.

Step 7

(Optional.) Verify the dynamic object in the Secure Firewall Management Center.

  1. Log in to the Secure Firewall Management Center as a user with the Network Admin role at minimum.

  2. Click Objects > Object Management > External Attributes > Dynamic Object.

    The dynamic attribute query you created should be displayed as a dynamic object.


Dynamic attribute filter examples

This topic provides some examples of setting up dynamic attribute filters.

Examples: vCenter

This example shows one criterion: a VLAN.

This sample shows a simple vCenter dynamic attributes filter that finds a VLAN

This example shows three criteria that are joined with OR: the query matches any of three hosts.

Another sample vCenter dynamic attributes filter that finds any of three hosts; the query is joined by OR

Example: azure

This example shows one criterion: a server tagged as a Finance app.

Sample Azure dynamic attributes filter that finds the Finance app tag

Example: AWS

This example shows one criterion: a FinanceApp with a value of 1.

Sample Amazon Web Services dynamic attributes filter that finds a tag FinanceApp with a value of 1

Manually get a certificate authority (CA) chain

If the certificate authority chain is not fetched automatically, use one of these browser-specific procedures to get a certificate chain to securely connect to vCenter or Firewall Management Center .

The certificate chain is the root certificate and all subordinate certificates.

Procedure

  Command or Action Purpose

Step 1

Get a Certificate Chain—Mac (Chrome and Firefox)

  1. Open a Terminal window.

  2. Enter the following command:

    
              security verify-cert -P 
              url[:port]
    

    where url is the URL (including scheme) to vCenter or Firewall Management Center . For example:

    security verify-cert -P https://myvcenter.example.com

    If you access vCenter or Firewall Management Center using NAT or PAT, you can add a port as follows:

    security verify-cert -P https://myvcenter.example.com:12345
  3. Save the entire certificate chain to a plaintext file.

    • Include all -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- delimiters.

    • Exclude any extraneous text (for example, the name of the certificate and any text contained in angle brackets ( < and > ) as well as the angle brackets themselves.

  4. Repeat these tasks for vCenter Firewall Management Center .

Step 2

Get a Certificate Chain—Windows Chrome

  1. Log in to vCenter or Firewall Management Center using Chrome.

  2. In the browser address bar, click the lock to the left of the host name.

  3. Click Certificate .

  4. Click the Certification Path tab.

  5. Click the top (that is, first) certificate in the chain.

  6. Click View Certificate .

  7. Click the Details tab.

  8. Click Copy to File .

  9. Follow the prompts to create a CER-formatted certificate file that includes the entire certificate chain.

    When you're prompted to choose an export file format, click Base 64-Encoded X.509 (.CER) .

    In the Certificate Export Wizard, select Base 64 encoded X.509 and export the certificate

    Follow the prompts to complete the export.

    Open the certificate in a text editor.

    Repeat the process for all certificates in the chain.

    You must paste each certificate in the text editor in order, first to last.

    Repeat these tasks for vCenter or Firewall Management Center .

Step 3

Get a Certificate Chain—Windows Firefox

  1. Log in to vCenter or Firewall Management Center using Firefox.

  2. Click the lock to the left of the host name.

  3. Click the right arrow ( Show connection details ).

    In Firefox, show the connection details to see the certificate being used to connect to the FMC
  4. Click More Information .

  5. Click View Certificate .

  6. If the resulting dialog box has tab pages, click the tab page corresponding to the top-level CA.

  7. Scroll to the Miscellaneous section.

  8. Click PEM (chain) in the Download row.

    Get the PEM chain to configure the FMC adapter
  9. Save the file.

    Repeat these tasks for vCenter or Firewall Management Center .

Dynamic objects in access control rules

A dynamic object is automatically pushed from the dynamic attributes connector to the Secure Firewall Manager after you create connectors and save a dynamic attributes filter on the connector.

You can use these dynamic objects on the access control rule's Dynamic Attributes tab page. You can add dynamic objects as source or destination attributes.

Dynamic object usage examples

In an access control block rule, you can add a Finance dynamic object as a destination attribute to block access to Finance servers by whatever objects match the other criteria in the rule.

Dynamic attributes filter limitations


Note


You cannot create dynamic attributes filters for Generic Text, Office 365, Azure Service Tags, Webex, or Zoom. These types of cloud objects provide their own IP addresses.


