Deploy the CN-Series Firewall as a Kubernetes Service on OKE


Deploy the CN-Series Firewall as a Kubernetes Service on OKE

Table of Contents

Deploy the CN-Series Firewall as a Kubernetes Service on OKE

Where Can I Use This?
What Do I Need?
  • CN-Series Firewall
  • CN-Series 10.1.x or above Container Images
  • Panorama
    running PAN-OS 10.1.x or above version
  • Helm 3.6 or above version client
    for CN-Series deployment using Helm
Complete the following procedure to deploy the CN-Series firewall as a Kubernetes Service on OKE platform:
Oracle Linux 8.5 OS is the only qualified environment for deploying the CN-Series firewall on OKE.
  1. Set up your Kubernetes cluster.
    To create a cluster in OKE, do the following:
    1. Log in to the Oracle Cloud Infrastructure.
    2. Click the navigation menu, go to
      Under Solutions and Platform
      , and then click
      Developer Services
    3. Click
      Kubernetes Clusters
    4. Select a Compartment and click
      Create Cluster
    5. In the Create Cluster dialog box, click
      Custom Create
      and then, click
      Launch Workflow
    6. On the
      Create Cluster
      page, enter the cluster
      and other details.
    7. Click
      to review the details you entered for the new cluster.
    8. On the Review page, click
      Create Cluster
    1. You must ensure that cluster has the CN-Series Prerequisites resources to support the firewall:
      kubectl get nodes
      kubectl describe node <node-name>
      View the information under the Capacity heading in the command output to see the CPU and memory available on the specified node.
      The CPU, memory and disk storage allocation will depend on your needs. See CN-Series Performance and Scaling.
      Ensure you have the following information:
      • Collect the Endpoint IP address for setting up the API server on Panorama.
        Panorama uses this IP address to connect to your Kubernetes cluster.
      • Collect the template stack name, device group name, Panorama IP address, and optionally the Log Collector Group Name from Panorama.
      • Have the location of the container image repository ready to which you downloaded the images.
  2. (
    ) If you configured a custom certificate in the Kubernetes plugin for Panorama, you must create the cert secret by executing the following command. Do not change the file name from ca.crt. The volume for custom certificates in pan-cn-mgmt-dynamic-pv.yaml and pan-cn-ngfw.yaml is optional.
    kubectl -n kube-system create secret generic custom-ca --from-file=ca.crt
  3. Edit the YAML files to provide the details required to deploy the CN-Series firewalls.
    You must ensure that the value of
    parameter on your YAML file matches with your actual Panorama IP address as shown in the diagram below:
    You must ensure that the parameter value of
    on your YAML file matches with the name of the device group and template stack that you created on Panorama as shown in the diagram below:
    You must ensure that the parameter value of
    is same as the log collector name that you created.
    For more information, see Editable parameters in CN-Series deployment yaml files for details.
  4. Deploy the CN-NGFW service. Perform the following steps:
    When deployed as a Kubernetes Service, instances of the CN-NGFW can be deployed on security nodes and application pod traffic is redirected to an available CN-NGFW instance for inspection and enforcement.
    When deploying the CN-Series firewall on OKE as a Kubernetes Service, you can use the yaml files from the pan-cn-k8s-service native folder.
    1. Verify that you have created the service account using the pan-cni-serviceaccount.yaml.
    2. Use Kubectl to run the pan-cni-configmap.yaml.
      kubectl apply -f pan-cni-configmap.yaml
    3. Use kubectl to run the pan-cn-ngfw-svc.yaml.
      kubectl apply -f pan-cn-ngfw-svc.yaml
      This yaml must be deployed before pan-cni.yaml.
    4. Use Kubectl to run the pan-cni.yaml.
      kubectl apply -f pan-cni.yaml
