{"id":300,"date":"2022-05-16T19:05:10","date_gmt":"2022-05-16T23:05:10","guid":{"rendered":"https:\/\/opentextbc.ca\/paloalto\/chapter\/deploy-palo-alto-to-azure\/"},"modified":"2023-11-28T19:05:52","modified_gmt":"2023-11-29T00:05:52","slug":"deploy-palo-alto-to-azure","status":"publish","type":"chapter","link":"https:\/\/opentextbc.ca\/paloalto\/chapter\/deploy-palo-alto-to-azure\/","title":{"raw":"4.2 Deploy Palo Alto to Azure","rendered":"4.2 Deploy Palo Alto to Azure"},"content":{"raw":"
\n

Learning Objectives<\/p>\n\n<\/header>\n

\n
    \n \t
  • Configure a Virtual Network in Microsoft Azure<\/li>\n \t
  • Set up and configure the Azure VPN Gateway for IPsec VPN<\/li>\n \t
  • Implement Network Security Groups (NSGs) in Azure for traffic control<\/li>\n \t
  • Monitor and troubleshoot IPsec VPN connections on Palo Alto<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
    Scenario<\/strong>: In this lab, we'll learn how to deploy Palo Alto Firewall to Azure.<\/div>\n
      \n \t
    1. Go to Azure Marketplace and search for Palo Alto.\n\n[caption id=\"attachment_277\" align=\"aligncenter\" width=\"820\"]\"Search Figure 4.45: Search for Palo Alto[\/caption]<\/li>\n \t
    2. Select VM-Series Next-Generation Firewall from Palo Alto.\n\n[caption id=\"attachment_278\" align=\"aligncenter\" width=\"1493\"]\"Select Figure 4.46: Select VM Series Next-Generation Firewall[\/caption]<\/li>\n \t
    3. Then, Select VM-Series Next Generation Firewall<\/strong> from dropdown list.\n\n[caption id=\"attachment_279\" align=\"aligncenter\" width=\"1304\"]\"Select Figure 4.47: Select VM-Series Next Generation Firewall[\/caption]<\/li>\n \t
    4. Create a Firewall information, as Figure 4.48.\n\n[caption id=\"attachment_282\" align=\"aligncenter\" width=\"1099\"]\"Step1- Figure 4.48: Create a VM-Series Palo Alto[\/caption]\n\n[caption id=\"attachment_282\" align=\"aligncenter\" width=\"772\"]\"Step2- Figure 4.49: Networking configuration[\/caption]\n\n[caption id=\"attachment_282\" align=\"aligncenter\" width=\"768\"]\"Step3- Figure 4.50: VM Configuration (DNS-VM Name)[\/caption]<\/li>\n \t
    5. Leave other tabs as default and press on \"Review + create<\/strong>.\" It will validate your information and then you can create a Palo Alto Firewall.\n\n[caption id=\"attachment_283\" align=\"aligncenter\" width=\"784\"]\"Create Figure 4.51: Create a firewall[\/caption]<\/li>\n \t
    6. Then, it will start deployment of Palo Alto. It takes around 5 minutes<\/strong> to deploy Palo Alto.\n\n[caption id=\"attachment_285\" align=\"aligncenter\" width=\"813\"]\"Deployment Figure 4.52: Deployment is in progress[\/caption]\n\n[caption id=\"attachment_285\" align=\"aligncenter\" width=\"812\"]\" Figure 4.53: Deployment is complete[\/caption]<\/li>\n \t
    7. After deployment is completed, go to Resource group > hamid > Overview<\/strong> and look for Palo Alto Public IP address.\n\n[caption id=\"attachment_287\" align=\"aligncenter\" width=\"903\"]\"Palo Figure 4.54: Palo Alto Public IP Address[\/caption]\n\n[caption id=\"attachment_287\" align=\"aligncenter\" width=\"1210\"]\"Palo Figure 4.55: Palo Alto Public IP Address[\/caption]<\/li>\n \t
    8. Type the IP address in the browser. You should be able to see the Palo Alto credentials page. Enter your username and password to log in to the firewall.\n\n[caption id=\"attachment_288\" align=\"aligncenter\" width=\"1639\"]\"Palo Figure 4.56: Palo Alto Firewall Credential Page[\/caption]<\/li>\n \t
    9. Azure will create three interfaces, as Figure 4.57. By default, Eth0 is set as a management port and this port has the public IP address and you can reach the GUI through this IP address. Eth1 is set as an Untrusted interface and to be able to access the firewall through this port, you should set the Public address for this port.\n\n[caption id=\"attachment_289\" align=\"aligncenter\" width=\"400\"]\" Figure 4.57: Palo Alto Firewall Interfaces by default[\/caption]<\/li>\n \t
    10. To set interfaces in the firewall, you should go to Network > Interfaces<\/strong> and set both ethernet1\/1<\/strong> and ethernet1\/2<\/strong> as a DHCP client. Also, uncheck \"Automatically create default route pointing to default gateway.\"\n\n[caption id=\"attachment_291\" align=\"aligncenter\" width=\"500\"]\"Ethernet1\/1 Figure 4.58: Ethernet1\/1 configuration[\/caption]\n\n[caption id=\"attachment_291\" align=\"aligncenter\" width=\"500\"]\" Figure 4.59: Ethernet1\/2 configuration[\/caption]<\/li>\n \t
    11. Then, you set a default route and set a zone for each interface.\n\n[caption id=\"attachment_294\" align=\"aligncenter\" width=\"922\"]\"Ethernet1\/1 Figure 4.60: Ethernet1\/1 zone and virtual router[\/caption]\n\n[caption id=\"attachment_294\" align=\"aligncenter\" width=\"917\"]\"Ethernet1\/2 Figure 4.61: Ethernet1\/2 zone and virtual router[\/caption]\n

      and then in Ethernet1\/1 under the advanced tab, set management interface profile as Figure 4.62.<\/p>\n\n\n[caption id=\"attachment_294\" align=\"aligncenter\" width=\"500\"]\"Ethernet1\/1 Figure 4.62: Ethernet1\/1 Management Profile[\/caption]<\/li>\n \t

    12. Create a static route to 10.0.1.1.\n\n[caption id=\"attachment_295\" align=\"aligncenter\" width=\"400\"]\"Create Figure 4.63: Create a static route to 10.0.1.1[\/caption]<\/li>\n \t
    13. Create a public IP address and assign the public IP address to interface eth1 (Untrusted interface).\n\n[caption id=\"attachment_299\" align=\"aligncenter\" width=\"500\"]\"Step1- Figure 4.64: Create a public IP address[\/caption]\n\n[caption id=\"attachment_299\" align=\"aligncenter\" width=\"350\"]\"Step2- Figure 4.65: Create a public IP address (set SKU and name)[\/caption]\n\n[caption id=\"attachment_299\" align=\"aligncenter\" width=\"700\"]\"Step3- Figure 4.66: Select Interface eth1[\/caption]\n\n[caption id=\"attachment_299\" align=\"aligncenter\" width=\"400\"]\"Step4- Figure 4.67: Assign public IP address to Eth1[\/caption]<\/li>\n \t
    14. Open the browser and type the public IP address. You should be able to access the firewall.<\/li>\n<\/ol>","rendered":"
      \n
      \n

