Focus

VM-Series

Configuring GCP Load Balancer

Table of Contents

Secure Boot Support for VM-Series on GCP

Autoscaling the VM-Series Firewall on Google Cloud Platform

Configuring GCP Load Balancer

Configure your GCP load balancer using the external load balancer, global HTTPS load balancer, or global HTTP(s) load balancer with XFF header.

Where Can I Use This?	What Do I Need?
Google Cloud Platform (GCP)	VM-Series License (PAYG or BYOL) VM-Series plugin Panorama Panorama plugin for GCP

The following are ways to configure your GCP load balancer:

Onboarding External Load Balancer

The external TCP load balancer distributes TCP/UDP traffic from the internet to the VM-Series firewall. Internal applications can be onboarded by creating a forwarding rule for each application. Here, we will onboard two applications by allocating frontend IPs to an external TCP load balancer.

Before you begin, you need the following:

The IPs of the backend applications (i.e. app1: 10.1.0.10, app2: 10.2.0.10).
If you do not have an environment, use this Terraform plan to build a test bed environment.

Following are the steps to onboard external TCP load balancer:

Configure the backend service.

Here is an example:

gcloud compute health-checks create tcp vmseries-hc \
   --request=/php/login.php \
   --port=80 \
   --region=us-central1

gcloud compute backend-services create vmseries-external-lb \
   --load-balancing-scheme=EXTERNAL \
   --protocol=TCP \
   --health-checks=vmseries-hc \
   --health-checks-region=us-central1 \
   --region=us-central1

gcloud compute backend-services add-backend vmseries-external-lb \
   --instance-group=vmseries-us-central1-a \
   --instance-group-zone=us-central1-a \
   --region=us-centrall

Create a forwarding rule for each application.

gcloud compute forwarding-rules create app1 \
   --load-balancing-scheme=EXTERNAL \
   --region=us-central1 \
   --ports=ALL \
   --backend-service=vmseries-external-lb

gcloud compute forwarding-rules create app2 \
   --load-balancing-scheme=EXTERNAL \
   --region=us-central1 \
   --ports=ALL \
   --backend-service=vmseries-external-lb

Click Create.
On your VM-Series firewall web interface, create two NAT policies to IP map the load balancer forwarding rule address to the correct internal application.

You can see the following details in your traffic logs:

Automation Example:

Below is a Terraform code sample that automates the manual steps above.

A forwarding rule is created on an existing external TCP load balancer. The forwarding rule address is used within the VM-Series NAT policy to map to a backend application.

# Create GCP LB forwarding rule 

resource "google_compute_forwarding_rule" "default" {
 name                  = "my-forwarding-rule"
 target                = var.target
 region                = "us-central1"
 load_balancing_scheme = "EXTERNAL"
 all_ports             = true
}

# Create VM-Series NAT policy

resource "panos_nat_rule_group" "main" {
 provider         = panos
 position_keyword = "bottom"

 rule {
   name = "my-nat-policy"

   original_packet {
     source_zones          = ["untrust"]
     destination_zone      = "untrust"
     destination_interface = "ethernet1/1"
     service               = "any"
     source_addresses      = ["any"]
     destination_addresses = ["${google_compute_forwarding_rule.default.ip_address}"]
   }

   translated_packet {
     source {
       dynamic_ip_and_port {
         interface_address {
           interface = "ethernet1/2"
         }
       }
     }
     destination {
       dynamic_translation {
         address = "<ip-address>"
       }
     }
   }
 }

Onboarding Global HTTPS Load Balancer

The Global HTTP(s) Load Balancer distributes traffic from the internet to the VM-Series firewall. Internal applications can be onboarded by creating port mappings between the backend service and VM-Series NAT policies. Here, we will onboard two separate HTTP applications using port mappings.

Before you begin, you need the following:

The IPs of the backend applications (i.e. app1: 10.1.0.10, app2: 10.2.0.10).
A unique port number to map each application (i.e. app1:TCP/1000, app2:TCP/2000).
If you do not have an environment, use this Terraform plan to build a test bed environment.

Following are the steps to onboard the global HTTPS load balancer:

Log in to your GPS console and create a health check for app1 and app2.
Create a Global HTTPS Load Balancer.
Create 2 frontend addresses on port TCP/80. Each frontend will map to a backend application.

Create a backend service for each application. Select the corresponding names port and health check for each application.

