topic Palo Alto and Azure Application Gateway in VM-Series in the Public Cloud

Palo Alto and Azure Application Gateway

jeromecarrier — Fri, 28 Oct 2022 07:38:39 GMT

Hello

I'm deploying infrastructure on Azure with Palo Alto firewall. We will host web application (appli1.company.com & appli2.company.com) on a vnet dmz. My design is based on Hub/Spoke configuration and I configured an vNet Peering between my DMZ vnet and my Hub where is hosted the firewall.

I would like to be able to access from Internet to appli1.company.com or appli2.company.com. For that, I added an Azure Application Gateway. I configured the Application Gateway with an public IP and backend pools to the vm-series. I configured an listen base on TCP_80 to test to access to my application via this port for testing. Currently, this is not working, I have this error :

When I try fom a computer on Internet to access to appli1.company.com, there is no traffic on my Palo Alto. Is my approach is correct and do you have an idea where the issue come from ?

My desing:

Jerome

Re: Palo Alto and Azure Application Gateway

raji_toor — Tue, 01 Nov 2022 14:28:39 GMT

@jeromecarrier I am assuming you are using private external IP of Firewall in backend pool. Because in our case there is no UDR on the Application Gateway subnet.

You will need to setup routes on PA and the vnet/subnets correctly.

When I set it up, I had to NAT source addresses of Application Gateway as well to internal IP of firewall.

Re: Palo Alto and Azure Application Gateway

jeromecarrier — Fri, 04 Nov 2022 15:57:11 GMT

Hello

I have problem to configure a NAT rule to access our different internal webservers from outside based on URL (https://apptestdsiweb1.company.com to apptestdsiweb1.localnet server, https://apptestdsiweb2.company.com to apptestdsiweb2.localnet server). Our dns entries for our application have the public IP of ApplicationGateway.

So I try another approach : for each application, I configure a dedicated listerner with a dedicated port for the backend (10.110.129.4 8000 or 8001). When I use a listener with a standard port (80), the access is working for https://apptestdsiweb1.company.com. But when I want to create a dedicated listener with, for each listener, a port dedicated on the backend (Palo Alto firewall), I'm not able to reach https://apptestdsiweb1.company.com or https://apptestdsiweb2.company.com

Can you help me ?

Here my design

Here the NAT rules