Early availability features

This topic describes how to enable ASMS's Early Availability features.

ASMS's Early Availability features enable you to access new functionality and support earlier than general availability in hopes that customers provide feedback on the design and implementation. Early Availability features have shorter QA cycles and therefore are disabled by default.

In this topic:

Cisco ISE devices in AFA

Support for Cisco ISE is available as an early availability (EA) feature. ASMS supports Cisco ISE devices as follows:

• Support includes FireFlow, but without ActiveChange
• Support does not include any AppViz features that rely on FireFlow
• Support does not include using a Geographic Distribution Remote Agent to manage Cisco ISE devices.

The following sections describe ASMS's connection to CISCO ISE devices:

• Network connectivity
• Device permissions
• Enable / disable early availability support for Cisco ISE
• Add a Cisco ISE device to AFA

Network connectivity

The following diagram shows an ASMS Central Manager or Remote Agent connecting to a Cisco ISE device.

Device permissions

ASMS connects to Cisco ISE devices via the Admin Node, using the ERS API.

To do so, ASMS requires an Administrator user with Read/Write permissions and the ERS-Operator group assignment.

Additionally, ASMS requires:

• A REST connection over port 9060
• Cisco ISE TrustSec SXP feature enabled for the device

Enable / disable early availability support for Cisco ISE

Do the following:

1. In the AFA Administration area, navigate to the Options > Advanced Configuration tab.

2. Click Add to add a new configuration parameter, and enter the following details:

   Name	AlgoSec_EA_CISCOISE
   Value	Enter one of the following: Yes = enable advanced map support No (default)= disable advanced support

3. Click OK.

Add a Cisco ISE device to AFA

This procedure describes how to add a Cisco ISE device to AFA.

Do the following:

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page.
2. In the vendor and device selection page, select Cisco > CISCO ISE.

3. Complete the fields as needed.

   Access Information

   Enter details for accessing your device.

   Host	Enter the device's host name or IP address.
   User Name	Enter the username to use for device access.
   Password	Enter the password to use for device access.

   Geographic Distribution

   Select the remote agent that should perform data collection for the device.

   To specify that the device is managed locally, select Central Manager.

   This field is relevant when a Geographic Distribution architecture is configured. For more details, see Configure a distributed architecture.

   Options

   Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time change monitoring. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

4. Click Finish. The new device is added to the device tree.

5. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Arista devices in ASMS

This section describes the ASMS Early Availability support for Arista devices:

• Network connectivity
• Device permissions
• Enable / Disable support for Arista
• Add an Arista device to AFA

Network connectivity

The following image shows an ASMS Central Manager or Remote Agent connected to an Arista device over HTTPS-REST.

Device permissions

To analyze Arista devices, ASMS connects to Arista EOS devices using the REST-based eAPI, ensuring high performance and efficient data collection.

ASMS requires a user with Read permissions, and a REST connection over port 443.

The user must also have permissions are required to run the following commands via API Explorer:

• show version
• show interfaces
• show ip interfaces
• show ip route vrf ( all | <vrf-name> )
• show ip access lists”
• show ip access-lists summary

If the REST eAPI is not yet enabled, run the following using the Arista CLI:

Enable / Disable support for Arista

This procedure describes how to enable or disable support for Arista devices in ASMS.

Do the following:

1. In AFA, click your username, and select Administration > Advanced Configuration.

2. Click Add to add a new configuration parameter.

3. Define your parameter values as follows:

   Name	ALGOSEC_EA_ARISTA
   Value	One of the following: yes = Enable Arista device support no = Disable Arista device support

For more details, see Advanced Configuration. Continue with Add an Arista device to AFA.

Add an Arista device to AFA

This procedure describes how to add an Arista EOS device to AFA.

1. Access the Devices Setup page. For details, see Access the DEVICES SETUP page

2. In the vendor device selection page, click Arista > Arista EOS.

3. Complete the following fields:

   Host	Enter the host name of the Arista device. This is the name that will be displayed in the devices tree.
   User Name	Enter the username to use when accessing the device.
   Password	Enter the password to use when accessing the device.
   Enable Password	Enter the enable password to use when accessing the device.

