Networking-UDRs-in-Azure-Inserting-the-VM-Series-into-an-Azure

[sougata]

Hi Team,

I am new to Paloalto and have some queries with regards to deployment of Paloalto on VM series Firewall on Azure.

https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-the-vm-series...

Upon search we found

> The VM-Series firewall in Azure does not support native VM Monitoring capabilities for virtual machines that are hosted in Azure.

> VM-Series high availability configuration is not supported to avoid downtime during plannned/unplanned maintainance.

The way of solution is to have Azure application gateway in front of the VM series firewall

https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-the-vm-series...

Queries that i had in mind:

1. If HA cannot be configured between the VM's( that might be 2 or 3) that are deployed in the VM Series firewall, how the configurations gets replicated between the firewall running on separate VM's?

2. How is the session state maintained when a connection is initiated from App gateway?

3. We want user defined routing between subnets and next hop should pass through Paloalto firewall (internal subnet- Trusted). What is the next hop address that we put if each VM in the VM series firewall with Paloalto holds a different IP address?

Refer to the subnet example in the link below

https://www.paloaltonetworks.com/documentation/71/virtualization/virtualization/set-up-the-vm-series...

Thanks in advance

[Warby]

There are several options for high availability in Azure.  Check out our cloud integration page and expand the Azure section for some examples: https://live.paloaltonetworks.com/t5/Public-Cloud-Integration/ct-p/Cloud_Templates

Firewall configurations can by synchronized accross multiple firewalls using:

• our Azure bootstrapping feature with a common config XML
• Panorama
• Ansible
• Our API

We don't maintain session state in the public cloud as most cloud applications are designed to handle state and the infrastructure is stateless.  This is true of other services as well like load balancers in Azure.

If you want to have redundant firewalls for security between subnets, you will need to either:

• point a UDR at a primary interface and use an Azure function to move the UDR in the case of a failure
• front the redundant firewalls with an Azure LB and point a UDR to the LB

Follow the link above for examples.

[sougata]

Hi Warby, thanks for the prompt response.

======================================

Firewall configurations can by synchronized accross multiple firewalls using:

• our Azure bootstrapping feature with a common config XML
• Panorama
• Ansible
• Our API

======================================

I do need some clarity on the above. Following is what I have understood:

• We can achieve the config sync during startup with the bootstrapping feature.
• We configure the firewalls with Panorama
• I guess Ansible along with API's would be used to sync the configuration while firewalls are in operation.

Is my understanding correct. Also, please share any configuration guide for the same, if available.

[Warby]

Either Ansible (using our API) or Panorama can keep the configs in synch post deployment (while the firewall is running.)

[sougata]

Hi Warby,

The subnet requirements for VM series as mentioned below

 CIDR block 192.168.0.0/16, and allocates five subnets (192.168.1.0/24 - 192.168.5.0/24) for deploying the Azure Application Gateway, the VM-Series firewalls, the Azure load balancer and the web servers.

Question: 

Is it a mandate to have 19.168.x.x/24 (subnet ./24) or we can use (/30) subnet as it will consume 1 IP for external NIC, internal nic, management nic?