Quick Question about Azure AppGateway VM Series Deployment

rajindersingh — Sat, 22 Sep 2018 15:12:21 GMT

We have an existing environment where Palo Alto VM Series was deployed by somebody who is no longer at the company.

I was told that it has never worked. Primary purpose of the firewall is to secure inbound web traffic.

Current configuration is:

AppGateway->LB->2 VM Series->ILB->Web Servers

VM Series VM's had 3 Network interfaces.

I can log into the management UI and see no configuration was done.

I noticed that AppGateway did not have a HTTPS listener so it only accepts HTTP traffic.

None of the subnets have any UDR's defined.

Our requirements can be met by the template published here:

https://github.com/PaloAltoNetworks/azure-applicationgateway

This template eliminates Public LB in front of VM Series so traffic flows like this:

internet->AppGateway->2 VM Series->ILB->Web Servers

What is the benefit of having public LB between AppGateway and the Firewall VM's

Even this template shows Application Gateway without HTTPS listener.

I am wondering why this is the case?

Thanks

Re: Quick Question about Azure AppGateway VM Series Deployment

jperry1 — Sat, 22 Sep 2018 16:52:29 GMT

If you are using an App gateway you don't need a public LB because the APP gateway is public facing. Just note that the App Gateway is for HTTP(S) traffic only. That being said it provides additional benefits such as WAF, SSL termination and decryption etc.

topic Re: Quick Question about Azure AppGateway VM Series Deployment in VM-Series in the Public Cloud

Quick Question about Azure AppGateway VM Series Deployment

Re: Quick Question about Azure AppGateway VM Series Deployment