Panorama Post-Deployment Configuration for VM Workloads and Kubernetes Clusters

• Configure the following in Panorama:
  • Interfaces
  • Zones
  • NAT Policy
  • Routers
  • Security Policies
• Secure VM workloads only for public clouds
• Secure Kubernetes clusters in public and private clouds
• Install a Kubernetes application with Helm
• • (Optional) Configure labels in your cloud environment for manual deployments.
    The deployment Terraform you generate from Strata Cloud Manager, automatically adds the required labels to organize your Prisma AIRS AI Runtime Firewall. For manual deployments, ensure you have the following labels (key-value pairs) in your Terraform template.
    • Add the following labels (key-value pairs) under Tags in the Terraform template file under your downloaded path `<azure|aws-deployment-terraform-path>/architecture/security_project/terraform.tfvars`. The value of these keys must be unique.
    • For GCP: `paloaltonetworks_com-trust` and `paloaltonetworks_com-occupied`.
    • For Azure and AWS: `paloaltonetworks.com-trust` and `paloaltonetworks.com-occupied`.
    • Ensure the network interface name in the security_project Terraform is suffixed by `-trust-vpc`.

• Complete the steps in Deploy Prisma AIRS AI Runtime Firewall for Panorama Managed Firewall for your cloud to save and download the Terraform template.
• Unzip and navigate to the `<unzipped-folder>` that has the following structure:

  
  |____architecture
      |____LICENSE
      |____README.md
      |____security_project
      |____application_project
      |____helm
  |____modules
  
  

• Enable SSL/TLS decryption on Prisma AIRS AI Runtime Firewall to decrypt traffic between AI applications and AI models using Configure an SSL/TLS Service Profile in Panorama (DeviceCertificate ManagementSSL/TLS Service Profile).
• Add a Template and configure a Template stack in Panorama.
• Add a Device group in Panorama.
  • After you create a template stack and a device group in Panorama, the first Commit All Changes pushes all the configuration changes to the Panorama managed firewall.
  • You can also schedule a Configuration Push to Managed Firewalls after deploying an AI network intercept managed by Panorama, and then select Commit -> Commit to Panorama and Commit -> Push to Devices. (This flexibility allows you to decide the order of operations that best suits your deployment workflow.)
    Select the AI Runtime Security platform under Device Groups in the Push Scope Selection.

• GCP
• Azure
• AWS
• Secure Container Traffic in Private Cloud