Deploy Azure Auto Scaling Template
Table of Contents
9.1 (EoL)
Expand all | Collapse all
-
- VM-Series Deployments
- VM-Series in High Availability
- Enable Jumbo Frames on the VM-Series Firewall
- Hypervisor Assigned MAC Addresses
- Custom PAN-OS Metrics Published for Monitoring
- Interface Used for Accessing External Services on the VM-Series Firewall
- PacketMMAP and DPDK Driver Support
-
- VM-Series Firewall Licensing
- Create a Support Account
- Serial Number and CPU ID Format for the VM-Series Firewall
-
- Activate Credits
- Transfer Credits
- Create a Deployment Profile
- Manage a Deployment Profile
- Provision Panorama
- Migrate Panorama to a Software NGFW License
- Renew Your Software NGFW Credits
- Amend and Extend a Credit Pool
- Deactivate License (Software NGFW Credits)
- Delicense Ungracefully Terminated Firewalls
- Create and Apply a Subscription-Only Auth Code
- Migrate to a Flexible VM-Series License
-
- Generate Your OAuth Client Credentials
- Manage Deployment Profiles Using the Licensing API
- Create a Deployment Profile Using the Licensing API
- Update a Deployment Profile Using the Licensing API
- Get Serial Numbers Associated with an Authcode Using the API
- Deactivate a VM-Series Firewall Using the API
- Use Panorama-Based Software Firewall License Management
- What Happens When Licenses Expire?
- Install a Device Certificate on the VM-Series Firewall
-
- Supported Deployments on VMware vSphere Hypervisor (ESXi)
-
- Plan the Interfaces for the VM-Series for ESXi
- Provision the VM-Series Firewall on an ESXi Server
- Perform Initial Configuration on the VM-Series on ESXi
- Add Additional Disk Space to the VM-Series Firewall
- Use VMware Tools on the VM-Series Firewall on ESXi and vCloud Air
- Use vMotion to Move the VM-Series Firewall Between Hosts
- Use the VM-Series CLI to Swap the Management Interface on ESXi
-
-
- VM-Series Firewall for NSX-V Deployment Checklist
- Install the VMware NSX Plugin
- Apply Security Policies to the VM-Series Firewall
- Steer Traffic from Guests that are not Running VMware Tools
- Add a New Host to Your NSX-V Deployment
- Dynamically Quarantine Infected Guests
- Migrate Operations-Centric Configuration to Security-Centric Configuration
- Use Case: Shared Compute Infrastructure and Shared Security Policies
- Use Case: Shared Security Policies on Dedicated Compute Infrastructure
- Dynamic Address Groups—Information Relay from NSX-V Manager to Panorama
-
- Supported Deployments of the VM-Series Firewall on VMware NSX-T (North-South)
- Components of the VM-Series Firewall on NSX-T (North-South)
-
- Install the Panorama Plugin for VMware NSX
- Enable Communication Between NSX-T Manager and Panorama
- Create Template Stacks and Device Groups on Panorama
- Configure the Service Definition on Panorama
- Deploy the VM-Series Firewall
- Direct Traffic to the VM-Series Firewall
- Apply Security Policy to the VM-Series Firewall on NSX-T
- Use vMotion to Move the VM-Series Firewall Between Hosts
- Extend Security Policy from NSX-V to NSX-T
-
- Components of the VM-Series Firewall on NSX-T (East-West)
- VM-Series Firewall on NSX-T (East-West) Integration
- Supported Deployments of the VM-Series Firewall on VMware NSX-T (East-West)
-
- Install the Panorama Plugin for VMware NSX
- Enable Communication Between NSX-T Manager and Panorama
- Create Template Stacks and Device Groups on Panorama
- Configure the Service Definition on Panorama
- Launch the VM-Series Firewall on NSX-T (East-West)
- Add a Service Chain
- Direct Traffic to the VM-Series Firewall
- Apply Security Policies to the VM-Series Firewall on NSX-T (East-West)
- Use vMotion to Move the VM-Series Firewall Between Hosts
- Extend Security Policy from NSX-V to NSX-T
- Use Migration Coordinator to Move Your VM-Series from NSX-V to NSX-T
-
-
- Deployments Supported on AWS
-
- Planning Worksheet for the VM-Series in the AWS VPC
- Launch the VM-Series Firewall on AWS
- Launch the VM-Series Firewall on AWS Outpost
- Create a Custom Amazon Machine Image (AMI)
- Encrypt EBS Volume for the VM-Series Firewall on AWS
- Use the VM-Series Firewall CLI to Swap the Management Interface
- Enable CloudWatch Monitoring on the VM-Series Firewall
- VM-Series Firewall Startup and Health Logs on AWS
- Use Case: Secure the EC2 Instances in the AWS Cloud
- Use Case: Use Dynamic Address Groups to Secure New EC2 Instances within the VPC
-
-
- What Components Does the VM-Series Auto Scaling Template for AWS (v2.0) Leverage?
- How Does the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1) Enable Dynamic Scaling?
- Plan the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1)
- Customize the Firewall Template Before Launch (v2.0 and v2.1)
- Launch the VM-Series Auto Scaling Template for AWS (v2.0)
- SQS Messaging Between the Application Template and Firewall Template
- Stack Update with VM-Series Auto Scaling Template for AWS (v2.0)
- Modify Administrative Account and Update Stack (v2.0)
-
- Launch the Firewall Template (v2.1)
- Launch the Application Template (v2.1)
- Create a Custom Amazon Machine Image (v2.1)
- VM-Series Auto Scaling Template Cleanup (v2.1)
- SQS Messaging Between the Application Template and Firewall Template (v2.1)
- Stack Update with VM-Series Auto Scaling Template for AWS (v2.1)
- Modify Administrative Account (v2.1)
- Change Scaling Parameters and CloudWatch Metrics (v2.1)
-
-
- Enable the Use of a SCSI Controller
- Verify PCI-ID for Ordering of Network Interfaces on the VM-Series Firewall
-
- Deployments Supported on Azure
- Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)
- Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)
- Deploy the VM-Series Firewall on Azure Stack
- Enable Azure Application Insights on the VM-Series Firewall
- Set up Active/Passive HA on Azure
- Use the ARM Template to Deploy the VM-Series Firewall
-
- About the VM-Series Firewall on Google Cloud Platform
- Supported Deployments on Google Cloud Platform
- Create a Custom VM-Series Firewall Image for Google Cloud Platform
- Prepare to Set Up VM-Series Firewalls on Google Public Cloud
-
- Deploy the VM-Series Firewall from Google Cloud Platform Marketplace
- Management Interface Swap for Google Cloud Platform Load Balancing
- Use the VM-Series Firewall CLI to Swap the Management Interface
- Enable Google Stackdriver Monitoring on the VM Series Firewall
- Enable VM Monitoring to Track VM Changes on GCP
- Use Dynamic Address Groups to Secure Instances Within the VPC
- Locate VM-Series Firewall Images in the GCP Marketplace
-
- Prepare Your ACI Environment for Integration
-
-
- Create a Virtual Router and Security Zone
- Configure the Network Interfaces
- Configure a Static Default Route
- Create Address Objects for the EPGs
- Create Security Policy Rules
- Create a VLAN Pool and Domain
- Configure an Interface Policy for LLDP and LACP for East-West Traffic
- Establish the Connection Between the Firewall and ACI Fabric
- Create a VRF and Bridge Domain
- Create an L4-L7 Device
- Create a Policy-Based Redirect
- Create and Apply a Service Graph Template
-
- Create a VLAN Pool and External Routed Domain
- Configure an Interface Policy for LLDP and LACP for North-South Traffic
- Create an External Routed Network
- Configure Subnets to Advertise to the External Firewall
- Create an Outbound Contract
- Create an Inbound Web Contract
- Apply Outbound and Inbound Contracts to the EPGs
- Create a Virtual Router and Security Zone for North-South Traffic
- Configure the Network Interfaces
- Configure Route Redistribution and OSPF
- Configure NAT for External Connections
-
-
- Choose a Bootstrap Method
- VM-Series Firewall Bootstrap Workflow
- Bootstrap Package
- Bootstrap Configuration Files
- Generate the VM Auth Key on Panorama
- Create the bootstrap.xml File
- Prepare the Licenses for Bootstrapping
- Prepare the Bootstrap Package
- Bootstrap the VM-Series Firewall on AWS
- Bootstrap the VM-Series Firewall on Azure
- Bootstrap the VM-Series Firewall on Google Cloud Platform
- Verify Bootstrap Completion
- Bootstrap Errors
End-of-Life (EoL)
Deploy Azure Auto Scaling Template
Auto scale the VM-Series firewalls on Azure to secure
your application workloads in greenfield and brownfield use cases.
The Azure auto scaling template leverages
multiple components including native Azure services to auto scale
the VM-Series firewall to secure your application workloads as they
scale in or out to meet the needs of your enterprise. To enable
the Azure VM Scale Sets (VMSS) to auto scale VM-Series firewalls,
custom firewall metrics are published to Azure Application Insights
which allows for firewalls to scale in or scale out based on the
monitored thresholds. For this auto scaling mechanism to work, you
require Panorama and the Azure plugin on Panorama. For details on
all the components you need to secure your application workloads
with an auto-scaling tier of VM-Series firewalls, see Auto Scaling on Azure - Components and Planning Checklist.
Watch the videos on deploying the
Azure autoscaling templates.
Before You Begin
Get started with the deploying the VM-Series
firewalls that auto scale with your application workloads on Azure.
- Review the checklist in Plan Your Deployment. Be sure to check the Panorama plugin version information in the Compatibility Matrix.
- Download the templates and files from the GitHub repository.
- Install the Panorama plugin for Azure on Panorama.
- Install the license deactivation API key for your account on Panorama.This key is required to successfully deactivate licenses on your firewalls when a scale-in event occurs.
- On Panorama create the following:
- In a template stack create a virtual router.Make sure to add the virtual router to the template stack and not to the template. If you do not the create the virtual router in the template stack, the static routes that the Inbound firewall template automatically creates will not be added to the virtual router, and your application template may not launch successfully.
- In a template, create two interfaces—ethernet1/1(Untrust) and ethernet1/2 (Trust) interfaces. On each interface,Enable DHCPand clearAutomatically create default route pointing to default gateway provided by server.
- Assign the interfaces to the virtual router.
- Create a NAT policy rule.
- Select the device group that you plan to use for the configuration of the Inbound Firewall template, and add a NAT policy rule to direct traffic from the untrust zone to the trust zone, and set the translated packet to use the trust interface (ethernet1/2) IP address so that the return traffic is sent back to the trust interface on the firewall.
- Select the device group that you plan to use for the configuration of the Hub Firewall template, and add a NAT policy rule to direct traffic from the trust zone to the untrust zone, and set the translated packet to use the untrust interface (ethernet1/1) IP address so that the return traffic is sent back to the untrust interface on the firewall.
- Create Security policy rules to allow traffic for the application(s) you are deploying.
Deploy the Auto Scaling VM-Series Firewalls to Secure Your
Applications
The following workflow takes you through the
process of setting up the Azure Service Bus infrastructure that
is required to support the messaging system required for detecting
scale-in and scale-out events, auto programming the static routes
and licensing the firewalls. It then helps you deploy the ARM templates
that configure the VM-Series firewalls in VMSS where the firewalls
can scale with your application workloads and ensure high availability
for your services. Finally, it also details how you must configure
your custom application to direct traffic to the VM-Series firewalls
and secure the flow.
- Launch the Infrastructure template.This allows you to launch the Azure Service Bus and the Azure function. You need to get the SB name, SB credentials (shared access key) for use later on the Panorama Azure plugin. You will also need the Function URL to deploy the firewall template (for inbound and hub).
- Log in to the Panorama, and for every VMSS group of firewalls, create a device group, a template stack and one or more templates.
- Set up your Service Principal on the Azure plugin on Panorama.The Service Principal is the service account that you created on the Azure portal. This account is attached to the Azure AD and has limited permissions to access and monitor the resources in your Azure subscription. For this auto scaling deployment, make sure that the Service Principal has Contributor rights, at a minimum.
- Select.PanoramaPluginsAzureSetupService PrincipalAdd
- Enter aNameand optionally aDescriptionto identify the service account.
- Enter theSubscription IDfor the Azure subscription you want to monitor. You must login to your Azure portal to get this subscription ID.
- Enter theClient Secretand re-enter it to confirm.
- Enter theTenant ID. The tenant ID is the Directory ID you saved when you set up the Active Directory application.
- ClickValidateto verify that the keys and IDs you entered are valid, and Panorama can communicate with the Azure subscription using the API.
- Create your Azure auto scaling definition for the Azure subscription.You can add up to 10 Autoscaling Definitions and each definition can include up to 25 Virtual Machine Scale Sets (VMSS). The firewalls in a VMSS map to one device group and one template stack on Panorama.
- Select.PanoramaPluginsAzureAutoscalingAdd
- Enter aNameandDescriptionfor the auto scaling definition.
- Add theService Bus Name—Enter the Service Bus Name that you defined when you launched the Infrastructure template from the GitHub repository. You must copy this name from the from the Azure portal and paste it here.
