Integrations
Once a Connector is paired and online (see Installation or Deploying the OVA appliance), point one or more on-prem integrations at it from Integrations in Connect. A single Connector can serve multiple accounts and integrations at once.
This page covers what's specific to the integrations that run through the Connector. For the full list, and the setup rules every integration shares, see Integrations.
Integration types
Each on-prem integration does one of two kinds of work:
- Group export: the Connector keeps a Group's IP addresses and CIDRs in sync with an address object on your on-prem enforcement point, so you can write policy against a Connect-managed object instead of maintaining lists by hand.
- Inventory discovery: the Connector pulls assets from an on-prem platform into Connect's Inventory, so on-prem resources show up alongside your cloud inventory.
| Integration | Type | What it does |
|---|---|---|
| Palo Alto Panorama | Group export | Pushes a Group to your firewalls as a Dynamic Address Group (DAG), kept in sync automatically. |
| VMware NSX | Group export | Pushes a Group to an NSX Group, kept in sync automatically. |
| Cisco Firewall Management Center | Group export | Pushes a Group to an FMC dynamic object, kept in sync automatically; your access control rules pick up the changes without a deployment. |
| Fortinet FortiManager | Group export | Pushes a Group to a FortiManager address group, kept in sync automatically, and can install the policy packages that reference it. |
| Infoblox | Inventory discovery | Reads the networks and used IPs from your Grid Manager and brings them into Connect's inventory. |
A Group is a named list of IP addresses and CIDRs, built from criteria over Inventory rather than maintained by hand. Groups covers building one, the Export To field that turns a Group into an export job for the Connector, the Update and Project fields that are fixed once a Group exists, and the 10,000-item cap on membership.
What the Connector adds
The rules in Common to every integration apply here too. On top of those:
- Choose the Connector on the Provision page. Panorama, NSX, FMC and FortiManager require one. For Infoblox the field is optional: leave it unset and discovery connects directly from the cloud instead, which requires your Grid Manager to be reachable from the internet.
- A new account's first job starts within about a minute. The Connector polls for work every 30 seconds, and fetches its account list again as soon as a job names an account it doesn't have yet.
- Optional settings sit under Advanced. The Provision page lists the required fields first, then a divider marked Advanced with the rest: Allow Self-Signed Certificate for all five, Manager Type for NSX, Domain for FMC, ADOM and Install policy packages after a sync for FortiManager, and WAPI Version for Infoblox.
- Self-signed certificates are allowed by default. Most on-prem systems present an internally-issued certificate, so the toggle starts on. It affects only the Connector's connection to that system; connections from the Connector back to Connect always require full certificate validation.
- The Test button runs on the Connector. Testing an on-prem account queues a Test Connection job, so the button reads Waiting for connector until the Connector picks it up. A verdict normally arrives within two minutes; past that, check that the Connector shows green under Settings > Connectors.
- Group export deletes are non-destructive. Deleting a Group leaves the corresponding object on the enforcement point in place, so live policy keeps a valid reference. Remove the object manually on the provider side once you're done with it.
Watching jobs
Everything the Connector does on your behalf is a job, listed under Settings > Connectors > Jobs in Connect.
| Column | What it tells you |
|---|---|
| Type | Sync Group for a Group export, Discover Inventory for an inventory discovery, or Test Connection for a test you started from a Provision page. |
| Status | Pending (queued) → In Progress → Complete or Error. A job that hit a temporary problem stays In Progress and is retried. On a failed job, hover the status to read the error. |
| Connector | Which Connector ran the job, with a green or red dot for whether it's connected right now. |
| Account | The account the job targeted. |
| Input | Hover the info icon for the job's details. A Sync Group job also names the Group. |
| Summary | While a job runs, how far it has got; see Job progress. Once it finishes, what it did: the Groups synced, IPs registered, or networks discovered. |
| Dates | The most recent timestamp, with created, started, updated, and completed on hover. |
Sort on Type, Status, Connector, Account, or Dates by clicking the column header. Filter the list by Connector, Status, or Type, or search it by summary text, error text, job type, job ID, input, or Connector name. The list pages ten jobs at a time.
A job whose Summary reports zero work usually means a prerequisite is missing. Read it, then re-check that integration's Before you start list.
Job progress
While any job on the page is In Progress, the list refreshes itself every 30 seconds, so a long-running job's Summary updates in place while you watch it.
Infoblox discovery reports its progress in up to three phases:
| Phase | What the Summary shows |
|---|---|
| Listing the grid's networks | A running count, 48,000 networks listed, which climbs as pages come back |
| Reading the grid's records, when the API user can read them | A running count, 850,000 record objects swept, with no total |
| Uploading them to Inventory | A count against the total, 12,400 of 60,000 networks uploaded, with a progress bar |
Sync Group and Test Connection jobs finish quickly enough to report their result directly, so their Summary fills in when they finish.
For issues with a specific integration, see its page above, or the general Troubleshooting page.