Palo Alto VM-Series Firewall Configuration in Azure

Palo Alto VM-Series Firewall Configuration in Azure

There are some configuration on Azure network to get your Palo Alto firewall working well for the passing through traffic. Especially for ping traffic, by default, you wont be able to ping Internet ip through Palo Alto firewall. 

In this post, it will give you some small tricks to get ping working for local interfaces and internet. 

Topology

Enable Ping on Interfaces

To allow Ping and other management traffic, configure an Interface Management Profile and apply it to the interface.

Steps

1. Go to Network > Network Profiles > Interface Mgmt
2. Create a profile allowing ping:

1. Go to Network > Interfaces and assign the profile, created above, to the interface under the Advanced tab:
   
2. Commit the changes
   
   From CLI:

   > configure
   # set network profiles interface-management-profile mgmt ping yes
   # set network interface ethernet ethernet1/3 layer3 interface-management-profile mgmt
   
   

   
   

Add a Route Table and Route

By default all Azure subnet traffic will go to Azure default gateway for that subnet, which is .1 ip address. 

If we will need to re-route traffic to our virtual appliance, such as our Palo Alto firewall, we will need to create a separate route table and add a new route in it. 

Create a new route to reroute all default traffic to Palo Alto firewall interface which is 10.0.2.4

Associate your subnet which will use this  routing table. 

Add Public IP Address To Untrusted Interface

By default Azure vnet will not allow ping or tracert packet going through well. 

To make ping working through Azure network and Palo Alto firewall, you will have to assign a public ip to untrusted interface on Palo Alto

Associate this new public ip with Palo Alto's untrusted interface, which is eth1:

Now you should be able to use Ping to Internet through Palo Alto firewall.

Updates

After did Check Now from Device -> Dynamic Updates page, you will be able to see some updates available for downloading.  You can install them after downloaded. 

Even the VM firewall is not able to connect to Palo Alto networks update server, you will be still able to proceed with installation without valid the content. 

References

• DOES AZURE CLOUD SUPPORT PING AND TRACEROUTE
• Azure Virtual Network frequently asked questions (FAQ)
• New VM-100 deployment, cannot ping or tracert to external websites
• Palo Alto Firewall Lab Setup-Allow Inside Users To The Internet

via Blogger http://blog.51sec.org/2021/12/palo-alto-vm-series-firewall.html
December 04, 2021 at 01:42PM Palo Alto