There are some configuration on Azure network to get your Palo Alto firewall working well for the passing through traffic. Especially for ping traffic, by default, you wont be able to ping Internet ip through Palo Alto firewall.
In this post, it will give you some small tricks to get ping working for local interfaces and internet.
For other basic configuration, please check this post: https://blog.51sec.org/2021/12/deploy-palo-alto-vm-series-firewall.html
Topology
Web Gui Overview
ACC Tab: The default ACC view will show you the network, threat, blocked and tunnel activity in four separate tabs for the past hour. The time frame and each tab can be customized to display the relevant application, threat, and user activity depending upon the user role.
- The Objects tab allows you to manage the building blocks for creating policies such as address objects, custom applications, and security profiles.
- The Network tab allows you to create and manage interfaces, security zones, VLANs and other elements that enable connectivity.
- The Device tab is where configuration items like DNS, service routes, etc. are managed. The device tab also allows you to manage high availability, users, software and content updates.
Enable Ping on Interfaces
Steps
- Go to Network > Network Profiles > Interface Mgmt
- Create a profile allowing ping:
- Go to Network > Interfaces and assign the profile, created above, to the interface under the Advanced tab:
- Commit the changesFrom CLI:
> configure # set network profiles interface-management-profile mgmt ping yes # set network interface ethernet ethernet1/3 layer3 interface-management-profile mgmt
Add a Route Table and Route
A subnet is a range of IP addresses in the virtual network. You can divide a virtual network into multiple subnets for organization and security. Each NIC in a VM is connected to one subnet in one virtual network. NICs connected to subnets (same or different) within a virtual network can communicate with each other without any extra configuration. By default all Azure subnet traffic will go to Azure default gateway for that subnet, which is .1 ip address.
Add Public IP Address To Untrusted Interface
By default Azure vnet will not allow ping or tracert packet going through well.
Associate this new public ip with Palo Alto’s untrusted interface, which is eth1:
Updates
After did Check Now from Device -> Dynamic Updates page, you will be able to see some updates available for downloading. You can install them after downloaded.
Basic Steps to Setup VM-Series Firewall and Register it with Credits
Steps:
up the VM-Series Firewall on Azure:
https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/set-up-the-vm-series-firewall-on-azure
2 Create a Deployment Profile:
https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/create-a-deployment-profile-vm-series
3 Manage a Deployment Profile:
https://docs.paloaltonetworks.com/vm-series/9-1/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/manage-a-deployment-profile
4 Register the VM-Series Firewall (Software NGFW Credits):
https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/license-the-vm-series-firewall/software-ngfw/register-the-vm-series-firewall-software-ngfw-credits
f. Enter the autorization code which you got from Support Portal’s deployment profile.
Click OK to confirm the license upgrade.The firewall contacts the Palo Alto Networks update server and consumes the tokens required for your firewall based on the VM-Series model.
Videos
References
- DOES AZURE CLOUD SUPPORT PING AND TRACEROUTE
- Azure Virtual Network frequently asked questions (FAQ)
- New VM-100 deployment, cannot ping or tracert to external websites
- Palo Alto Firewall Lab Setup-Allow Inside Users To The Internet
- https://blog.51sec.org/2021/12/deploy-palo-alto-vm-series-firewall.html
So with the section on adding the route to the palo vm in the route table using UDR, does this mean that two vms in the SAME subnet will have to go through the firewall to talk to each other?