firewall deployment in Azure Vmware solution (AVS)

[deepak12]

Hi All ,

We are exploring options to deploy PA VM series firewall in  AVS setup .

Could you please share any document which we can refer to start our deployment .

Thanks ,

[BPry]

@deepak12,

Azure's VMware solutions is just baremetal VMware. You'll want to decide if you are actually going to utilize NSX-T or not, but since you're paying for it as part of your subscription I would recommend it personally. You'll want to take a look at the following deployment guides as a starting point. 

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-a-vm-series-firewall-on-...

https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-o...

[deepak12]

@BPry ,

Thanks , i will check on this. For AVS related can see  below  , so want to check still you recommend for NSX-T as if we go with NSX 3.2.0 version need to deploy Panorama on-prem ?

=========================================================================================

When using the Panorama plugin for VMware NSX 3.2.0, Panorama must be deployed on-prem, not in any public cloud environment, to manage VM-Series firewalls on AVS. This requires a VPN connection between your on-prem Panorama and your public VNet and an ExpressRoute between your public VNet and NSX-T Manager on AVS.

=========================================================================================

[deepak12]

@BPry, 

Could you please suggest on below :

For NSX-T if we go with NSX 3.2.0 version ,  need to deploy Panorama on-prem ?

=========================================================================================

When using the Panorama plugin for VMware NSX 3.2.0, Panorama must be deployed on-prem, not in any public cloud environment, to manage VM-Series firewalls on AVS. This requires a VPN connection between your on-prem Panorama and your public VNet and an ExpressRoute between your public VNet and NSX-T Manager on AVS.

=========================================================================================

[EduardoNavarro]

Did you were able to deploy Palo VM inside AVS?   Did you used ESX or NSX-T Service insertion mode?  

I have tried NSX-T Service insertion mode on AVS we were not able.  Connection to NSX manager was ok, however when trying to deploy  the service, it was asking for the attachment point and none was available, it seems tier0 was not an option as its on active/active and even creating a tier1 it didn't allowed us to select it as an attachment point,  so not sure if I'm doing something wrong or if this is a limitation of NSX-T on AVS.  

Any suggestion or feedback is welcome. 

thanks

[eshukaushal]

Do you have routing and other configuration details for these topologies mentioned in the link provided. For eg: creating transient/management segments and isolated tier 1 gateways etc.

https://techcommunity.microsoft.com/t5/azure-migration-and/firewall-integration-in-azure-vmware-solu...

However, into the NSX-T environment of AVS I believe the "service deployment" button is disabled or enabled so we cannot register the VM-Series firewall as a service.

Is it possible download and install the Palo Alto appliance as an .OVA file into the nsx-t environment ?

[templeton_al]

Any updates on this architecture with the OVA file in the AVS NSX-T environment?