    5. Verify that you have modified the pan-cni-configmap and pan-cni YAML files.
    6. Run the following command and verify that your output is similar to the following example.
  5. Deploy the CN-MGMT StatefulSet.
    By default, the management plane is deployed as a StatefulSet that provides fault tolerance. Up to 30 firewall CN-NGFW pods can connect to a CN-MGMT StatefulSet.
    1. Verify that you have modified the pan-cn-mgmt-configmap and pan-cn-mgmt YAML files.
      Sample pan-cn-mgmt-configmap from OKE.
      apiVersion: v1 kind: ConfigMap metadata: name: pan-mgmt-config namespace: kube-system data: PAN_SERVICE_NAME: pan-mgmt-svc PAN_MGMT_SECRET: pan-mgmt-secret # Panorama settings PAN_PANORAMA_IP: "<panorama-IP>" PAN_DEVICE_GROUP: "<panorama-device-group>" PAN_TEMPLATE_STACK: "<panorama-template-stack>" PAN_CGNAME: "<panorama-collector-group>" PAN_CTNR_MODE_TYPE: "k8s-service" #Non-mandatory parameters # Recommended to have same name as the cluster name provided in Panorama Kubernetes plugin - helps with easier identification of pods if managing multiple clusters with same Panorama #CLUSTER_NAME: "<Cluster name>" #PAN_PANORAMA_IP2: "" # Comment out to use CERTs otherwise PSK for IPSec between pan-mgmt and pan-ngfw #IPSEC_CERT_BYPASS: "" # No values needed # Override auto-detect of jumbo-frame mode and force enable system-wide #PAN_JUMBO_FRAME_ENABLED: "true" # Start MGMT pod with GTP enabled. For complete functionality, need GTP # enable at Panorama as well. #PAN_GTP_ENABLED: "true" # Enable high feature capacities. These need high memory for MGMT pod and # higher/matching memory than specified below for NGFW pod. # Refer to the system requirements documentation to see the max supported NGFW CPU size # supported for each memory profile. #PAN_NGFW_MEMORY: "6.5Gi" #PAN_NGFW_MEMORY: "48Gi" #PAN_NGFW_MEMORY: "56Gi"
      Sample pan-cn-mgmt-dynamic-pv.yaml
      initContainers: - name: pan-mgmt-init image: <your-private-registry-image-path> command: ["/usr/bin/"] imagePullPolicy: Always
      containers: - name: pan-mgmt image: <your-private-registry-image-path> terminationMessagePolicy: FallbackToLogsOnError
    2. Use Kubectl to run the yaml files.
      kubectl apply -f pan-cn-mgmt-configmap.yaml
      kubectl apply -f pan-cn-mgmt-slot-crd.yaml
      kubectl apply -f pan-cn-mgmt-slot-cr.yaml
      kubectl apply -f pan-cn-mgmt-secret.yaml
      kubectl apply -f pan-cn-mgmt-dynamic-pv.yaml
      You must run the pan-mgmt-serviceaccount.yaml, only if you had not previously completed the Create Service Account for Cluster Authentication.
    3. Verify that the CN-MGMT pods are up by running the following command:
      kubectl get pods -l app=pan-mgmt -n kube-system
      It takes about 5-6 minutes.
  6. Deploy the CN-NGFW pods.
    1. Verify that you have modified the YAML files as detailed in PAN-CN-NGFW-CONFIGMAP and PAN-CN-NGFW.
      containers: - name: pan-ngfw-container image: <your-private-registry-image-path>
    2. Use Kubectl apply to run the pan-cn-ngfw-configmap.yaml.
      kubectl apply -f pan-cn-ngfw-configmap.yaml
    3. Use Kubectl apply to run the pan-cn-ngfw.yaml.
      kubectl apply -f pan-cn-ngfw.yaml
    4. Verify that the CN-NGFW Pods are running.
      kubectl get pods -n kube-system -l app=pan-ngfw -o wide
  7. Verify that you can see CN-MGMT, CN-NGFW and the PAN-CNI on the Kubernetes cluster.
    kubectl -n kube-system get pods
  8. Annotate the application yaml or namespace so that the traffic from their new pods is redirected to the firewall.
    You need to add the following annotation to redirect traffic to the CN-NGFW for inspection:
    annotations: pan-fw
    For example, for all new pods in the “default” namespace:
    kubectl annotate namespace default
    On some platforms, the application pods can start when the pan-cni is not active in the CNI plugin chain. To avoid such scenarios, you must specify the volumes as shown here in the application pod YAML.
    volumes: - name: pan-cni-ready hostPath: path: /var/log/pan-appinfo/pan-cni-ready type: Directory
  9. Deploy your application in the cluster.

Recommended For You