Azure: Deploying Palo Alto Networks VM-series Part-2

This is a continuation of Part-1.

Configure Security Zones

• There should only be INSIDE (trust) and OUTSIDE (untrust) zones. No other zones (e.g., DMZ) are applicable as additional vNIC is not advisable in Azure deployment.
• Network > Zones > Add

Configure Interfaces

• There are only two interfaces to configured. Ethernet1/1 is always associated to the untrust vNIC. Ethernet1/2 is always associated to the trust vNIC.
• Network > Interfaces > [select ethernet1/1]
• Assign the Outside or Untrust security zone.
• Add the IP address of the untrust vNIC (see diagram for this demo). The IP address for the untrust interface is always the IP address assigned to the untrust vNIC during deployment.
• Repeat for ethernet1/2 with the respective security zone and IP address for trust (inside) vNIC.

Configure Virtual Router (VR)

It is best practice to have two separate VRs in Azure; one for routing traffic to the internet, one for routing traffic to the trust (inside) zone.

• Network > Virtual Routers > Add (another VR as placeholder)
• Network > Virtual Routers > [edit existing VR for routing to the untrust]
• In Router Settings tab > General > Add ethernet1/1 (if not done so already)
• In Static Routes > Add default route (0.0.0.0/0) with next-hop being the Azure default gateway for that subnet (which always ends in .1).
• In Static Routes > Add inside route (RFC1918) with next-hop being the placeholder VR.

Likewise, the placeholder VR is now the new VR to route traffic inside.

The configuration is the exact opposite. Where the default route next-hop is the other VR. The inside (trust vNIC) next hop is Azure default gateway for that subnet.

In the end, there should be two VRs with two static routes:

Outbound security rules configuration remain unchanged compared to non-cloud based infrastructure.

NAT rules:

Source NAT

Destination NAT

See part 3 for destination NAT.

Now, you can have two-traffic (Tx and Rx) routing through the firewall.

That's it, the firewall is deployed.