ASMS integration to SaaS services

This topic describes how to create a connection between AppViz (SaaS) and ASMS, enabling all AppViz (SaaS) users to enjoy integration-based features such as ASMS-AppViz (SaaS) network and service object synchronization, connectivity check, Application Discovery, FireFlow change requests and more.

Prerequisites

Supported ASMS versions: Can be integrated with ASMS A32.20 and above.

Connect AppViz (SaaS) to ASMS

This procedure describes how the Admin role can create a AppViz (SaaS) trust token and enter it in ASMS, thus establishing a trust and connecting the two systems.

Note: The following steps are relevant both for existing customers of other AlgoSec SaaS solutions and for customers connecting ASMS to AlgoSec SaaS Services for the first time.

Note: ASMS-AlgoSec SaaS integration supports integrating a single ASMS host (i.e. production, testing or Beta) to each AlgoSec SaaS tenant. If you need to change the ASMS host integrated to AlgoSec SaaS, follow Offboard AlgoSec SaaS (CloudFlow, ObjectFlow, AppViz) from ASMS and then reconnect AppViz (SaaS) to ASMS. If you are also using other AlgoSec SaaS applications, reconnect as well.

Do the following:

  1. Connect to Kafka destination hosts:

    • Connect to the Kafka hosts in the required region.

      Allow outgoing HTTP traffic on port 8082 towards the Kafka hosts.

      Note: If your firewall configuration restricts the usage of these FQDNs for any reason, an alternative approach is to treat the resolved IPs as static instead.

      US region:

      • kafka1.us.algocare.algosec.com

      • kafka2.us.algocare.algosec.com

      • kafka3.us.algocare.algosec.com

      EU region:

      • kafka1.eu.algocare.algosec.com

      • kafka2.eu.algocare.algosec.com

      • kafka3.eu.algocare.algosec.com

      ANZ region:

      • kafka1.anz.algocare.algosec.com

      • kafka2.anz.algocare.algosec.com

      • kafka3.anz.algocare.algosec.com

    Important: In order to maintain the security of your ASMS instance, AppViz (SaaS) is barred from establishing inbound connections to the ASMS host. AppViz (SaaS)-ASMS integration communication is always initiated by ASMS.

  1. Start in AppViz (SaaS), and click the Settings icon at the bottom left of your screen.
  2. Select ASMS INTEGRATION. Click Configuration File.

    Note the downloaded file's name (AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip) and location for use in Step 4, below.
  3. Upload the trust file (AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip) to the ASMS upgrade directory (/root/AlgoSec_Upgrade).

  4. Log in to your ASMS machine with username root.

    Note: More details regarding the algosec_conf utility can be found in Connect to the Administration interface in the ASMS Documentation.

  5. Enter 14 to select option 14. Product and Cloud Configuration from the algosec_conf menu that is displayed .

  6. Enter 3 to select 3. Cloud Integration from the configuration items submenu.

  7. Enter 1 to select 1. Onboard AlgoSec Cloud components.


  8. When prompted for the path of the configuration file, enter: /root/AlgoSec_Upgrade/AlgoSec_Cloud_trust_establish_data-{tenant ID}.zip


    A message will indicate the success or failure of the ASMS-AppViz (SaaS) integration.

Offboard AlgoSec SaaS (CloudFlow, ObjectFlow, AppViz) from ASMS

To manually offboard (remove the trust between the subject ASMS machine and the target SaaS tenant):

Do the following:

  1. Login via SSH to the target ASMS machine as user root

  2. Recommended: Backup the folder: /home/afa/.fa/kafka

  3. Remove the tunnel:

    1. In the algosec_conf main menu, enter 14 Product and cloud configuration.

    2. Enter 3 Cloud Integration.

    3. Enter 2 HTTP tunnel Configuration.

    4. Enter 2 Remove HTTP tunnel.

    5. Confirm by entering y. The tunnel is removed.

  4. Delete the folder: /home/afa/.fa/kafka

  5. Open the file: /home/afa/.fa/config and remove the following parameters:

    1. Kafka_Tenant_Region

    2. Kafka_Tenant_Environment

    3. Cloud_Tenant_Id

    4. APPVIZCLOUD_ENABLED

    Save your changes.

  6. Run the following command: 

    service ms-cloudflow-broker restart

 

â See also: