Create an Azure Connector

Procedure

From the navigation pane, choose Manage > Workloads > Connectors.

Click Azure Connector.

Click Configure your New Connector.

Generate a Azure Resource Manager template with the roles and policies required for the capabilities you wish to enable, and then upload the template to Azure.

Note that without this step, you will not be able to create an Azure Connector Configuration.

Configuration Settings:

Attribute	Description
Connector Name	The name of the connector associating with the Azure connector.
Description	Short description of the connector.
ClientID	The Application (client) ID from the application that you created in Azure for this connector.
ClientID	The Application (client) ID from the application that you created in Azure for this connector.
TenantID	The Directory (tenant) ID from the application that you created in Azure for this connector.
Client Secret or Client Certificate	For authentication, you can use either a client secret or a client certificate and key. Obtain either from the Client credentials link in the application that you created in Azure for this connector. If you use a certificate: The certificate should be unencrypted. Only RSA certificates are supported. Private keys can be either PKCS1 or PKCS8.
HTTP Proxy	Proxy required for Secure Workload to reach Azure. Supported proxy ports: 80, 8080, 443, and 3128.
Full Scan Interval	Frequency with which Secure Workload refreshes complete inventory data from Azure. Default and minimum is 3600 seconds.
Delta Scan Interval	Frequency with which Secure Workload fetches incremental changes in inventory data from Azure. Default and minimum is 600 seconds.

Click either of the below options to create a new Azure connector:

Get Started Guide
OR
Generate Templates

Get Started Guide: Use this option to gather labels and flow data from Azure to enforce segmentation policy using cloud-native constructs, and or to gather labels from EKS clusters.

Before you configure this connector, see:

Requirements and Prerequisites: Understand the general requirements and prerequisites for the Azure cloud connector and the specific requirements for each capability.
This wizard creates an Azure Resource Manager (ARM) template with the permissions required for the capabilities you enable. You can upload this template to a custom role in Azure to assign the necessary permissions.
Segmentation policy enforcement: Before you enable policy enforcement for any VPC, read about important caveats and take action to avoid unintended results.

Click Get Started and under Settings, configure the new connector. For more information, see Edit a New Azure Connector section.

Click Generate Templates.

Cisco Secure Workload requires relevant permissions to access and read flow logs settings and perform policy enforcement. Choose the desired capabilities and based on the capabilities selected, CloudFormation Template (CFT) is generated. Use the generated CFT template in your AWS CloudFormation to create the policy for the User or Role. Select activities to be performed with Cisco Secure Workload on your AWS Resources.

Context Gathering
Ingest Flow Logs
Segmentation
Managed Kubernetes Services

The above selections will determine the RBAC recommendations.

Click Next and read the information on the configuration page.

Configure settings:

Attribute	Description
SubscriptionID	The ID of the Azure subscription that you are associating with this connector.
ClientID	The Application (client) ID from the application that you created in Azure for this connector.
TenantID	The Directory (tenant) ID from the application that you created in Azure for this connector.
Client Secret or Client Certificate	For authentication, you can use either a client secret or a client certificate and key. Obtain either from the Client credentials link in the application that you created in Azure for this connector. If you use a certificate: The certificate should be unencrypted. Only RSA certificates are supported. Private keys can be either PKCS1 or PKCS8.
HTTP Proxy	Proxy required for Secure Workload to reach Azure. Supported proxy ports: 80, 8080, 443, and 3128.
Full Scan Interval	Frequency with which Secure Workload refreshes complete inventory data from Azure. Default and minimum is 3600 seconds.
Delta Scan Interval	Frequency with which Secure Workload fetches incremental changes in inventory data from Azure. Default and minimum is 600 seconds.

Your subscription must have the required privileges before you can continue to the next page in the wizard.

To use the provided Azure Resource Manager (ARM) template to assign required permissions for the connector:

Download the ARM template from the wizard.
Edit the template text to replace Subscription_ID with your subscription ID.

For a connector, you can create multiple subscription IDs in the Azure account.

You can enter multiple subscription IDs where the credentials belong to the same subscription ID.
In Azure, create a custom role in the applicable subscription.
In the custom role form, for the Baseline permissions, choose Start from scratch.
In the JSON tab of the custom role creation form, paste the text from the edited file you downloaded from the connector wizard.
Save the custom role.
Attach the custom role to the application you configured in the prerequisites for this procedure.

This template has the IAM permissions required for the capabilities that you selected in the previous step.

If you enabled the Kubernetes managed services option, you must separately configure permissions for AKS. For more information, see Managed Kubernetes Services Running on Azure (AKS).

Click Next.

The next page displays a Resource Tree where the user can expands to view various region and inside the region you can select or unselect the resource check boxes to obtain the list of VNets and AKS clusters from Azure.

From the list of VNets and AKS clusters for each VNet, choose the VNets and AKS clusters for which you want to enable your selected capabilities.

Generally, you should enable flow ingestion as soon as possible, so that Secure Workload can begin to collect enough data to suggest accurate policies.

Note that since AKS only supports Gather Labels capability, no explicit capability selection has been provided. Selecting an AKS cluster will implicitly enable the supported capability. Upload the client certificate and key for each cluster for which you enable this functionality.

Generally, you should not choose Enable Segmentation during initial configuration. Later, when you are ready to enforce segmentation policy for specific VNets, you can edit the connector and enable segmentation for those VNets. For more information, see Best Practices When Enforcing Segmentation Policy for Azure Inventory.

Once your selections are complete, click Create and wait a few minutes for the validation check to complete.

The View Groups page shows all VNets that you enabled for any functionality on the previous page, grouped by region. Each region, and each VNet in each region, is a new scope.

(Optional) Choose the parent scope under which to add the new set of scopes. If you have not yet defined any scopes, your only option is the default scope.

(Optional) To accept all settings configured in the wizard, including the hierarchical scope tree, click Save.

To accept all settings, except the hierarchical scope tree, click Skip this step.

You can manually create or edit the scope tree later, under Organize > Scopes and Inventory.

What to do next

If you have enabled gathering labels, ingesting flows data, and or segmentation:

If you enabled flow ingestion, it may take up to 25 minutes for flows to begin appearing on the Investigate > Trafficpage.
(Optional) For richer flow data and other benefits including visibility into host vulnerabilities (CVEs), install the appropriate agent for your operating system on your VNet-based workloads. For requirements and details, see the agent installation chapter.
After you have successfully configured the Azure connector to gather labels and ingest flows, follow the standard process for building segmentation policies. For example: Allow Secure Workload to gather sufficient flow data to generate reliable policies; define or modify scopes (typically one for each VNet); create a workspace for each scope; automatically discover policies based on your flow data, and/or manually create policies; analyze and refine your policies; ensure that your policies meet the guidelines and best practices below; and then, when you are ready, approve and enforce those policies in the workspace. When you are ready to enforce segmentation policy for a particular VNet, return to the connector configuration to enable segmentation for the VNet. For details, see Best Practices When Enforcing Segmentation Policy for Azure Inventory.

If you have enabled the Kubernetes managed services (AKS) option:

Install Kubernetes agents on your container-based workloads. For details, see Install Kubernetes or OpenShift Agents for Deep Visibility and Enforcement.

Event Log:

The event logs can be used to know significant events happening per connector from different capabilities. We can filter them using various attributes like Component, Namespace, Messages and Timestamp.

Previous topic Azure Connector Configuration Overview Next topic Create a New Azure Connector