Azure Palo Alto VM Setup - QA/Dev/Prod/Stg

BoonKeatGan — Fri, 25 Feb 2022 00:59:09 GMT

Hi,

I has successfully deployed the VM-200 series in our Azure subscription. Trying to figure out how to do the segregation of environments (QA/Dev/Prod/Stg).

Currently setup as Hub-and-spoke, the trust interface is connected to Core Subscription which will be use to setup, AD, Proxy, GW subnet and so on. The un-trust interface is associate with GW subnet that we already establish the s2s VPN tunnel.

What I cannot figure out is what is the best practice to setup the different environment using Palo Alto?

If we create additional subscription (or VNET), when doing VNET peering, it will consider as trust interface and inter-zone are allow by defaults.

Do we create multiple interface for each PROD/QA/DEV/STG environment? not too say we might have Special Project subscription(or VNET).

If anyone have any suggestion how we can create different environment using Palo Alto, will really appreciate.

Re: Azure Palo Alto VM Setup - QA/Dev/Prod/Stg

DanaHawkins — Tue, 01 Mar 2022 20:48:29 GMT

I would take a look at the Palo Alto Azure Reference Architecture Guide.

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/azure-architecture-guide. In short, you have to configure UDRs to get traffic over to the Palo Alto for inspection.

topic Re: Azure Palo Alto VM Setup - QA/Dev/Prod/Stg in VM-Series in the Public Cloud

Azure Palo Alto VM Setup - QA/Dev/Prod/Stg

Re: Azure Palo Alto VM Setup - QA/Dev/Prod/Stg