   Note: In the Geographic Distribution area, you must select Central Manager.

   Arista devices cannot be managed by Remote Agents.

4. Click Next, and then select the managed devices you want to add to AFA.

5. Select the following as needed:

   Real-time change monitoring	Select this option to enable real-time alerting upon configuration changes. For details, see Configure real-time monitoring.
   Set user permissions	Select this option to set user permissions for this device.

6. Click Finish. The new device is added to the device tree.

7. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   To select multiple users, press the CTRL button while selecting.

   Click OK to close the dialog.

A success message appears to confirm that the device is added.

Back to top

Enable / Disable map support for Azure

By default, no icon appears in the graphic network map for Azure subscriptions, and traffic simulation queries involving VMs from Azure subscriptions do not benefit from internal routing information. Advanced graphic network map support for Azure devices is available as an early availability feature. Early availability features may be limited in their scope and have undergone a shortened testing cycle. They are disabled by default.

When advanced graphic network map support for Azure devices is enabled, the internal routing information is available to traffic simulation queries and the following network elements appear in the graphic network map: VNet routers, VNet peerings, and internet gateways. The subnets coming off the VNet routers include the containers.

To enable/disable early availability map support for Azure:

1. In the toolbar, click your username.

   A drop-down menu appears.

2. Select Administration.

   The Administration page appears, displaying the Options tab.

3. Click the Advanced Configuration tab.

   The Advanced Configuration page appears.

4. Click Add.

   The Add New Configuration Parameter dialog box appears.

5. In the Name field, type AlgoSec_EA_Azure_Topology.

6. In the Value field, type one of the following:

   • Type yes to enable advanced map support.
   • Type no to disable advanced map support. This is the default setting.

7. Click OK.

Back to top

Enable /Disable ActiveChange for Azure

ActiveChange for Microsoft Azure is available as an early availability feature. Early availability features may be limited in their scope and have undergone a shortened testing cycle. They are disabled by default.

When ActiveChange for Azure is enabled, you can add and remove rules from the policy directly from FireFlow. Note that you cannot create new objects; you are limited to using existing objects. The work order will never recommend creating new objects regardless of whether ActiveChange is enabled.

To enable/disable early availability ActiveChange for Azure:

1. In the toolbar, click your username.

   A drop-down menu appears.

2. Select Administration.

   The Administration page appears, displaying the Options tab.

3. Click the Advanced Configuration tab.

   The Advanced Configuration page appears.

4. Click Add.

   The Add New Configuration Parameter dialog box appears.

5. In the Name field, type AlgoSec_EA_Azure_ActiveChange.
6. In the Value field, type one of the following:
   • Type yes to enable advanced map support.
   • Type no to disable advanced map support. This is the default setting.
7. Click OK.

Back to top

Enable support for Check Point R80 layers

Enabling this feature expands AFA support to include inline layers and ordered layers (global and domain-level). AFA supports these layers in the policy tab (including searching and exporting)and in change monitoring (in the Changes tab directly in the UI and in reports). Additionally, relevant AFA API responses will include layer information.

AFA represents layers with layer specific columns and action values. In the policy tab, each layer is grouped by headings.

Before enabling this feature, AFA supports only the global policy layer and the domain-level first ordered layer. Inline layers and rules in a second (or more) domain-level ordered layer are ignored, and rules with an action that calls an inline layer are treated as allow rules. All early availability features are disabled by default.

Enable early availability support for Check Point R80 Layers

Do the following:

1. In the toolbar, click your username and select Administration to access the AFA Administration area.

2. Click the Advanced Configuration tab.

3. On the Advanced Configuration page, click Add.

4. In the Add New Configuration Parameter dialog, enter the following:

   Name	AlgoSec_EA_CKP_R80_Layers
   Value	This parameter is set to no by default. Define the value as yes to enable it. Once enabled, this feature cannot be disabled again.

5. Click OK.

Back to top