Deploy NGFW in eu-west-2

[SZanpure]

Hi,

I am trying to deploy NGFW in eu-west-2, but it's failing on the Cloudformation template. Steps below:

1. Subscribe to NGFW via AWS Marketplace (which is global and not per region).

2. Click on the verification email and set up new password. Then login.

3. Go to Add account, and then launch cloudformation termplate. 

At this point, the template opens up in us-east-1 region by default, and changing the region to eu-west-2 in AWS console does not change the cloudformation template parameter values (Trusted Account ID, ExternalID and SNS). Deploying the template with these values fails

One thing I want to try is change the region in NGFW Web UI first (In the Rulestack/NGFW section), and then click Add Account to see if it makes a difference. Again, I could not find anything in the docs about this, but I could be looking in the wrong place.

This would be mean I have to un-subscribe, wait for an hour and re-subscribe. While I wait, any suggestions about what I might be missing please?

Thanks,

Shreyas

[SZanpure]

This is my very first reply to my first private message. Therefore I guess the max limit is zero?

[mgordon]

Hello @SZanpure LIVEcommunity admin here! I apologize for this issue. We are working with our community vendor right now for this. I will update here as quickly as possible

[SZanpure]

I will post more details here since PM is not working for now.

I have subscribed to NGFW using Marketplace and tried to set the region to eu-west-2 in browser url 

After setting my new password, I logged in and set the NGFW region to London in web UI

I then went to Add Account, and clicked Launch Cloudformation template. At this point, it opened a browser tab pointing to us-east-1, and the SNS Topic resource was pointing to us-east-1 as well. If I run the stack like this, it error as per the original post.

I attempted changing the region in AWS console to eu-west-2 at this point, however that did not update CFT parameter values.

Hope this provides a bit more info.

[asrinivasan]

Can you try running the template in us-east-1, it doesnt need to run in eu-west-2

[lr · Accepted solution]

Hello Shreyas,
 

Could you please run the cloud formation template in us-east-1 by doing which gets onboarded to us-east-1 and then try changing the region and creating resources in eu-west-2 region

Regards,
Likith R
Product Specialist
Palo Alto Networks
live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW
 

[SZanpure]

NBS Internal


NBS Internal

Hi Likith,

If I run the template in us-east-1, then the cross-account role will be deployed in us-east-1, whereas the rulestacks and NGFW will be deployed in eu-west-2. Will this work?
Also, I don’t think we have any infra in us-east-1 for our dev and prod accounts, apart from some Cloudfront bits.

Are there any plans to launch Palo trusted accounts in eh-west-2? Meanwhile I will try running the template in us-east-1 and create firewall in eu-west-2

[lr]

Hello Shreyas,

Yes it will work If you run the template in us-east-1 and deploy rulestacks and NGFW in eu-west-2 as IAM is global

Regards,
Likith R
Product Specialist
Palo Alto Networks
live.paloaltonetworks.com/t5/cloud-ngfw-help-center/ct-p/Cloud_NGFW

[SZanpure]

This works now as per the solution discussion above thanks.