Cisco Secure Dynamic Attributes Connector Configuration Guide 2.0

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book

Results

Updated:
June 1, 2021

Chapter: About the Cisco Dynamic Attributes Connector

About the Cisco Dynamic Attributes Connector

The Cisco Secure Dynamic Attributes Connector enables you to collect data (such as networks and IP addresses) from cloud providers and send it to the Ciso Secure Firewall Management Center (management center) so it can be used in access control rules.

The following topics provide background about the dynamic attributes connector:

About the Cisco Secure Dynamic Attributes Connector

The Cisco Secure Dynamic Attributes Connector enables you to use service tags and categories from various cloud service platforms in Secure Firewall Management Center (management center) access control rules.

Supported connectors

We currently support these:

Table 1. List of supported connectors by Cisco Secure Dynamic Attributes Connector version and platform

CSDAC version/platform

AWS

GitHub

Google Cloud

Azure

Azure Service Tags

Microsoft Office 365

vCenter

Webex

Zoom

Version 1.1 (on-premises)

Yes

No

No

Yes

Yes

Yes

Yes

No

No

Version 2.0 (on-premises)

Yes

No

Yes

Yes

Yes

Yes

Yes

No

No

More information about connectors:

How It Works

Network constructs such as IP address are not reliable in virtual, cloud and container environments due to the dynamic nature of the workloads and the inevitability of IP address overlap. Customers require policy rules to be defined based on non-network constructs such as VM name or security group, so that firewall policy is persistent even when the IP address or VLAN changes.

You can collect these tags and attributes using Docker containers running on an Ubuntu, CentOS, or Red Hat Enterprise Linux virtual machine. Install the Cisco Secure Dynamic Attributes Connector on the Ubuntu host using an Ansible collection.

The following figure shows how the system functions at a high level.

"The Cisco Secure Dynamic Attributes Connector queries cloud services such as VMware vCenter and provides information such as VLANs, networks, and tags to the secure management center to use as selection criteria in access control rules. This way, you don't have to constantly update network objects when IP address information (for example) in your cloud systems change"

  • Install the dynamic attributes connector on a supported Linux virtual machine.

    For more information, see Supported Operating Systems and Third-Party Software.

  • The system supports certain public cloud providers.

    This topic discusses supported connectors (which are the connections to those providers).

  • The adapter defined by the dynamic attributes connector receives those dynamic attributes filters as dynamic objects and enables you to use them in access control rules.

    You can create the following types of adapters:

    • On-Prem Firewall Management Center for an on-premises Management Center device.

      This type of Management Center device might be managed by Cisco Defense Orchestrator (CDO) or it might be a standalone.

    • Cloud-delivered Firewall Management Center for devices managed by CDO.

Was this Document Helpful?

FeedbackFeedback

Contact Cisco