- Add theShared Access TokenandService Bus Key Name— You need to get these from the Infrastructure template on the Azure portal.
- Select theService Principalthat enables Panorama to authenticate to your Azure subscription.
- Addthe firewall Resource Group to Panorama.
- Enter a name to identify theFirewall Resource Group, and optionally aDescription.
- Select the Resource Group Type:Hub—These firewalls secure outbound traffic and east-west traffic between the VMs in your Azure deployment.Inbound—These firewalls secure inbound traffic to the application VMs in your Azure deployment.
- Select theDevice Group.and theTemplate Stackthat you created for the firewalls deployed within the Resource Group above.
- Verify thatPush static routes automatically to the template stackis enabled. This option is enabled by default, and it enables Panorama to push static routes to the firewalls that belong to the Inbound Firewall VMSS and the Hub Firewall VMSS. In the Inbound Firewall template, the static routes enable the firewalls to direct inbound traffic to the backend application server pool, route return traffic to the client, and route the health probe initiated by the Azure load balancer. In the Hub Firewall template, the static routes enable the firewalls to route the health probe initiated by the Azure load balancer and direct outbound traffic (that is traffic originating from the applications/services) to the internet.
- Launch the Azure Inbound Firewall template.Whether you want to secure a greenfield deployment or a brownfield deployment, you need the Azure Inbound Firewall template to secure inbound traffic to an internet-facing application.
- Launch the Inbound Firewall template.For a description of the input parameters, see Inbound Firewall Template Parameters. And skip to onboard an app, if you do not want to secure outbound traffic (that is secure traffic originating from your application workloads within a Resource Group).
- To secure inbound application traffic, you must connect the application to the Inbound firewall VMSS.When you onboard your application, you need to do the following:
- Configure the Application Gateway with the frontend and backend configuration to point to the internal load balancer that fronts the application server pool. Refer to the Azure Application Gateway documentation.
- In the default BackendUDR, add a route with application subnet as the destination, and the next hop IP address as that of the internal load balancer that fronts the firewall VMSS.
- Set up VNet peering between the application VNet and the Inbound firewall VMSS VNet, if they are in different VNets. When you use the sample application template included in the GitHub repository, VNet peering is set up for you.
- Tag the internal load balancer that fronts the application with these name-value pairs.PanoramaManaged-yesInboundRG-<Name of the Inbound Firewall Resource Group>The Inbound template assigns a public IP address to VMSS PA-VM management interface. Make sure to configure the Network Security Group inbound source IP in the template.
- Launch the Azure Hub Firewall template.You need to deploy this template, only if you want to secure traffic originating from your application workloads within a Resource Group.
- Launch the Hub autoscaling firewall template. For a description of the input parameters, see Hub Template Parameters.
- Connect the Hub firewall VMSS to the application VNet.Complete the following on the Azure portal:
- Add a UDR in the route table and associate the application’s subnet to the route table. Refer to the Azure documentation.
- On the Azure portal, add a default route (0.0.0.0/0) to forward all traffic to the internal load balancer that fronts the Hub firewall VMSS.
- Tag the internal load balancer that fronts the application with these name-value pairs.HubRG-<Name of the Hub Firewall Resource Group>On Panorama, you must add a static route to enable the firewalls in the Hub VMSS to direct traffic back to the application workloads (as shown below in this step). Make sure to define the static route on the template stack that manages the configuration of the firewalls in the Hub VMSS.
- Verify that the auto-programmed routes are in the virtual router on Panorama.After you deploy the Hub template, a default route and a route for health checks to the managed firewalls is automatically added to the virtual router in the template stack for the VM-Series firewalls launched with the Hub template. And the Azure Application Insights instrumentation key is also automatically available. You need to verify that these routes and the are included so that the firewalls are properly configured and can send metrics for monitoring the autoscaling thresholds. the Synchronizing Config with Azure button. Follow the same procedure if you do not see routes populated for the Hub template stack as well.
- Log in to Panorama and selectNetwork.
- Select the template stack associated with the Hub firewall VMSS in theTemplatedrop-down.
- SelectVirtual Routerand select the virtual router.
- SelectStatic Routesand verify that you can see two routes.
- Selectand view the value for theDeviceVM-SeriesAzure Instrumentation Key.
