Using the ELB Scaling v2.0 cfn templates

jerrygb — Thu, 20 Dec 2018 03:04:04 GMT

Hi,

I am trying to use

https://github.com/PaloAltoNetworks/aws-elb-autoscaling/tree/master/Version-2.0 for setting up a PoC.

I went through the docs and was able to get a pair of PANFW running with some changes to the IAM roles required as per the cloud formation templates.

The ALB (ELBv2) is exposed on port 80 on the frontend. But ALB seems to probe the FW instance on port 81 on the backend.

So for example, public-elb-<id>.us-west-1.elb.amazonaws.com:80 are the load balancer front end.

firewall_instance_az1:81 and firewall_instance_az1:81 are the load balancer back ends.

AMI ID: ami-a95b4fc9 (BYOL)

Based on this deployment I had a few questions,

1. After the deployment, the ALB (ELBv2) Target Group Health Checks fail and I noticed that there is no process opening port 81 on the FW, even after the management interface switch - https://docs.paloaltonetworks.com/vm-series/7-1/vm-series-deployment/set-up-the-vm-series-firewall-in-aws/management-interface-mapping-for-use-with-amazon-elb

2. How do we debug this web ui or web portal for Firewall?

3. Is that the expected behavior to expose on port 80 on frontend? Is this to simulate a simple scenario with the cfn templates and we need to manually setup certificates on ALB for communication over TLS?

4. How do we configure multiple authcodes in the bootstrap package, assuming 2 FWs, 1 per AZ?

Thanks

topic Using the ELB Scaling v2.0 cfn templates in VM-Series in the Public Cloud

Using the ELB Scaling v2.0 cfn templates