Create dynamic attributes filters

Create dynamic attributes filters to expose them as dynamic objects in Secure Firewall Management Center for use in access control policies.

Dynamic attributes filters that you define using the Dynamic Attributes Connector are exposed in the Secure Firewall Management Center as dynamic objects that can be used in access control policies. For example, restrict access to an AWS server for the Finance Department to only members of the Finance group defined in Microsoft Active Directory.


Note


You cannot create dynamic attributes filters for Generic Text, Office 365, Azure Service Tags, Webex, or Zoom. These types of cloud objects provide their own IP addresses.


For more information about access control rules, see Create access control rules using dynamic attributes filters.

Before you begin

Connectors

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Click Integration > Dynamic Attributes Connector > Dynamic Attributes Filters.

Step 2

Do any of the following:

  • Add a new filter: click Add (add icon).

  • Edit or delete a filter: Click More (more icon), then click Edit or Delete at the end of the row.

Step 3

Enter the following information.

Item

Description

Name

Unique name to identify the dynamic filter (as a dynamic object) in a policy and in the Secure Firewall Management Center Object Manager (External Attributes > Dynamic Object).

Connector

From the list, click the name of a connector to use.

Query

Click Add add icon.

Step 4

To add or edit a query, enter the following information.

Item Description

Key

Click a key from the list. Keys are fetched from the connector.

Operation

Click one of the following:
  • Equals to exactly match the key to the value.

  • Contains to match the key to the value if any part of the value matches.

Values

Click either Any or All and click one or more values from the list. Click Add another value to add values to your query.

Step 5

Click Show Preview to display a list of networks or IP addresses returned by your query.

Step 6

When you're finished, click Save.

Step 7

(Optional.) Verify the dynamic object in the Secure Firewall Management Center.

  1. Log in to the Secure Firewall Management Center as a user with the Network Admin role at minimum.

  2. Click Objects > Object Management > External Attributes > Dynamic Object.

    The dynamic attribute query you created should be displayed as a dynamic object.


Dynamic attributes rule conditions

Dynamic attributes rule conditions allow you to specify access control rules based on real-time properties such as network objects, device types, locations, and security tags. These conditions determine how access control rules match traffic based on various attributes, optimizing policy flexibility and accuracy.

Types of dynamic attributes

Dynamic attributes include:

  • (source or destination) Dynamic objects (such as from the dynamic attributes connector)

    The dynamic attributes connector enables you to collect data (such as networks and IP addresses) from cloud providers and send it to the Secure Firewall Management Center so they can be used in access control rules.

    For more information about the dynamic attributes connector, see About the dynamic attributes connector.

  • (source only) SGT objects contain tags either manually defined or defined in ISE. For more information, see Source and destination security group tag (SGT) matching and Security group tags.

  • (source only) Location IP objects, defined by Cisco ISE

  • (source only) Device type objects, defined by Cisco ISE (also referred to as endpoint profile objects)

Combining objects in rules

Dynamic attributes can be used as source criteria and destination criteria in access control rules. Use these guidelines:

  • Objects of different types are ANDd together

  • Objects of a similar type are ORd together

For example, if you choose source destination criteria SGT 1, SGT 2, and device type 1, the rule matches if device type 1 is detected on either SGT 1 or SGT 2.

If you select both a security group tag, and a dynamic object that lists IP addresses, the rule matches if traffic with the tag originating from, or destined to, one of those IP addresses.

Create access control rules using dynamic attributes filters

Create access control rules using dynamic objects that are based on dynamic attributes filters you have previously configured.

This topic discusses how to create access control rules using dynamic objects (these dynamic objects are named after the dynamic attributes filters you created previously).

To add dynamic attributes filters to DNS policies, see Create basic DNS policies.

Before you begin

Create dynamic attributes filters as discussed in Create dynamic attributes filters.


Note


You cannot create dynamic attributes filters for Generic Text, Office 365, Azure Service Tags, Webex, or Zoom. These types of cloud objects provide their own IP addresses.


Follow these steps to create access control rules using dynamic attributes filters:

Procedure


Step 1

Log in to the Secure Firewall Management Center

Click Policies > Access Control heading > Access Control.

Step 2

Click Edit (edit icon) next to an access control policy.

Step 3

Click Add Rule.

Step 4

Click the Dynamic Attributes tab.

Step 5

In the Available Attributes section, from the list, click Dynamic Objects.

