Document:CN-Series Deployment Guide

Prepare to Use the Terraform Templates

Download PDF

Last Updated:

Fri May 19 07:55:39 UTC 2023

Current Version:

11.0

Version 11.0
Version 10.2
Version 10.1

Filter

CN-Series Firewall for Kubernetes

CN-Series Key Concepts

CN-Series Core Building Blocks

Components Required to Secure Kubernetes Clusters with CN-Series Firewall

CN-Series Deployment—Supported Environments

CN-Series System Requirements

CN-Series Performance and Scaling

Additional CN-Series Resources

License the CN-Series Firewall

Activate Credits

Create a CN-Series Deployment Profile

Manage Deployment Profiles

Secure Kubernetes Workloads with CN-Series

CN-Series Deployment Checklist

CN-Series Prerequisites

Generate the Auto-Registration PIN for the CN-Series

Create Service Accounts for Cluster Authentication

Install the Kubernetes Plugin and Set up Panorama for CN-Series

Get the Images and Files for the CN-Series Deployment

Editable Parameters in CN-Series Deployment YAML Files

Deploy the CN-Series Firewalls

Deploy the CN-Series Firewall with Rancher Orchestration

Rancher Cluster Deployment

Set up Master and Worker Node on Rancher Cluster

Modify the Rancher Cluster Options YAML File

Deploy the CN-Series Firewall on GKE

Deploy the CN-Series Firewall as a Kubernetes Service on GKE

Deploy the CN-Series Firewall as a DaemonSet on GKE

Deploy the CN-Series Firewall on EKS

Deploy the CN-Series Firewall as a Kubernetes Service on AWS EKS

Deploy the CN-Series Firewall as a Daemonset on AWS EKS

Deploy the CN-Series from the AWS Marketplace

Deploy the CN-Series Firewall on OKE

Deploy the CN-Series Firewall as a Kubernetes Service on OKE

Deploy the CN-Series Firewall as a DaemonSet on OKE

Deploy the CN-Series Firewall as a Kubernetes Service

Deploy the CN-Series Firewall as a DaemonSet

Deploy the CN-Series Firewall as a Kubernetes CNF

Deploy the Kubernetes CNF L3 in Standalone Mode

High Availability Support for CN-Series Firewall as a Kubernetes CNF

High Availability for CN-Series Firewall on AWS EKS

Overview of HA on AWS EKS

IAM Roles for HA

HA Links

Heartbeat Polling and Hello Messages

Device Priority and Preemption

HA Timers

Configure Active/Passive HA on AWS EKS Using a Secondary IP

Configure DPDK on CN-Series Firewall

Set up DPDK on On-Premises Worker Nodes

Set up DPDK on AWS EKS

Deploy the CN-Series on OpenShift

Deploy CN-Series Firewalls with a Template

Deploy CN-Series Firewall with Terraform Templates

Prepare to Use the Terraform Templates

Deploy a GKE Cluster

Deploy an EKS Cluster

Deploy an AKS Cluster

Deploy a Sample Application

Deploy a CN-Series Firewall Using Terraform

Configure the Kubernetes Plugin for Panorama

Deploy CN-Series Firewalls with Helm Charts and Templates

Deploy CN-Series Firewalls With and Without the Helm Repository

Enable Horizontal Pod Autoscaling on the CN-Series

Configure Panorama to Secure a Kubernetes Deployment

IP-Address-to-Tag Mapping of Kubernetes Attributes

Secure 5G With the CN-Series Firewall

Enable Inspection of Tagged VLAN Traffic

Enable IPVLAN

Uninstall the Kubernetes Plugin on Panorama

Features Not Supported on the CN-Series

CN-Series HSF

CN-Series HSF Architecture

Types of Pods

Interconnect Links

License the CN-Series HSF

Activate Credits

Create a CN-Series HSF Deployment Profile

Manage Deployment Profiles

CN-Series HSF System Requirements

Prerequisites to Deploy the CN-Series HSF

Cluster Requirements

Prepare the Cluster

Prepare Panorama for CN-Series HSF Deployment

Deploy the HSF Cluster

Different States of Deployment

Configure Traffic Flow Towards CN-Series HSF

Test Case: Layer 3 BFD Based CN-GW Failure Handling

View CN-Series HSF Summary and Monitoring

Validating the CN-Series HSF Deployment

Custom Metric Based HPA Using KEDA in EKS Environments

CN-Series HSF: Use Cases

5G Traffic Testing

Scale Out Firewalls Based on Custom Metrics Supported

Test Case: CN-MGMT Failure Handling

Test Case: CN-NGFW Failure Handling

Test Case: CN-DB Failure Handling

Features Not Supported on the CN-Series

Upgrade the CN-Series Firewall

Migrate the CN-Series Firewall to PAN-OS 10.2

Upgrade the CN-Series Firewall—Rolling Update

Upgrade the CN-Series Firewall—Redeploy

CN-Series Firewall for Kubernetes
License the CN-Series Firewall
Secure Kubernetes Workloads with CN-Series
CN-Series HSF
Upgrade the CN-Series Firewall

Prepare to Use the Terraform Templates

Install the software required to use the community-supported Terraform templates.

To use the Terraform templates to secure a Kubernetes cluster, ensure you have the templates and the following software installed.

Clone the https://github.com/PaloAltoNetworks/cn-series-deploy repository.

$ git clone https://github.com/PaloAltoNetworks/cn-series-deploy.git

$ cd cn-series-deploy

Install the following software on Panorama.

In your deployment, Panorama must be accessible from the Kubernetes cluster and the CN-Series firewall you use to secure the cluster.

Panorama 10.0.0 or later

Kubernetes Plugin for Panorama version 1.0.0 or later. See Configure the Kubernetes Plugin for Panorama.

Install Terraform version 1.0.3 or later.

Install the API and command line interface for the public cloud you are using.

Google Cloud SDK

AWS CLI

Azure CLU

You are ready to Configure the Kubernetes Plugin for Panorama and deploy a GKE, EKS, or AKS cluster.

Document:CN-Series Deployment Guide

Prepare to Use the Terraform Templates

Table of Contents

Prepare to Use the Terraform Templates

Most Popular

Recommended For You

Document:CN-Series Deployment Guide

Prepare to Use the Terraform Templates

Table of Contents

Prepare to Use the Terraform Templates

Most Popular

Recommended For You

Recommended Videos