Configure any Cortex XDR Broker virtual machine (VM) as necessary.
To set up the Broker virtual machine (VM), you need to deploy an image created by Palo Alto Networks on your network or supported cloud infrastructure and activate the available applications. You can set up several Broker VMs for the same tenant to support larger environments. Ensure each environment matches the necessary requirements.
Before you set up the Broker VM, verify you meet the following requirements.
For standard installation, use a minimum of a 4-core processor, 8 GB RAM, and 512 GB disk. If you only intend to use the Broker VM for agent proxy, you can use a 2-core processor. If you intend to use the Broker VM for agent installer and content caching, you must use an 8-core processor.
Note
The Broker VM comes with a 512 GB disk. Therefore, deploy the Broker VM with thin provisioning, meaning the hard disk can grow up to 512 GB but will do so only if needed.
Bandwidth is higher than 10 mbit/s.
When the Broker VM is collecting data, the optimal outgoing bandwidth into the Cortex XDR server should be about 25% of the incoming data traffic into the Broker VM applets.
Important
There can be cases in which the Broker VM requires up to 50% of the incoming bandwidth as outgoing. Such cases can be, network instability between the Broker VM and Cortex XDR, or data that is being collected, but not well compressed.
Ensure that your virtual machine (VM) is compatible with one of the following options and install the applicable broker image according to the installation steps provided:
Infrastructure | Image Type | Additional Requirements |
|---|---|---|
Amazon Web Services (AWS) | VMDK | |
Google Cloud Platform | VMDK | |
Microsoft Azure | VHD (Azure) | |
Microsoft Hyper-V 2012 | VHD | Hyper-V 2012 or later |
Alibaba Cloud | QCOW2 | |
Nutanix Hypervisor | QCOW2 | Nutanix AHV 2021 |
KVM | QCOW2 | |
VMware ESXi | OVA | VMware ESXi 6.5 or later |
Enable communication between the Broker Service, and other Palo Alto Networks services and applications.
FQDN, Protocol, and Port | Description |
|---|---|
(Default)
UDP port 123 | Broker's NTP server used for broker registration and communication encryption. The Broker VM provides default servers you can use, or you can define an NTP server of your choice. |
HTTPS over TCP port 443 | Broker Service server depending on the region of your deployment, such as |
HTTPS over TCP port 443 | Information needed to communicate with your Cortex XDR tenant. Used by tenants deployed in all regions. |
HTTPS over TCP port 443 | Broker Service server for Federal (US Government) deployment. |
HTTPS over TCP port 443 | Used by tenants with Federal (US Government) deployment |
Enable Access to Cortex XDR from the Broker VM to allow communication between agents and collectors and Cortex XDR.
Note
If you use SSL decryption in your firewalls, you need to add a trusted self-signed certificate authority on the Broker VM to prevent any difficulties with SSL decryption. If adding a CA certificate to the broker is not possible, ensure that you’ve added the Broker Service FQDNs to the SSL Decryption Exclusion list on your firewalls.
Perform the following procedures in the order listed below.
Select Settings → Configurations → Data Broker → Broker VMs.
Click Add Broker → Generate Token, and copy to your clipboard. The token is valid for 24 hours. A new token is generated each time you select Generate Token.
Depending on the Broker VM version, navigate to either of the following URLs:
From Broker VM version 19.x.x and later:
https://<broker_vm_ip_address>.:4443From Broker VM version 18.x.x and earlier:
https://<broker_vm_ip_address>/
Note
When DHCP is not enabled in your network and there isn't an IP address for your Broker VM, configure the Broker VM with a static IP using the serial console menu.
Log in with the default password !nitialPassw0rd, and then define your own unique password. The password must contain a minimum of eight characters, contain letters and numbers, and at least one capital letter and one special character.
Perform the following procedures in the order listed below.
Define the network interfaces settings.
Review the pre-configured Name, IP address, and MAC Address, and select the Address Allocation: DHCP (default) or Static. If you choose Static, define the static IP address, Netmask, Default Gateway, and DNS Server settings, and then save your configurations.
Important
When configuring more than one network interface, ensure that only one Default Gateway is defined. The rest must be set to
0.0.0.0, which configures them as undefined.You can also specify which of the network interfaces is designated as the Admin and can be used to access the Broker VM web interface. Only one interface can be assigned for this purpose from all of the available network interface on the Broker VM, and the rest should be set to Disable.