      Learning Objectives<\/p>\n<\/header>\n

      \n
        \n
      • Configure a Virtual Network in Microsoft Azure<\/li>\n
      • Set up and configure the Azure VPN Gateway for IPsec VPN<\/li>\n
      • Implement Network Security Groups (NSGs) in Azure for traffic control<\/li>\n
      • Monitor and troubleshoot IPsec VPN connections on Palo Alto<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
        Scenario<\/strong>: In this lab, we’ll learn how to deploy Palo Alto Firewall to Azure.<\/div>\n
          \n
        1. Go to Azure Marketplace and search for Palo Alto.
          \n
          \"Search
          Figure 4.45: Search for Palo Alto<\/figcaption><\/figure>\n<\/li>\n
        2. Select VM-Series Next-Generation Firewall from Palo Alto.
          \n
          \"Select
          Figure 4.46: Select VM Series Next-Generation Firewall<\/figcaption><\/figure>\n<\/li>\n
        3. Then, Select VM-Series Next Generation Firewall<\/strong> from dropdown list.
          \n
          \"Select
          Figure 4.47: Select VM-Series Next Generation Firewall<\/figcaption><\/figure>\n<\/li>\n
        4. Create a Firewall information, as Figure 4.48.
          \n
          \"Step1-
          Figure 4.48: Create a VM-Series Palo Alto<\/figcaption><\/figure>\n
          \"Step2-
          Figure 4.49: Networking configuration<\/figcaption><\/figure>\n
          \"Step3-
          Figure 4.50: VM Configuration (DNS-VM Name)<\/figcaption><\/figure>\n<\/li>\n
        5. Leave other tabs as default and press on “Review + create<\/strong>.” It will validate your information and then you can create a Palo Alto Firewall.
          \n
          \"Create
          Figure 4.51: Create a firewall<\/figcaption><\/figure>\n<\/li>\n
        6. Then, it will start deployment of Palo Alto. It takes around 5 minutes<\/strong> to deploy Palo Alto.
          \n
          \"Deployment
          Figure 4.52: Deployment is in progress<\/figcaption><\/figure>\n
          \"Deployment
          Figure 4.53: Deployment is complete<\/figcaption><\/figure>\n<\/li>\n
        7. After deployment is completed, go to Resource group > hamid > Overview<\/strong> and look for Palo Alto Public IP address.
          \n
          \"Palo
          Figure 4.54: Palo Alto Public IP Address<\/figcaption><\/figure>\n
          \"Palo
          Figure 4.55: Palo Alto Public IP Address<\/figcaption><\/figure>\n<\/li>\n
        8. Type the IP address in the browser. You should be able to see the Palo Alto credentials page. Enter your username and password to log in to the firewall.
          \n
          \"Palo
          Figure 4.56: Palo Alto Firewall Credential Page<\/figcaption><\/figure>\n<\/li>\n
        9. Azure will create three interfaces, as Figure 4.57. By default, Eth0 is set as a management port and this port has the public IP address and you can reach the GUI through this IP address. Eth1 is set as an Untrusted interface and to be able to access the firewall through this port, you should set the Public address for this port.
          \n
          \"Palo
          Figure 4.57: Palo Alto Firewall Interfaces by default<\/figcaption><\/figure>\n<\/li>\n
        10. To set interfaces in the firewall, you should go to Network > Interfaces<\/strong> and set both ethernet1\/1<\/strong> and ethernet1\/2<\/strong> as a DHCP client. Also, uncheck “Automatically create default route pointing to default gateway.”
          \n
          \"Ethernet1\/1
          Figure 4.58: Ethernet1\/1 configuration<\/figcaption><\/figure>\n
          \"Ethernet1\/2
          Figure 4.59: Ethernet1\/2 configuration<\/figcaption><\/figure>\n<\/li>\n
        11. Then, you set a default route and set a zone for each interface.
          \n
          \"Ethernet1\/1
          Figure 4.60: Ethernet1\/1 zone and virtual router<\/figcaption><\/figure>\n
          \"Ethernet1\/2
          Figure 4.61: Ethernet1\/2 zone and virtual router<\/figcaption><\/figure>\n

          and then in Ethernet1\/1 under the advanced tab, set management interface profile as Figure 4.62.<\/p>\n

          \"Ethernet1\/1
          Figure 4.62: Ethernet1\/1 Management Profile<\/figcaption><\/figure>\n<\/li>\n
        12. Create a static route to 10.0.1.1.
          \n
          \"Create
          Figure 4.63: Create a static route to 10.0.1.1<\/figcaption><\/figure>\n<\/li>\n
        13. Create a public IP address and assign the public IP address to interface eth1 (Untrusted interface).
          \n
          \"Step1-
          Figure 4.64: Create a public IP address<\/figcaption><\/figure>\n
          \"Step2-
          Figure 4.65: Create a public IP address (set SKU and name)<\/figcaption><\/figure>\n
          \"Step3-
          Figure 4.66: Select Interface eth1<\/figcaption><\/figure>\n
          \"Step4-
          Figure 4.67: Assign public IP address to Eth1<\/figcaption><\/figure>\n<\/li>\n
        14. Open the browser and type the public IP address. You should be able to access the firewall.<\/li>\n<\/ol>\n","protected":false},"author":124,"menu_order":5,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-300","chapter","type-chapter","status-publish","hentry"],"part":230,"_links":{"self":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/wp\/v2\/users\/124"}],"version-history":[{"count":1,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/300\/revisions"}],"predecessor-version":[{"id":301,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/300\/revisions\/301"}],"part":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/parts\/230"}],"metadata":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapters\/300\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/wp\/v2\/media?parent=300"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/pressbooks\/v2\/chapter-type?post=300"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/wp\/v2\/contributor?post=300"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/opentextbc.ca\/paloalto\/wp-json\/wp\/v2\/license?post=300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}