FW connectivity with Panorama in AWS

[AndresAlfaro]

Cordial greetings

Palo Alto Team

This is to clarify a doubt regarding the integration of devices to Panorama. Currently the appliance is deployed in an AWS region, however, we have FW VM-Series deployed in GCP, Azure and AWS cloud. The AWS FWs are already integrated, however, I would like to know how I could integrate the appliances that are in the other GCP and Azure clouds to the Panorama that is on AWS. I understand that Panorama allows to configure a public IP, however and considering that it is in AWS what public ip would I have to configure? the same that AWS assigns to the interface? Is there any link or instructive that provides me with this information?

[laurence64]

HI 

When you configure the public IP of Panorama you would enter the local IP (AWS Internal) and the public assigned IP for that interface, then you would configure the firewalls to connect to that public IP.

Connectivity should be no issue at as it will be done over the internet, I guess all you would have to decide then is what to do with your security groups with regard to leaving them open or restricting them to the firewalls that will be connecting.

Hope this helps.

[AndresAlfaro]

Cordial greetings

Laurance.

A thousand thanks for the reply, if I understood you correctly, AWS offers me the option to attach 2 ips to the panorama interface, in this case the internal addressing IP and the public addressing IP. Already inside the Panorama, I must configure both the internal and the Public in the public Ip space, right?

Now, if the GCP FW has an output to the Internet, in the Panorama configuration option I must enter the public ip address of the Panorama? do I have to do a Nateo or this traffic goes out directly?

Thank you very much for the collaboration, I am going to try and I will be commenting.

[laurence64]

Hi

Yes, you can attach an elastic IP to the interface of your Panorama, at this point you will have the interface IP configured in Panorama as the Internal interface and the elastic IP configured as the public interface in the Panorama management settings.