VM-Series
Deployment
Guide
49
The VM-Series NSX Edition Firewall
VM-Series NSX Edition Firewall Overview
On Panorama, you can then create three Dynamic Address Groups to match objects that are tagged as
Database, Application and WebFrontEnd. Then, in security policy you can use the Dynamic Address Groups
as source or destination objects, define the applications that are permitted to traverse these servers, and push
the rules to the VM-Series firewalls.
Each time a guest is added or modified in the ESXi cluster or a security group is updated or created, the NSX
Manager uses the PAN-OS REST-based XML API to update Panorama with the IP address, and the security
group to which the guest belongs.
When Panorama receives the API notification, it verifies/updates the IP address of each guest and the security
group to which that guest belongs. Then, Panorama pushes these real-time updates to all the firewalls that are
included in the device group and notifies device groups in the service manager configuration on Panorama.
To ensure that the name of each security group is unique, the vCenter server assigns a
Managed Object Reference (MOB) ID to the name you define for the security group. The
syntax used to display the name of a security group on Panorama is
specified_name-securitygroup-number
; for example,
WebFrontEnd-securitygroup-47
.
