Best guides for new Firewall Deployment

[Nhussain]

I am deploying a new firewall for a PoC however I am having some issues. I have deployed and activated the server on Azure, I am using VM-Series. However despite on the Azure side there being no restrictions, there server is not able to connect to the internet for updates. 
I must be missing something basic in understand/setup so any pointers would be great.

[reaper]

is the server in the same vnet and subnet as the internal interface and how have you set the default gateway of the server? 

most commonly the internal interface of the palo will be dhcp client and the server behind has a default gateway to x.x.x.4

Set the palo external interface also to dhcp client and enable dynamic port/ip NAT and only assign the interface (don't set an IP)

see if that helps

[Nhussain]

The server is on the same virtual network as the internal interface but not the same subnet. The Internal interface has been configured with DHCP, however I have not done anything specific to define the gateway, where would this be done? 

[BPry]

@Nhussain,

What are you seeing in the traffic logs? Do you see the traffic coming in from the server in question? Do you see it properly your NAT statement? 

[Nhussain]

So Logs show traffic is allowed and the NAT is also being applied.

however after all that nothing worked, so I deployed another Palo ALto instance but this time it had a public IP on the management interface. it worked,

Added a public IP on the server I was working on and internet connectivity worked. My question is why? Azure does nat'ing for you, it should not need a public IP to get out to the internet? Does anyone know why? 

[OtakarKlier]

Hello,

Sounds like a routing/policy issues with the original PAN you deployed. I wouldnt recommend having the management interface internet facing unless you lock it down to source IP's. However you can change the services, so they use a different interface to reaching out and grabbing updates, etc.

If you're adventurous

https://live.paloaltonetworks.com/t5/general-articles/secure-day-one-configuration-not-for-the-faint...

it blocks almost everything so be careful.

Regards,