Create a VPC and Configure Networks

1. Open the VPC console and select your region from the menu. Note, the region you select must provide one of the instance types that Palo Alto Networks supports.

2. From the Alibaba Cloud Console homepage, select Products and ServicesNetworkingVirtual Private Cloud.
3. Create a VPC.

   In this step you create a VPC and Management, Untrust, and Trust VS.witches. The ECS console creates a VPC and a switch using the same form.

   1. Select Create VPC.

      Specify the VPC name, an IPv4 CIDR Block, and a description. Refer to Create a VPC.

      Property	Value
      Name	Your choice
      IPv4 CIDR Bock	Your choice. Refer to the CIDR block FAQ.
      Resource Group	Your Choice.

   2. Select Create VSwitch.

      • Name the vSwitch Management.
      • Choose the Zone, specify an IPv4 CIDR Block that is a subset of the block you specified for the VPC, and specify a Description.
      • At the bottom, click Add to add another vSwitch (don't click OK until you have added all VS.witches).

      Refer to Create a VSwitch.
   3. Add the Untrust vSwitch in the same manner.
   4. Add the Trust vSwitch.
   5. Click OK.

      View the VPC details and make any changes before you click Complete.
4. Create security groups and security group rules.

   • From the Alibaba Cloud Console homepage, select Elastic Compute ServiceNetworking & SecuritySecurity Groups.
   • On the upper right, click Create Security Group.

   1. Create the management security group.

      Refer to Create a security group to fill out the following fields.

      Property	Value
      Template	Customize
      Security Group Name	Management
      Security Group Type	Basic
      Network Type	VPC
      VPC	Select the VPC you created earlier.
      Resource Group	Your choice

      • Complete the form and click OK.
        ECS console prompts you to create rules for this security group. This task describes some basic security group rules that allow you to bring up the VM-Series firewall. You can create more rules to enforce your network security requirements.
   2. Select Create Rules Now and create rules for HTTPS and SSH.

      Select the Inbound tab, and click Add Security Group Rule.

      • Create an Inbound rule to allow HTTPS in this security group. For example:

        Property	Value
        Rule Direction	Inbound
        Action	Allow
        Protocol Type	HTTPS (443)
        Priority	100
        Authorization Type	Refer to Add security group rules.
        Authorization Object

      • Click Add Security Group Rule to create an inbound rule to allow SSH on the management interface.

        Property	Value
        Rule Direction	Inbound
        Action	Allow
        Protocol Type	Customized TCP
        Port Range	1/65535
        Authorization Type	Refer to Add security group rules.
        Authorization Object

        Click OK and select Back to return to the Security Groups page.
   3. Select Create Security Group and create the Untrust security group.

      When prompted, create a rule for the Untrust security group.

      Property	Value
      Rule Direction	Inbound
      Action	Allow
      Protocol Type	Custom TCP
      Port Range	1/65535
      Priority	100
      Authorization Type	Refer to Add security group rules.
      Authorization Object

      Click OK and select Back to return to the Security Groups page.
   4. Create the Trust security group.

      When prompted, click Add Security Group Rule and duplicate the Untrust rule.

      Continue to Create and Configure the VM-Series Firewall.