You can deploy the VM-Series firewall on Azure Stack HCI within Software Defined
Networking (SDN) architecture. Azure Stack HCI is a hyperconverged infrastructure (HCI)
cluster solution that hosts virtualized Windows and Linux workloads and their storage in
a hybrid environment that combines on-premises infrastructure with Azure cloud services.
For more information, see Azure Stack HCI solution overview.
You can deploy the VM-Series firewall on Azure Stack HCI and protect the inbound traffic,
outbound traffic, and east-west traffic between various vNETs. The VM-Series firewall
traffic is pinned to an active interface with an out-of-band management interface, where
the internal applications and inbound traffic are routed through route tables to force
traffic through the firewall load balancer for east-west and north-south traffic to
provide internal micro segmentation and a security perimeter. The SDN Gateway then
allows traffic to pass in and out of the internal SDN via the Hub vNet.
Perform the following steps to deploy the VM-Series firewall on Azure Stack HCI SDN:
Operating system licenses for your workload VMs – for example, Windows
Server. See Activate Windows Server VMs.
An internet connection for each server in the cluster that can connect via
HTTPS outbound traffic to well-known Azure endpoints at least every 30 days.
See Azure connectivity requirements
for more information.
This document considers the Windows Admin
Center option for deploying VM-Series firewall.
After successfully
deploying the SDN infrastructure, go to the SDN Infrastructure dashboard on your
Windows Admin Center and ensure that all server nodes are healthy.
By modeling a VLAN-based network as an SDN logical network, you can apply
network policies to workloads that are attached to these networks. For more
information, see Manage Tenant Logical Network.
Deploy the VM-Series firewall.
Download the VHDX file. Register your
VM-Series firewall and obtain the VHDX file.
Click Add IP Address and enter the IP address
for the management interface.
Select Network Security Group (optional).
To connect the Virtual Hard Disk, select Use an existing virtual hard
disk and browse to the VHDX file you downloaded earlier in Step
6.
Click Create.
After successfully installing the VM-Series firewall on the cluster,
you can add more Network Adapters for data traffic. Perform the following
to add a Network Adapter:
