topic Re: Extend VPN to Azure Cloud in General Topics

Extend VPN to Azure Cloud

jmunalem — Thu, 06 Sep 2018 19:37:15 GMT

Is it possible to extend Palo Alto VPN onto Azure Cloud? That way we can have users connect directly onto any Azure Cloud Region

Re: Extend VPN to Azure Cloud

BPry — Thu, 06 Sep 2018 20:13:23 GMT

@jmunalem,

Can you describe what you want exactly just a bit more. I've answered below if any of these work, but not 100% what you are asking for.

I would think that what you are looking for is that you want to extend access so that when users connect to say 'HQ_Portal' they then have access to Azure resources? To accomplish this you need a route to Azure, which would either be done through an ExpressRoute connection (or whatever they call it) or through establishing an IPSec tunnel between your Azure Gateway and your Firewall. You would then have to allow access to that resource just like anything else through GlobalProtect. Then whenever connected to 'HQ_Portal' you would also give users the ability to access any Azure resource.

So essentially within your virtual network gateway you go to 'Connections' and create a Site-to-site connnection back to your firewall. Then everything else is handled exactly like any other IPSec tunnel connection.

Re: Extend VPN to Azure Cloud

jmunalem — Thu, 06 Sep 2018 20:23:13 GMT

Hi Bpry,

Thank you for your response.

The situation that I have is basically that a client has Palo Alto VPN on a different location (Let's say Canada).

I want to provide them with MS Azure Cloud Azure File Storage directly on the cloud.

The problem is that when their mobile users (Let's say China, UK, and Africa). To access the files on the cloud they have to connect to the VPN first (in Canada) and then access the cloud files that is located on their region/country. So that is very slow.

Does Palo Alto have a way to extend that VPN capabilities onto Azure so that users can just login to VPN anywhere and access the cloud files along with it?

Re: Extend VPN to Azure Cloud

BPry — Thu, 06 Sep 2018 20:33:21 GMT

@jmunalem,

Sure!

Take a look at the GlobalProtect Cloud Service.

Info On Service: HERE

Service Documentation: HERE