The following figure shows an example.

Configure Dynamic Attributes created using the dynamic attributes connector as dynamic objects in access control rules. Use those exactly as you would network objects.

This example shows a dynamic object named APIC Dynamic Attribute that corresponds to the dynamic attribute filter created in the dynamic attributes connector.

Step 6

Add the desired object to source or destination attributes.

Step 7

Add other conditions to the rule if desired.

See Dynamic attributes rule conditions.


Use dynamic objects in DNS policies

Use dynamic objects in DNS rules to enable dynamic filtering capabilities based on attributes from the dynamic attributes connector.

The dynamic attributes connector enables you to configure dynamic filters seen in the Secure Firewall Management Center as dynamic objects, in DNS rules. For information about DNS policies, see DNS Policies for Security Intelligence.

A dynamic object is automatically pushed from the dynamic attributes connector to the Secure Firewall Management Center after you create connectors and save a dynamic attributes filter on the connector.

You can use these dynamic objects on the DNS rule's Dynamic Attributes tab page, similarly to the way you use Security Group Tags (SGTs). You can add dynamic objects as source or destination attributes, except for endpoint device type objects, which are source only.

Procedure


Step 1

Click Policies > Access Control heading > DNS and create or edit a DNS policy.

Step 2

Add or edit a rule.

Step 3

Click the Dynamic Attributes tab.

Step 4

In the Dynamic Attributes list, select the objects you want to use, then add them to the source or destination lists as appropriate.

Initially, all security group and dynamic objects are listed, by you can uncheck the Security Group option to see dynamic objects only.

Step 5

On the DNS tab, select the appropriate list or feed to match the DNS requests you are targeting.

Step 6

Add other conditions to the rule if desired and set the action.

Step 7

Click Save.


Disable the dynamic attributes connector

Disable the Dynamic Attributes Connector when you no longer wish to collect dynamic objects from cloud sources.

If you no longer wish to collect dynamic objects from cloud sources, you can disable the Dynamic Attributes Connector in the Secure Firewall Management Center.

Procedure


Step 1

Log in to the Secure Firewall Management Center if you have not done so already.

Step 2

Click Integration > Dynamic Attributes Connector.

Step 3

Slide to Disabled.


Troubleshoot using the Secure Firewall Management Center

Generate troubleshoot files to diagnose and resolve issues with the Secure Firewall Management Center.

This task discusses how to generate troubleshoot files for the Secure Firewall Management Center.

Procedure


Step 1

Log in to the Secure Firewall Management Center.

Step 2

Click System (system gear icon) > Health > Monitor.

Step 3

In the left pane, click Firewall Management Center.

Step 4

At the top, click System & Troubleshooting Details.

Step 5

Click Generate Troubleshooting Files.

Step 6

Provide the files to Cisco TAC or to your Beta coordinator.


Manually get a certificate authority (CA) chain

If the certificate authority chain is not fetched automatically, use one of these browser-specific procedures to get a certificate chain to securely connect to vCenter or Firewall Management Center .

The certificate chain is the root certificate and all subordinate certificates.

Procedure

  Command or Action Purpose

Step 1

Get a Certificate Chain—Mac (Chrome and Firefox)

  1. Open a Terminal window.

  2. Enter the following command:

    
              security verify-cert -P 
              url[:port]
    

    where url is the URL (including scheme) to vCenter or Firewall Management Center . For example:

    security verify-cert -P https://myvcenter.example.com

    If you access vCenter or Firewall Management Center using NAT or PAT, you can add a port as follows:

    security verify-cert -P https://myvcenter.example.com:12345
  3. Save the entire certificate chain to a plaintext file.

    • Include all -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- delimiters.

    • Exclude any extraneous text (for example, the name of the certificate and any text contained in angle brackets ( < and > ) as well as the angle brackets themselves.

  4. Repeat these tasks for vCenter Firewall Management Center .

Step 2

Get a Certificate Chain—Windows Chrome

  1. Log in to vCenter or Firewall Management Center using Chrome.

  2. In the browser address bar, click the lock to the left of the host name.

  3. Click Certificate .

  4. Click the Certification Path tab.

  5. Click the top (that is, first) certificate in the chain.

  6. Click View Certificate .

  7. Click the Details tab.

  8. Click Copy to File .

  9. Follow the prompts to create a CER-formatted certificate file that includes the entire certificate chain.

    When you're prompted to choose an export file format, click Base 64-Encoded X.509 (.CER) .

