topic Re: PA-VM in Azure - multiple Zones? (e.g. DMZ,Trust,Unstrust,etc) in VM-Series in the Public Cloud

PA-VM in Azure - multiple Zones? (e.g. DMZ,Trust,Unstrust,etc)

TonyDeHart — Tue, 31 Oct 2023 13:25:11 GMT

(sorry for the repost but the other forums/topic areas just don't ever seem to get a response when I post there and are much less active)

In the deployment guides and conversations I've had it seems that the PA-VM firewall in Azure is typically designed around only four interfaces: trust, untrust, mgmt, HA. Two zones only: Trust/Untrust. Subnets used to isolate traffic.

In my on-prem setups I've always had zones associated with either the interfaces or VLANs on those interfaces to help differentiate application of policies. I feel like it makes in plainly obvious in the policy where that traffic is coming from and going but prevents inadvertently allowing something you don't want allowed.

I'd prefer to keep the ability to use the zones vs subnets and subnet groups. Is there a way to create another Zone for a subnet within Azure? I don't believe VLAN's are available in Azure so that options seems out. I'd like to setup a DMZ zone since that just seems more elegant to use and easier to read when looking at Policies.

Palo support had suggested adding another interface but that doesn't seem like an option nor does it seem advisable based on what is considered a standard setup in Azure. The VM that the PA-VM runs on right now too is limited to four interfaces.

Re: PA-VM in Azure - multiple Zones? (e.g. DMZ,Trust,Unstrust,etc)

LAYER_8 — Fri, 01 Dec 2023 02:50:21 GMT

One of the ways I've gotten around this before was using the 'regions' feature in the objects tab. You can input a subnet as a location and 'tag' it that way so it shows up in the logs as such.

Re: PA-VM in Azure - multiple Zones? (e.g. DMZ,Trust,Unstrust,etc)

TonyDeHart — Fri, 01 Dec 2023 12:43:40 GMT

Interesting. I'll have to explore that idea. Thank you for the suggestion!

Re: PA-VM in Azure - multiple Zones? (e.g. DMZ,Trust,Unstrust,etc)

LAYER_8 — Fri, 01 Dec 2023 18:59:32 GMT

There isn't much benefit from doing it this way compared to creating address groups and using them in policy besides the ACC tab. Regions show up in widgets so you can see named subnets, use them in policy, and are exposable via API for dynamic modification.