Create an IPAM Pool for BYOIPs

Table of Contents

Create an IPAM Pool for BYOIPs

Create, provision, advertise, and share an AWS IPAM pool so Cloud NGFW for AWS can use your own public IP addresses (BYOIPs) for Egress NAT.

You can transfer your BYOIP addresses from your AWS account to the Cloud NGFW to avoid incurring hourly EIP management costs.

To use BYOIPs, you must create a IP Address Management (IPAM) pool in your AWS account and share it in your Cloud NGFW for AWS deployment account. IPAM helps manage your IP addressing schema to meet security requirements. See Bring your own IP addresses on the AWS site for more information.

When creating an IPAM pool in AWS you must add the Palo Alto Networks AWS Account ID to the allow list for Cloud NGFW to share IP addresses between the Cloud NGFW dataplane and AWS. During the IPAM pool creation process, you select the option to Allow Amazon VPC IP Address Manager (a mandatory step to create the IPAM pool); specify the AWS Data Plane Account ID for your Cloud NGFW resource: 010510656586.

It may take approximately 10 minutes to create an IPAM pool.

To create an IPAM pool:

Log in to the AWS VPC IP Address Manager.
Select Planning > IPAMs.
In the IPAMs page, click Create IPAM.

For more information, see the instructions on the AWS page to Create an IPAM.

After you successfully create the IPAM, the AWS VPC IP Address Manager displays details of the IPAM:

After you successfully create the IPAM, the AWS VPC IP Address Manager displays details of the IPAM:
Create an IPAM pool to plan for IP address provisioning. Select Planning>Pools and click Create pool.

When creating an IPAM pool, you must set the Address Family to IPv4, and set the Locale to where you want to deploy your Cloud NGFW resource, as illustrated in the Pool Hierarchy screen:

After you successfully create the IPAM, the AWS VPC IP Address Manager displays details about the new pool:

The newly created pool does not have CIDRs provisioned. You’ll need a public IP CIDR range and the corresponding certificate’s private key.
Provision CIDRS to the newly created pool from the previous step. Select Planning>Pools then select the CIDR tab below the Pool Summary.
Select Actions>Provision CIDR. You’ll use this process to retrieve a public IP CIDR range and the corresponding certificate’s private key. See Provision CIDRS to a pool for more information.
In the CIDRs to provision, click Input a CIDR with a X.509 Certificate .
Copy the Signature.
Click Provision.

Confirm that the CIDR is successfully provisioned, and that the pool was successfully created:
By default, when you add a CIDR to a pool it isn't advertised. Advertise it to make it publicly accessible over the internet. To advertise the CIDR:
1. Select the pool.
2. Click the CIDR tab.
3. In the Actions menu, select Advertise.
4. In the Advertise CIDR menu, use the drop-down menu to select the appropriate ASN; click Advertise CIDR. For more information, see Advertise your CIDR.
Confirm that the CIDR is successfully advertised:
After advertising the CIDR, share the IPAM pool with your Cloud NGFW deployment account. To do this:
1. Select the pool.
2. Click the Resource sharing tab.
3. In the Resource sharing menu, select Create resource share.
4. In the Resource share name menu, enter the name of the IPAM pool you want to share.
5. Optionally add the ARN to the resource share name.
6. Click Next.
7. Grant access to principals.
8. Review the resource share options and principals, then click Create. For more information, see Share an IPAM pool.
  
  Confirm that resources associated with the IPAM pool were successfully shared: