Deploy the Firewall Template

1. Edit the vm-series-fw-nlb.yaml or vm-series-fw-alb.yaml environment variables to reflect your cloud environment.

   The sample in this workflow is for the NLB. See vm-series-fw-nlb.yaml and vm-series-fw-alb.yaml for further explanation of the template parameters.

   properties:
       region: us-east1
       zones:
       -us-east1-b
       # Do not modify the lb-type field.
       lb-type: nlb
       cloud-nat: yes
       forwarding-rule-port: 80

   # Only one app is allowed
       urlPath-namedPort-maps:
       - appName: app1

   # ssh key PUBLIC:
       - optional

   The autoscaling firewall template requires you to enter the value in single quotes and prepend the key with admin: followed by a space. This is the same convention used for the Google Marketplace template, as detailed in SSH Key Pair. For example:

       bootstrap-bucket: bootstrap-autoscale

       image: vmseries-byol-814
       machine-type: n1-standard-4

   For the service-account, supply the email address for the host project service account you created previously.

        service-account: sa-pan@gcp-autoscale-kk.iam.gserviceaccount.com

   The fw-instance-tag value will be the managed instance group name in the deployment.

        fw-instance-tag: vm-series-fw

   Choose one metric for auto scaling. Possible values are: panSessionActive, panSessionUtilization, DataPlaneCPUUtilizationPct, DataPlanePacketBufferUtilization, or panSessionUtilization.

   metric: custom.googleapis.com/VMSeries/panSessionActive

   max-size: 2
   min-size: 1
   target-type: GAUGE
   util-target: 100 

   # Greenfield deployment
   mgmt-network-cidr: 172.22.2.0/24
   untrust-network-cidr: 172.22.1.0/24
   trust-network-cidr: 172.22.3.0/24
   mgmt-network-access-source-range:
   - 199.167.54.229/32
   - 199.167.52.5/32
   mgmt-network-access-ports:
   - 22
   - 443

2. Deploy the firewall template.

   gcloud deployment-manager deployments create <your-template> 
   --config apps.yaml
   --automatic-rollback-on-error

   Take note of the outputs the CLI prints after the deployment—the subnet names, the deployment name, and the Panorama Pub/Sub topic name. You need these values to configure the Shared VPC and for the application template deployment.

   The firewall deployment name must be configured in the Panorama plugin for GCP auto scaling definition.

Prepare a Service Project

1. Enable the service project APIs from the GCP console or the CLI.

   The required APIs are:

   • Cloud Deployment Manager API
   • Cloud Pub/Sub API
   • Compute Engine API

   Enable APIs from the GCP console.

   1. Select the service project, and from the Navigation menu, select APIs & Services.
   2. Search for and view each required API.
   3. ENABLE any APIs that don't display the “API enabled” status.

   Enable APIs from the CLI.

   1. In the CLI, view your configuration to ensure that you are in the correct project.

      gcloud config list

      If not, set the project as follows:

      gcloud config set project <project-name>

   2. Issue the following commands to enable the required APIs.

      gcloud services enable deploymentmanager.googleapis.com
      gcloud services enable pubsub.googleapis.com
      gcloud services enable compute.googleapis.com

   3. Confirm that the required APIs are enabled.

      gcloud services list --enabled

2. Make the application project a service project for the host project.

   Add the service account from Service/application project administrator as a member in host project with following roles:

   • Compute Network User
   • Pub/Sub Admin
3. Choose a VPC configuration.

   • If the Service project will share the networks in the host project, continue to Configure the Shared VPC.
   • If the Service project has its own VPC network for the application deployment, continue to Configure a Peered VPC.

Configure the Shared VPC

1. Create a shared VPC using the Trust VPC created when you deployed the firewall template.

   Set up a shared VPC for the host (firewall) project:

   gcloud compute shared-vpc enable HOST_PROJECT_ID

2. Attach the service/application project to the host project.

   gcloud compute shared-vpc associated-projects add [SERVICE_PROJECT_ID]--host-project [HOST_PROJECT_ID]

   Additional options are available to share only specific subnets, rather than all subnets in the host project.
3. If you want to use the sample application template to deploy an application, continue to Deploy the Application Template.

   If you have already deployed an application and you want to secure it in your auto scaling deployment, go to Manually Onboard an Application to an Existing Auto Scaling Deployment.

   If you have deployed a service in a GKE cluster, continue to Onboard a GKE Cluster in a Shared VPC.

Configure a Peered VPC

1. In the host project, peer the Trust VPC network of the firewall deployment with the Application VPC.

   gcloud beta compute networks peerings create [PEERING-NAME] \
       --network=[MY-LOCAL-NETWORK] \
       --peer-project [SERVICE-PROJECT-ID] \
       --peer-network [PEER-NETWORK-NAME] \
      [--import-custom-routes] \
      [--export-custom-routes]

2. In the service project, peer the Trust VPC network of the application deployment with the Trust VPC network of the firewall deployment.

   gcloud beta compute networks peerings create [PEERING-NAME] \
       --network=[MY-LOCAL-NETWORK] \
       --peer-project [HOST-PROJECT-ID] \
       --peer-network [PEER-NETWORK-NAME] \
      [--import-custom-routes] \
       [--export-custom-routes]

3. If you want to use the sample application template to deploy an application, continue to Deploy the Application Template.

   If you have already deployed an application and you want to secure it in your auto scaling deployment, go to Manually Onboard an Application to an Existing Auto Scaling Deployment.

   If you have deployed a service in a GKE cluster, continue to Onboard a GKE Cluster in a Peered VPC.

Deploy the Application Template

1. Create a separate application project (service project) to deploy the application (see Prepare a Service Project).
2. Prepare the apps.yaml file as outlined in apps.yaml.
3. Deploy a new application with the application template and define a label for the named port.

   gcloud deployment-manager deployments create <your-template>
   --config apps.yaml
   --automatic-rollback-on-error

   Continue to View the Onboarded Application in the Panorama Plugin for GCP.

Onboard a New Application

Onboard a GKE Cluster

To onboard a private GKE cluster, the GCP plugin for Panorama requires the following information.

• In GCP, expose the ELB frontend for the cluster to the GKE service so the VM-Series firewall can get the named port information for the service.
• The cluster API server address.
• The service account credential for the service in which the cluster is deployed, in JSON format.

The GKE cluster name must not exceed 24 characters. This ensures that if you deploy auto scaling in a peered VPC configuration the static route name does not exceed 31 characters.

Onboard a GKE Cluster in a Shared VPC

To onboard the GKE cluster, you must share the Host project Trust network VPC with the Service project. See Configure the Shared VPC.

For security reasons, only private clusters should be used in an auto scaling deployment. See Creating a private cluster.

1. Set the Host project ID.

   gcloud config set project [HOST_PROJECT_ID]

2. (Optional) Set a compute zone or region for clusters.

   If the cluster is zonal, enter the following:

   gcloud config set compute/zone [COMPUTE_ZONE]

   If the cluster is regional, enter the following:

   gcloud config set compute/region [COMPUTE_REGION]

3. In the Host project, update secondary ranges in the Trust VPC subnet.

   gcloud compute networks subnets update [TRUST_SUBNETWORK_NAME]
     --add-secondary-ranges 
     [PODS_IP_RANGE_NAME] = [POD_RANGE_CIDR],
     [SERVICE_IP_RANGE_NAME]=[SERVICE_RANGE_CIDR]

   Pods and service IP ranges must be within: 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16, and cannot collide with existing IP ranges in the subnetwork.
4. In the Service project, create a private cluster in the shared VPC.

   1. Set the Service project ID.

      gcloud config set project [SERVicE_PROJECT_ID]

   2. Create a private cluster in the shared VPC.

      gcloud container clusters create  [CLUSTER_NAME] 
        --project [SERVICE_PROJECT_ID]
        --zone=[ZONE_NAME]
        --enable-ip-alias
        --enable-private-nodes
        --network projects/[HOST_PROJECT_ID]/global/networks/[NETWORK_NAME]
        --subnetwork projects/[HOST_PROJECT_ID]/regions/[REGION_NAME]
        /subnetworks/[TRUST_SUBNETWORK_NAME] 
        --cluster-secondary-range-name=[PODS_IP_RANGE_NAME] 
        --services-secondary-range-name=[SERVICE_IP_RANGE_NAME] 
        --master-ipv4-cidr=[MASTER_IPV4_CIDR]
        --enable-master-authorized-networks
        --master-authorized-networks=[PANORAMA_MANAGEMENT_IP/32],
        [MY_MANAGEMENT_IP/32]

5. Check your current cluster context:

   kubectl config current-context

6. Check all cluster contexts.

   kubectl config get-context

7. Change to another cluster.

   kubectl config use-context [CONTEXT_NAME]

   If you created your cluster in the GCP console, generate a kubeconfig entry:

   gcloud container clusters get-credentials [CLUSTER_NAME]

8. Create a cluster role in a .yaml file—for example, gke_cluster_role.yaml.

   apiVersion: rbac.authorization.k8s.io/v1beta1
   kind: ClusterRole
   metadata:
     name: gke-plugin-role
   rules:
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - list

9. Apply the cluster role.

   kubectl apply -f gke_cluster_role.yaml

10. Create a cluster role binding in a .yaml file—for example, gke_cluster_role_binding.yaml.

    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: gke-plugin-role-binding
    subjects:
      - kind: ServiceAccount
        name: [SERVICEACCOUNT_NAME]
        namespace: default
    roleRef:
      kind: ClusterRole
      name: gke-plugin-role
      apiGroup: rbac.authorization.k8s.io

11. Apply the cluster role binding.

    kubectl apply -f gke_cluster_role_binding.yaml

12. Create a service account.

    kubectl create serviceaccount [SERVICEACCOUNT_NAME]

13. Export the service account secret token in JSON format.

    MY_TOKEN=`kubectl get serviceaccounts [SERVICEACCOUNT_NAME] 
    -o jsonpath='{.secrets[0].name}'`
    
    kubectl get secret $MY_TOKEN -o json > [FILE_NAME].json

14. Get the API server address.

    kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "

15. In the Panorama plugin for GCP, add the service account information.

    Select PanoramaGoogle Cloud PlatformSetup.

    Name the credential, enter a description, and enter the API server address from step 14, and for GKE Service Account Credential, upload the JSON file you exported in step 13.

    After you add a service account credential, you can validate the credential from your Panorama command line (you cannot validate from the web interface):

    request plugins gcp validate-service-account gke_service_account <svc-acct-credential-name>

16. Set up auto scaling on the Panorama plugin for GCP.

    1. In the Panorama context, expand Google Cloud Platform, select AutoScaling, and click Add.
    2. Supply the Firewall Deployment Name and an optional description for the deployment.
    3. For the GCP Service Account Credential, supply the GCP service account name created in Auto Scaling Components for Google Cloud Platform, step 4.
    4. Choose the Device Group and the template stack you created in when you configured the Panorama plugin for GCP.
    5. Disable License Management Only to ensure traffic is secured.
    6. Enter the exact GKE Cluster Name.
    7. (Optional) Enter a Description of the GKE cluster.
    8. Enter the Network CIDR for the GKE cluster.
    9. Select the GKE Service Account corresponding to the GKE cluster.
17. Commit your changes.
18. (Optional) Create and deploy a service template according to Using the Sample GKE Service Templates, or deploy a GKE service in the GCP console.

Onboard a GKE Cluster in a Peered VPC

To onboard the GKE cluster, you must create and peer the Service VPC with the firewall Trust network in the Host project, as described in Configure a Peered VPC.

For security reasons, only private clusters should be used in an auto scaling deployment. See Creating a private cluster.

1. Set the project ID.

   gcloud config set project [PROJECT_ID]

2. Set a compute zone or region for clusters.

   If the cluster is zonal, enter the following:

   gcloud config set compute/zone [COMPUTE_ZONE]

   If the cluster is regional, enter the following:

   gcloud config set compute/region [COMPUTE_REGION]

3. Update the service project VPC network with the secondary IP ranges for the pods and services.

   gcloud compute networks subnets update [GKE_PEERED_VPC_SUBNETWORK]
   --region=[REGION] 
   --add-secondary-ranges PODS_IP_RANGE_NAME=[ip cidr],
     SERVICE_IP_RANGE_NAME=[ip cidr]

4. Enable cloud NAT.

   Cloud NAT is required to deploy a private cluster.

   gcloud compute routers create [ROUTER_NAME]
     --network [NETWORK_NAME] 
     --region [REGION_NAME]

   gcloud compute routers nats create [NAT_CONFIG_NAME]
     --router-region [REGION_NAME] 
     --router [ROUTER_NAME] 
     --nat-all-subnet-ip-ranges 
     --auto-allocate-nat-external-ip

5. Create a new private cluster in the Service VPC.

   gcloud container clusters create [CLUSTER_NAME] 
     --project [SERVICE_PROJECT_ID]
     --zone=[ZONE_NAME]
     --enable-ip-alias
     --network [NETWORK_NAME]
     --subnetwork [SUBNETWORK_NAME]
     --enable-private-nodes
     --cluster-secondary-range-name=[PODS_IP_RANGE_NAME]
     --services-secondary-range-name=[SERVICE_IP_RANGE_NAME]
     --master-ipv4-cidr=[MASTER_IPV4_CIDR]
     --enable-master-authorized-networks
     --master-authorized-networks=[PANORAMA_MANAGEMENT_IP/32],
     [MY_MANAGEMENT_IP/32]

6. Check your current cluster context:

   kubectl config current-context

7. Check all cluster contexts.

   kubectl config get-context

8. Change to another cluster.

   kubectl config use-context [CONTEXT_NAME]