(Optional) Set the internal network settings (Requires Broker VM 14.0.42 and later).
Specify a network subnet to avoid the Broker VM dockers colliding with your internal network. By default, the Network Subnet is set to
172.17.0.1/16.Important
Internal IP must be:
Formatted as
prefix/mask, for example192.0.2.1/24.Must be within
/8to/24range.Cannot be configured to end with a zero.
For Broker VM version 9.0 and lower, Cortex XDR accepts only
172.17.0.0/16.(Optional) Configure a proxy server address and other related details to route Broker VM communication.
Select the proxy Type as HTTP, SOCKS4, or SOCKS5.
Note
You can configure another Broker VM as a proxy server for this Broker VM by selecting the HTTP type. When selecting HTTP to route Broker VM communication, you need to add the IP Address and Port number (set when activating the Agent Proxy) for another Broker VM registered in your tenant. This designates the other Broker VM as a proxy for this Broker VM.
Specify the proxy Address (IP or FQDN), Port, and an optional User and Password. Select the pencil icon to specify the password. Avoid using special characters in the proxy username and password.
Save your configurations.
(Optional) Configure your NTP servers (Requires Broker VM 8.0 and later).
Specify the required server addresses using the FQDN or IP address of the server.
(Optional) Allow SSH connections to the Broker VM (Requires Broker VM 8.0 and later).
Enable or disable SSH connections to the Broker VM. SSH access is authenticated using a public key, provided by the user. Using a public key grants remote access to colleagues and Cortex XDR support who need the private key. You must have Instance Administrator role permissions to configure SSH access.
To enable connection, generate an RSA Key Pair, and enter the public key in the SSH Public Key section. Once one SSH public key is added, you can Add Another. When you are finished, Save your configuration.
When using PuTTYgen to create your public and private key pairs, you need to copy the public key generated in the Public key for pasting into OpenSSH authorized_keys file box, and paste it in the Broker VM SSH Public Key section as explained above. This public key is only available when the PuTTYgen console is open after the public key is generated. If you close the PuTTYgen console before pasting the public key, you will need to generate a new public key.
When you SSH the Broker VM using PuTTY or a command prompt, you need to use the
adminusername. For example:ssh -i [/path/to/private.key] admin@[broker_vm_address]
Important
We strongly recommend disabling SSH connectivity when it's not being used. Therefore, activate SSH connectivity when it's needed and disable it right afterwards.
(Optional) Update the SSL Server certificates for the Broker VM (Requires Broker VM 10.1.9 and later).
Upload your signed server certificate and key to establish a validated secure SSL connection between your endpoints and the Broker VM. When you configure the server certificate and the key files in the Broker VM UI, Cortex XDR automatically updates them in the tenant UI. Cortex XDR validates that the certificate and key match, but does not validate the Certificate Authority (CA).
Note
The Palo Alto Networks Broker supports only strong cipher SHA256-based certificates. MD5/SHA1-based certificates are not supported.
Update the Trusted CA Certificate for the Broker VM.
Upload your signed Certificate Authority (CA) certificate or Certificate Authority chain file in a PEM format with the associated key, and click Save. If you use SSL decryption in your firewalls, you need to add a trusted self-signed CA certificate on the Broker VM to prevent any difficulties with SSL decryption. For example, when configuring Palo Alto Networks NGFW to decrypt SSL using a self-signed certificate, you need to ensure the Broker VM can validate a self-signed CA by uploading the
cert_ssl-decrypt.crtfile on the Broker VM.Note
If adding a CA certificate to the Broker VM is not possible, ensure that you’ve added the Broker Service FQDNs to the SSL Decryption Exclusion list on your firewalls. See Enable Access to Cortex XDR.
(Optional) Collect and Generate New Logs (Requires Broker VM 8.0 and later). Your Cortex XDR logs will download automatically after approximately 30 seconds.
Register and enter your unique Token, created in the Broker VMs page. This can take up to 30 seconds.
After a successful registration, Cortex XDR displays a notification.
You are directed to Settings → Configurations → Data Broker → Broker VMs. The Broker VMs page displays your Broker VM details and allows you to edit the defined configurations.