topic Re: Queries regarding the Azure Bootstrap Package in VM-Series in the Public Cloud

Queries regarding the Azure Bootstrap Package

A_Adamski — Thu, 08 Dec 2022 16:52:00 GMT

Dear and valuable Live Community Members,

One of our customers came to us with some questions about Azure Bootstrap Package, but I couldn't find the requested information for that.

We've checked the article where the steps to create new firewalls in Azure are explained (https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/bootstrap-the-vm-series-firewall/bootstrap-the-vm-series-firewall-in-azure), but there are still some open points we need to address. And we would like to check if maybe someone here has some more experience on this and could help to answer the below questions:

Is the Bootstrap packet only needed for the first boot or as well for later boots (e.g., during software updates?)
In cases of virtual machine scale sets, does every new machine need to boot from the bootstrap directory?
We are using subfolders (possible since version 10.*.) for different device groups. How does the link between a booting VM and the subdirectory work, how can we configure specific machines to use a specific subdirectory?

*And in case it's needed the PAN-OS in use is 10.0.4

We will appreciate your help and guidance with the above queries. And please let me know if that'S something we should be asking the TAC.

Thank you in advance!

Cheers!

Re: Queries regarding the Azure Bootstrap Package

Julienmongin — Wed, 04 Jan 2023 16:10:17 GMT

Is the Bootstrap packet only needed for the first boot or as well for later boots (e.g., during software updates?)

It's only need to for the first boot of the FW (Creation). For software Update you have 2 options :

- do the update from panorama (I would not recommends that)

- Change the Marketplace image version of the Scale set and reimage your vm, so your firewall will bootstrap again and you will have a fresh instance (you can also add new instance and delete the old one)

In cases of virtual machine scale sets, does every new machine need to boot from the bootstrap directory?

Yes Instances are independent, so any new instance will bootstrap from the storage account

We are using subfolders (possible since version 10.*.) for different device groups. How does the link between a booting VM and the subdirectory work, how can we configure specific machines to use a specific subdirectory?

Subdirectory is an input n the custom data (Azure), personally I'm using different storage account

Re: Queries regarding the Azure Bootstrap Package

A_Adamski — Thu, 05 Jan 2023 11:42:03 GMT

We've involved the PA Team to advise on this and below are the answer supplied by TAC to the queries:

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
1. Is the Bootstrap packet only needed for the first boot or as well for later boots (e.g., during software updates?)
>> If you are going to reboot the device later, you can do it unusually with a software upgrade or content. Hence bootstrap package is not required for later boot.

2. In cases of virtual machine scale sets, does every new machine need to boot from the bootstrap directory?
>> Yes, All the firewalls in the scaling will boot from the bootstrap directory.

3. The customer is using subfolders (possible since version 10.*.) for different device groups.
How does the link between a booting VM and the subdirectory work,?
And how can we configure specific machines to use a specific subdirectory?
>> In the user data you can provide a subdirectory path to boot the device.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

As per the documentation: Bootstrap the VM-Series Firewall on AWS:
https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/bootstrap-the-vm-series-firewall/bootstrap-the-vm-series-firewall-in-aws