   If you created your cluster in the GCP console, generate a kubeconfig entry:

   gcloud container clusters get-credentials [CLUSTER_NAME]

9. Create a cluster role in a .yaml file—for example, gke_cluster_role.yaml.

   apiVersion: rbac.authorization.k8s.io/v1beta1
   kind: ClusterRole
   metadata:
     name: gke-plugin-role
   rules:
     - apiGroups:
         - ""
       resources:
         - services
       verbs:
         - list

10. Apply the cluster role.

    kubectl apply -f gke_cluster_role.yaml

11. Create a cluster role binding in a .yaml file—for example, gke_cluster_role_binding.yaml.

    kind: ClusterRoleBinding
    apiVersion: rbac.authorization.k8s.io/v1beta1
    metadata:
      name: gke-plugin-role-binding
    subjects:
      - kind: ServiceAccount
        name: [SERVICEACCOUNT_NAME]
        namespace: default
    roleRef:
      kind: ClusterRole
      name: gke-plugin-role
      apiGroup: rbac.authorization.k8s.io

12. Apply the cluster role binding.

    kubectl apply -f gke_cluster_role_binding.yaml

13. Create a service account.

    kubectl create serviceaccount [SERVICEACCOUNT_NAME]

14. Export the service account secret token in JSON format.

    MY_TOKEN=`kubectl get serviceaccounts [SERVICEACCOUNT_NAME] 
    -o jsonpath='{.secrets[0].name}'`
    
    kubectl get secret $MY_TOKEN -o json >[FILE_NAME].json

15. Get the API server address.

    kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "

16. In the Panorama plugin for GCP, add the service account information.

    Select PanoramaGoogle Cloud PlatformSetup.

    Name the credential and enter the API server address from step 15, and upload the JSON file you exported in step 14.

    After you add a service account credential, you can validate the credential from your Panorama command line:

    request plugins gcp validate-service-account <svc-acct-credential-name>

17. Set up auto scaling on the Panorama plugin for GCP.

    1. In the Panorama context, expand Google Cloud Platform, select AutoScaling, and click Add.
    2. Supply the Firewall Deployment Name and an optional description for the deployment.
    3. For the GCP Service Account Credential, supply the GCP service account name from step 16.
    4. Choose the Device Group and the Template Stack you created in when you configured the Panorama plugin for GCP.
    5. Disable License Management Only to ensure traffic is secured.
    6. Enter the exact GKE Cluster Name.
    7. (Optional) Enter a Description of the GKE cluster.
    8. Enter the Network CIDR for the GKE cluster.
    9. Select the GKE Service Account corresponding to the GKE cluster.
18. (Optional) In your service project, create and deploy a GKE template according to Using the Sample GKE Service Templates, or deploy a GKE service use the GCP console. Onboard a GKE Cluster

View the Onboarded Application in the Panorama Plugin for GCP

Select PanoramaGoogle Cloud PlatformAutoscaling to view your onboarded application. The Details column is only visible if you have an onboarded application.

Each link in the Details column triggers an action.

• Show Status— View the details for applications onboarded to a GCP VM-Series firewall deployment.
  The following fields display information obtained from the selected deployment. You specified these values in the pub/sub message or through GKE cluster service polling.
  • Application/GKE Service Name—An application deployment name, or the name of a GKE service.
  • Host Project—The name of the host project.
  • Cluster/Namespace—A GKE cluster name followed by the namespace, for example, mycluster/namespace9.
  • Named Port—The port assigned to the named port for the service.
  • ILB IP—The ILB IP address.
  • ILB Port—The ILB port number.
    For autoscaling an application, this property is ilb-port in apps.yaml.
    For securing a GKE cluster, this value is the port number of the GKE cluster, as specified in the .yaml file you used to deploy the service in your cluster.
  • Configuration Programmed— True if a NAT rule exists, False if not.
  • Protected— True when an application is onboarded successfully, or False if onboarding failed. If False, see the Not Protected Reason column for an explanation.
  • Not Protected Reason— If Protected is False, it displays the reason the application is not protected. Some common reasons are:
    • Configuration Programmed—True if a NAT rule exists, False if not.
    • Protected—True when an application is onboarded successfully, or False if onboarding failed. If False, see the Not Protected Reason column for an explanation.
    • Not Protected Reason—If Protected is False, it displays the reason the application is not protected. Some common reasons are:
      • You deployed a UDP service in the GKE cluster.
      • You specified a named port that is already in use. Only one application can listen on a specific named port.
      • You chose the License management only option, so we do not program the configuration.
      • No matching label found for GKE services.
• Delicense Inactive VMs—Answer Yes to trigger the delicensing function for inactive VMs.
• Trigger GKE services Sync—Answer Yes to poll the services running in the clusters, and program the NAT, address, and service objects, and static routes if necessary. By default, Panorama automatically polls 10 minutes after the completion of the previous poll.