If you do not see the static routes or the Azure Instrumentation Key, on, and click thePanoramaPluginsAzureAutoScalingSynchronizing Config with Azurelink that corresponds to the autoscaling definition you want to update. - Verify that you have a static route to direct return traffic from the internet back to the application.Otherwise, you must add the static route as follows.On Panorama, the virtual router associated with the template stack for the Hub firewall must have a static route to direct return traffic to the application workloads. This static route is automatically created when you tag the internal load balancer in the Application VNet withHubRG-<Name of the Hub Firewall Resource Group>
- Log in to Panorama and selectNetwork.
- Select the template stack associated with the Hub firewall VMSS in theTemplatedrop-down.
- SelectVirtual Routerand select the virtual router you are configuring.
- SelectStatic Routesand add a route with the destination IP address as the subnet for the application, set the outgoing interface as the trust interface on the firewall and the Next Hop IP address for the internal load balancer that fronts your application workloads in the application Resource Group.
The Inbound template assigns a public IP address to VMSS PA-VM management interface. Make sure to configure the Network Security Group inbound source IP in the template.
- To onboard an app, complete the following on the Inbound Firewall Resource Group.
- Access the Application Gateway.
- Add the Load balancer IP address for the sample application to the Application Gateway backend pool.
- Add a route to the defaultBackendUDR to direct traffic through the firewall to the application you want to secure.You need to add a route that specifies the address prefix of the internal load balancer IP address for the application gateway that was created when you launched the App template, and the next hop IP address should match the IP address of the load balancer that fronts the VM-Series firewall VMSS in the Inbound firewall resource group. This route allows the Application Gateway to send traffic to the Inbound firewall VMSS before routing it to the load balancer in the application resource group.
If you have your own app and you want to configure it to secure traffic to it using the VM-Series firewalls that you deployed using the hub or the firewall template, you must do the following:- Set up VNET peering between the application VNet and the VNet in which your firewall VMSS are deployed.If you are securing inbound and outbound application traffic, on the Azure portal select the virtual network for the application and verify that VNet peering status is connected for the Hub and the Inbound firewall VNets.
- Add the IP address of the internal Load Balancer that fronts the application to the Application gateway configuration in the inbound firewall Resource Group.
- Add a route to the defaultBackend UDR table to direct traffic through the firewall. You need to add a route that specifies the IP address of the load balancer that fronts the application, and specify the IP address load balancer that fronts the firewall VMSS as the next hop. This route allows the Application Gateway to send traffic to the firewall VMSS before routing it to the load balancer in the application resource group.
- Add the following tags to the internal load balancer that fronts your application workloads.
- HubRG: Enter the name of the Hub firewall Resource Group
- PanoramaManaged: yes
- InboundRG: Enter the name of the Inbound firewall Resource Group
- To onboard an app, complete the following on the Hub Firewall Resource Group.
- Access the Application Gateway.
- Add the Load balancer IP address for the sample application to the Application Gateway backend pool.
- Add a route to the defaultBackendUDR to direct traffic through the firewall to the application you want to secure.You need to add a route that specifies the address prefix of the internal load balancer IP address for the application gateway that was created when you launched the App template, and the next hop IP address should match the IP address of the load balancer that fronts the VM-Series firewall VMSS in the Inbound firewall resource group. This route allows the Application Gateway to send traffic to the Inbound firewall VMSS before routing it to the load balancer in the application resource group.
If you have your own app and you want to configure it to secure traffic to it using the VM-Series firewalls that you deployed using the hub or the firewall template, you must do the following:- Set up VNET peering between the application VNet and the VNet in which your firewall VMSS are deployed.If you are securing inbound and outbound application traffic, on the Azure portal select the virtual network for the application and verify that VNet peering status is connected for the Hub and the Inbound firewall VNets.
- Add the IP address of the internal Load Balancer that fronts the application to the Application gateway configuration in the inbound firewall Resource Group.
- Add a route to the defaultBackend UDR table to direct traffic through the firewall. You need to add a route that specifies the IP address of the load balancer that fronts the application, and specify the IP address load balancer that fronts the firewall VMSS as the next hop. This route allows the Application Gateway to send traffic to the firewall VMSS before routing it to the load balancer in the application resource group.
- Add the following tags to the internal load balancer that fronts your application workloads.
- HubRG: Enter the name of the Hub firewall Resource Group
- PanoramaManaged: yes
- InboundRG: Enter the name of the Inbound firewall Resource Group
- On Panorama, create Security policy rules.For securing inbound application traffic, you can specify the source zone and destination zones as any, and add the destination IP addresses as a dynamic address group object and reference it in the Security policy rule.