How to retain Public IP Address Assigned to a host on VMSeries Firewall on Azure

ORufai — Tue, 27 Dec 2022 10:18:14 GMT

Hello Community,

I want to deploy Palo Alto VM Series firewall Infront of some workloads already existing on my Azure tenant and still ensure that services calling the workloads use the existing public IP Addresses assigned to these workloads when the traffic passes through the VM Series firewall.

It is easier to deploy when workloads haven't been provisioned and are not accessible via the internet using their public IP Addresses but instances where you already have a workload with an assigned public IP Address which have to disassociate from the host and assign to the VM Series firewall is a bit of a challenge.

I havent seen how I can reserve this public IP Address on workloads then assign them as public IP address on the VM series firewall, maybe on the secondary interface so that I can configure a destination NAT on the firewall.

Looking for support from the community on this.

Thank You!

Re: How to retain Public IP Address Assigned to a host on VMSeries Firewall on Azure

Julienmongin — Wed, 04 Jan 2023 15:51:03 GMT

Hi,

You should have a look on the Azure Gateway Loadbalancer option

https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-the-vm-series-firewall-on-azure/deploy-the-vm-series-firewall-with-the-azure-gwlb

So you can keep the PIP on your exsting workload, you just need to Chain the PIP to the Gateway Loadbalancer attach to your Palo Alto, Like that the Intenet traffic will go via the FW

BR//Julie

topic Re: How to retain Public IP Address Assigned to a host on VMSeries Firewall on Azure in VM-Series in the Public Cloud

How to retain Public IP Address Assigned to a host on VMSeries Firewall on Azure

Re: How to retain Public IP Address Assigned to a host on VMSeries Firewall on Azure