This is an example:

gcloud compute instance-groups set-named-ports vmseries \
   --region=us-central1 \
   --named-ports=app1:1000,app2:2000

gcloud compute backend-services create app1 \
   --load-balancing-scheme=EXTERNAL_MANAGED \
   --protocol=HTTP \
   --port-name=app1 \
   --health-checks=app1 \
   --connection-draining-timeout=300 \
   --global

gcloud compute backend-services add-backend app1 \
   --instance-group=vmseries \
   --instance-group-region=us-central1 \
   --balancing-mode=RATE \
   --max-rate-per-instance=10000 \
   --global

gcloud compute backend-services create app2 \
   --load-balancing-scheme=EXTERNAL_MANAGED \
   --protocol=HTTP \
   --port-name=app2 \
   --health-checks=app2 \
   --connection-draining-timeout=300 \
   --global

gcloud compute backend-services add-backend app2 \
   --instance-group=vmseries \
   --instance-group-region=us-central1 \
   --balancing-mode=RATE \
   --max-rate-per-instance=10000 \
   --global

gcloud compute url-maps create global-https-lb \
   --default-service app1 \
   --global

gcloud compute target-http-proxies create global-https-lb-target-proxy \
   --url-map=global-https-lb \
   --global-url-map \
   --global

gcloud compute forwarding-rules create app1 \
   --load-balancing-scheme=EXTERNAL_MANAGED \
   --network-tier=PREMIUM \
   --target-http-proxy=global-https-lb-target-proxy \
   --ports=80 \
   --global

gcloud compute forwarding-rules create app2 \
   --load-balancing-scheme=EXTERNAL_MANAGED \
   --network-tier=PREMIUM \
   --target-http-proxy=global-https-lb-target-proxy \
   --ports=80 \
   --global

Configure the routing rules. Set the frontend address as the host to direct traffic to each backend.
On your VM-Series firewall web interface, create 2 NAT policies to map the named port to the correct destination.

Automation Example:

Here is a Terraform example that onboards a new backend service to an existing HTTP(s) load balancer. The PAN-OS Terraform provider creates a service object and NAT policy for the new service:

# Assign named port to instance group
resource "google_compute_instance_group_named_port" "main" {
 group = var.instance_group
 zone  = “us-central1-a”
 name  = "app2"
 port  = "2000"
}

# Create health check
resource "google_compute_health_check" "main" {
 name = "app2"
 tcp_health_check {
   port = "2000"
 }
}

#  Create backend service
resource "google_compute_backend_service" "main" {
 name                  = "app2"
 port_name             = "app2"
 load_balancing_scheme = "EXTERNAL_MANAGED"
 health_checks         = [google_compute_health_check.main.self_link]

 backend {
   balancing_mode        = "RATE"
   capacity_scaler       = 1
   group                 = var.instance_group
   max_rate_per_instance = "10000"
 }
}

# Create forwarding rule
resource "google_compute_global_forwarding_rule" "main" {
 name                  = "app2"
 load_balancing_scheme = "EXTERNAL_MANAGED"
 port_range            = "80"
 target                = var.global_lb_self_link
}

# Create VM-Series service object
resource "panos_service_object" "main" {
 name             = "app2"
 vsys             = "vsys1"
 protocol         = "tcp"
 destination_port = "2000"
}

# Create VM-Series NAT policy
resource "panos_nat_rule_group" "main" {
 provider         = panos
 position_keyword = "bottom"

 rule {
   name = "app2"

   original_packet {
     source_zones          = ["untrust"]
     destination_zone      = "untrust"
     destination_interface = "ethernet1/1"
     service               = panos_service_object.main.name
     source_addresses      = ["any"]
     destination_addresses = ["any"]
   }

   translated_packet {
     source {
       dynamic_ip_and_port {
         interface_address {
           interface = "ethernet1/2"
         }
       }
     }
     destination {
       dynamic_translation {
         address = "<ip-address>"
       }
     }
   }
 }
}

Configuring Global HTTP(s) Load Balancer with XFF Header

The Palo Alto Networks NGFW can read the XFF field and use the XFF IP address when enforcing security policy. Additionally, you can configure various logs and reports to display the XFF IP address along with the source IP address.

Following are the steps to add Client Source IP Header to HTTPS Load Balancer

Run the following gcloud command to add the client’s source IP address as a custom header. Replace <backend-services> with your backend service that contains the VM-Series instance group.
```
gcloud compute backend-services update <backend-service> \
    --global \
    --custom-request-header='X-Forwarded-For:{client_ip_address}'
```
Your HTTPS load balancer’s custom request headers should like the image below:
In your VM-Series web interface, go to Device > Setup > Content-ID >X-Forwarded-For Headers.
Set Use X-Forwarded-For Header to Enabled for Security Policy.
Commit the changes.

The following are the steps to view the Custom Header in Traffic Logs:

Go to Monitor > Traffic.
Add the X-Forward-For IP log field to view the client IP address.
Curl your web server through the HTTPS load balancer.
The traffic logs should now contain your client source IP address under the X-Forwarded-For IP column.

Secure Boot Support for VM-Series on GCP

Autoscaling the VM-Series Firewall on Google Cloud Platform

VM-Series Firewall Docs

Configuring GCP Load Balancer

VM-Series Firewall Docs

Configuring GCP Load Balancer

Onboarding External Load Balancer

Onboarding Global HTTPS Load Balancer

Configuring Global HTTP(s) Load Balancer with XFF Header

Activation and Onboarding

Next-Generation Firewalls

Cloud-Delivered Security Services

Network Security

Endpoints

Resources