    In the Certificate Export Wizard, select Base 64 encoded X.509 and export the certificate

    Follow the prompts to complete the export.

    Open the certificate in a text editor.

    Repeat the process for all certificates in the chain.

    You must paste each certificate in the text editor in order, first to last.

    Repeat these tasks for vCenter or Firewall Management Center .

Step 3

Get a Certificate Chain—Windows Firefox

  1. Log in to vCenter or Firewall Management Center using Firefox.

  2. Click the lock to the left of the host name.

  3. Click the right arrow ( Show connection details ).

    In Firefox, show the connection details to see the certificate being used to connect to the FMC
  4. Click More Information .

  5. Click View Certificate .

  6. If the resulting dialog box has tab pages, click the tab page corresponding to the top-level CA.

  7. Scroll to the Miscellaneous section.

  8. Click PEM (chain) in the Download row.

    Get the PEM chain to configure the FMC adapter
  9. Save the file.

    Repeat these tasks for vCenter or Firewall Management Center .

Recommendation: security requirements for network deployment

Install the dynamic attributes connector on a protected internal network. Although the dynamic attributes connector is configured to have only the necessary services and ports available, you must make sure that attacks cannot reach it.

If the dynamic attributes connector and the Secure Firewall Management Center reside on the same network, you can connect the Secure Firewall Management Center to the same protected internal network as the dynamic attributes connector.

Take steps to ensure that communications between appliances cannot be interrupted, blocked, or tampered with. Regardless of how you deploy your appliances, inter-system communication is encrypted. However, you must still protect against distributed denial of service (DDoS) or adversary-in-the-middle attacks.

Internet access requirements

By default, the dynamic attributes connector is configured to communicate with the Firepower System over the internet using HTTPS on port 443/tcp (HTTPS). If you do not want the dynamic attributes connector to have direct access to the internet, you can configure a proxy server.

This information details the URLs the dynamic attributes connector use to communicate with the Secure Firewall Management Center and with external servers.

Table 5. Dynamic Attributes Connector access requirements
URL Reason
https://fmc-ip/api/fmc_platform/v1/ auth/generatetoken

Authentication

https://fmc-ip/api/fmc_config/ v1/domain/domain-id/object/dynamicobjects

GET and POST dynamic objects

https://fmc-ip/api/fmc_config/ v1/domain/ domain-id/object/dynamicobjects/ object-id/mappings?action=add

Add mappings

https://fmc-ip/api/fmc_config/ v1/domain/domain-id /object/dynamicobjects/ object-id/mappings?action=remove

Remove mappings

Table 6. Dynamic Attributes Connector vCenter access requirements
URL Reason
https://vcenter-ip/rest/com/vmware/cis/session

Authentication

https://vcenter-ip/rest/vcenter/VM

GET VM information

https://NSX-ip/api/v1/fabric/virtual-machines/ VM-id

GET NSX-T tag associated with the virtual machine

Migration from DockerHub to Amazon ECR

Docker images for the Dynamic Attributes Connector are being migrated from Docker Hub to Amazon Elastic Container Registry (Amazon ECR).

To use the new field packages, you must allow access through your firewall or proxy to all of the following URLs:

Dynamic Attributes Connector Azure access requirements

The dynamic attributes connector calls built-in SDK methods to GET instance information. These methods internally call https://login.microsoft.com (for authentication) and https://management.azure.com (to GET instance information).

History for the dynamic attributes connector

This document provides the history of features for the dynamic attributes connector, including feature introductions and modifications across different product versions.

Feature

Minimum Firewall Management Center

Minimum Firewall Threat Defense

Details

New connectors

7.6

20241127

AWS security groups, AWS service tags, and Cisco Cyber Vision

These connectors can send an on-premises Secure Firewall Management Center dynamic objects as can Security Cloud Control.

To receive dynamic objects from an on-premises dynamic attributes connector, version 3.0 of the on-premises dynamic attributes connector is required.

Dynamic Attributes Connector

7.4.0

7.4.0

This feature is introduced.

The Dynamic Attributes Connector is now included in the Secure Firewall Management Center. You can use the dynamic attributes connector to get IP addresses from cloud-based platforms such as Microsoft Azure in access control rules without having to deploy to managed devices.

More information:

New/modified screen: Integration > Dynamic Attributes Connector