View the Deployment Status from the CLI

You can use the Panorama CLI to manage deployed applications. The command-line actions parallel those described in View the Onboarded Application in the Panorama Plugin for GCP. In the following commands, the autoscaling_name is the firewall Deployment Name you entered in the auto scaling configuration.

• List the onboarded (protected) applications.

  show plugins gcp show-protected-apps autoscaling_name <fw-deployment-name>

• Trigger the delicensing function for firewalls in the specified deployment.

  request plugins gcp force-delicensing autoscaling_name <fw-deployment-name>

• For a GKE deployment, force the plugin to read the pub-sub messages, and sync NAT rules that are programmed based on the pub-sub messages.

  request plugins gcp gke-service-discovery autoscaling_name <fw-deployment-name>

Parameters in the Auto Scaling Templates for GCP

#Copyright and license information
    :
    :
imports:                     <do not change>
    :
    :
resources:
    -name: vm-series-fw      <do not change>
    -type:vm-series-fw.py    <do not change
    -properties:
    :
    :
outputs:                     <do not change>
    :
    :

urlPath-namedPort-maps
-MyApplication

panSessionActive
panSessionUtilization
DataPlaneCPUUtilizationPct
DataPlanePacketBufferUtilization
panSessionUtilization

mgmt-network-access-source-range
- <permitted-ip-range-1>
- <permitted-ip-range-2>

mgmt-network-access-ports
- 22
- 443

urlPath-namedPort-maps:
- appname:
  namedPort:
  urlMapPaths:
  - '/app1'
  - '/app1/*'

urlPath-namedPort-maps: 
- appName: app1
  namedPort: 80    urlMapPaths:
  - '/app1'
  - '/app1/*'
- appName: app2
  namedPort: 81
  urlMapPaths:
  - '/app2'
  - '/app2/*'

panSessionActive
panSessionUtilization
DataPlaneCPUUtilizationPct
DataPlanePacketBufferUtilization
panSessionUtilization

zones- us-central1-a-
us-central1-b-
us-central1-c-
us-central1-f

Sample GKE Service Templates

kubectl delete -f [FILE_NAME].yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: gke-plugin-role
rules:
  - apiGroups:
      - ""
    resources:
      - services
    verbs:
      - list

kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: gke-plugin-role-binding
subjects:
  - kind: ServiceAccount
    name: hj-gke-891ca3-cluster1-sa
    namespace: default
roleRef:
  kind: ClusterRole
  name: gke-plugin-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: web
  namespace: default
spec:
  selector:
   matchLabels:
    run: web
  template:
   metadata:
    labels:
      run: web
   spec:
    containers:
    - image: gcr.io/google-samples/hello-app:1.0
      imagePullPolicy: IfNotPresent
      name: web
      ports:
      - containerPort: 8080
       protocol:  TCP

apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: default
  annotations:
    cloud.google.com/load-balancer-type: "Internal"
  labels:
    panw-named-port-port1: "80"
spec:
  ports:
  # the port that this service should serve on
  - name: port1 
    port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    run: web
  type: LoadBalancer

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: web2
  namespace: default
spec:
  selector:
    matchLabels:
      run: web2
  template:
    metadata:
      labels:
        run: web2
    spec:
      containers:
      - image: gcr.io/google-samples/hello-app:2.0
        imagePullPolicy: IfNotPresent
        name: web2
        ports:
        - containerPort: 8080
          protocol: TCP

apiVersion: v1
  kind: Service
  metadata:
    name: web2
    namespace: default
    annotations:
      cloud.google.com/load-balancer-type: "Internal"
    labels:
      panw-named-port-port2: "81"
  spec:
    ports:
    # the port that this service should serve on
    - name: port2
      port: 81
      protocol: TCP
      targetPort: 8080
    selector:
      run: web2
    type: LoadBalancer

apiVersion: v1
kind: Service
metadata:
  name: carts
  annotations:
    cloud.google.com/load-balancer-type: "Internal"
  labels:
    panw-named-port-carts-http: "6082"
    panw-named-port-carts-https: "6083"
  namespace: default
spec:
  type: LoadBalancer
  ports:
  # the port that this service should serve on
  - name: carts-http
    protocol: TCP
    port: 80
    targetPort: 80
  - name: carts-https
    protocol: TCP
    port: 443
    targetPort: 443
  selector:
    name: carts