Cloud NGFW for Azure
    : Use Panorama for Cloud NGFW Policy Management
    Focus
    Download PDF
    Focus
    1. Home
    2. Azure
    3. Cloud NGFW for Azure
    4. Panorama Policy Management
    5. Use Panorama for Cloud NGFW Policy Management
    Download PDF

    Cloud NGFW for Azure

    Use Panorama for Cloud NGFW Policy Management

    Table of Contents

    Use Panorama for Cloud NGFW Policy Management

    Manage Cloud NGFW with Panorama.

    Add a Cloud Device Group

    After linking your Cloud NGFW resource to the Panorama virtual appliance you can start using the integration for policy management tasks, such as adding device groups and applying policy rules to the device group.
    With Panorama, you group firewalls in your network into logical units called
    device groups
    . A device group enables grouping based on network segmentation, geographic location, organizational function, or any other common aspect of firewalls requiring similar policy configurations.
    Using device groups, you can configure policy rules and the objects they reference. Organize device groups hierarchically, with shared rules and objects at the top, and device group-specific rules and objects at subsequent levels. This enables you to create a hierarchy of rules that enforce how firewalls handle traffic.
    See Manage Device Groups for more information.
    To add a cloud device group using the Panorama console:
    1. In the
      Azure
      plugin, select
      Cloud NGFW
      .
      The Cloud Device Group table is empty when you first select it. Previously created cloud device groups appear if they were established for the Cloud NGFW resource using Azure.
    2. Click
      Add
      in the lower left corner.
    3. In the
      Cloud Device Group
       screen:
      1. Enter a unique
        name
        for the cloud device group.
      2. Enter a
        description
        .
      3. Use the drop-down to select the
        Parent Device Group
        . By default, this value is shared.
      4. Select the Template Stack from the drop-down. Or, click
        Add
        to create a new one.
      5. Select the
        Panorama IP
         address used by the deployment. The drop-down allows you to select either the
        private
        or
        public
        IP address.
      6. Optionally select the Panorama HA
        Peer IP
         address.
      7. Optionally use the drop-down to select the Collector Group.
      8. Optionally configure Zone Mapping for the Cloud Device Group. Only two zones are supported:
        public or private
        .
      9. Click
        OK
        .
      10. Commit your change in the Panorama console to create the cloud device group. Next, Generate the registration string to create the Cloud NGFW resource and deploy in Azure.

    Delete a Cloud Device Group

    Use the Panorama console to delete a cloud device group. You can only delete a cloud device group if there are no firewalls attached to it.
    To delete a cloud device group from a resource using the Panorama console:
    1. In
      Panorama
      , select
      Cloud Device Groups
      .
    2. Select the
      Cloud Device Group
       you want to remove.
    3. In the lower portion of the Panorama console, click
      Delete
      .
    4. Click
      Yes
      to confirm the deletion.
    5. Commit the change.

    Apply Policy

    Cloud Device Groups on Panorama allow you to centrally manage firewall policy rules. You create policy rules on Panorama either as pre-rules or post-rules. These rules allow you to create a layered approach for implementing policy. For more information, see
    Defining Policies on Panorama
    .
    To configure policy rules for the cloud device group in Panorama:
    1. Select
      Policies
      .
    2. In the
      Device Group
       section, use the drop-down to select the
      Cloud Device Group
       previously created.
      When you create a device group for Cloud NGFW, the name begins with
      cngfw
      . For example,
      cngfw-azure-demo
    3. In the lower left portion of the console, click
      Add
      .
    4. In the
      Security Policy Rule
       screen, configure elements of the policy you want to apply to the device group.
      1. In the
        General
         tab, include a name for the policy. Optionally provide additional information.
      2. Source
        policy defines the source zone or source address from which the traffic originates. For
        Source Zone
        , click
        Any
        . You can't add a specific source zone.
        Continue applying
        Source
        policy rules by including the
        Source Address
        . Click
        Any
        , or use the drop-down to select an existing address, or use options to add a new address or address group.
        For
        Source User
         and
        Source Device
         policy, click
        Any
        . Cloud NGFW does not support specifying specific source users or source devices.
      3. Destination
        policy defines the destination zone or destination address for the traffic. Use the drop-down to select an existing address, or use the options to add a new address or address group. The Destination policy includes fields for the zone, address, and device.
        For the
        Destination Zone
        , click
        Any
        . Cloud NGFW does not support adding individual destination zones.
        For the
        Destination Address
        , click
        Any
        , or use the drop-down to select an existing zone. Click
        New
        to add a new address, address group, or region.
        For the
        Destination Device
        , click
        Any
        . Cloud NGFW does not support adding individual destination devices.
      4. Configure an
        Application
        policy to have the policy action occur based on an application or application group. An administrator can also use an existing App-ID signature and customize it to detect proprietary applications or to detect specific attributes of an existing application. Custom applications are defined in
        ObjectsApplications
        .
        In the
        Application
        screen, click Any, or specify a specific application, like SSH. Click
        Add
        to include a new application policy.
      5. Configure
        Service/URL Category
         policy rules for the firewall to specify a specific TCP or UDP port number or a URL category as match criteria in the policy. Specify
        Service
        level policy rules or
        URL Category
         policy rules by selecting
        Any
        , or use the drop-down options to individually select the policy elements you want to apply. Click
        Add
         to create new policy rules for Service or URL/Category.
    5. After applying policy rules to the cloud device group for the Cloud NGFW resource, push the changes in the Panorama console. In the
      Push to Devices
       screen, click
      Edit Selections
      .
    6. Select the cloud device groups you want to push to the resources, and click
      OK
      , then click
      Push
      .

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.