topic Re: Autoscale (manually created VM-SERIES) on AWS in VM-Series in the Public Cloud

Autoscale (manually created VM-SERIES) on AWS

Cdchamberlin — Wed, 31 Jul 2019 15:56:30 GMT

two firewalls behind an NLB.

what approach would you take to spin up additional firewalls if a certain threshold is hit (what threshold would you trigger on)?

i've looked at the templates provided by palo alto but this would be adding additional firewalls in already established VPCs.

also use panorama

Re: Autoscale (manually created VM-SERIES) on AWS

jperry1 — Wed, 31 Jul 2019 23:54:30 GMT

That would vary based on your environment and the type of traffic you inspect. You may want to look at a sample size of your data to find the value better suited for your app mix. For example, if you have high session count traffic then you may want to trigger based on session utilization table. If you have traffic that depleted dataplane cpu then you may want to look at the processor utilization. It all depends on the type of traffic you have. Our Auto Scale templates support this and you can set your ASG to have 2 FW by default. But if manually scale is what you want you will have to manually monitor this or write a script to check either metric.

Re: Autoscale (manually created VM-SERIES) on AWS

jperry1 — Thu, 01 Aug 2019 18:50:20 GMT

Also, for AWS auto scale 2.1, it supports deployment into an existing application environment.

https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-on-aws/auto-scale-vm-series-firewalls-with-the-amazon-elb/vm-series-auto-scale-template-for-aws-version-v21.html#ide07a7726-45c0-414e-98c5-33c5034f5d64