Deploy the VM-Series Firewall from the Azure Marketplace
The following instructions describe how to deploy the solution template for the VM-Series firewall that is available in the Azure® Marketplace and the Azure Government Marketplace. To use the customizable Azure Resource Manager (ARM) templates available in the GitHub repository, see Use the ARM Template to Deploy the VM-Series Firewall.
All VM-Series firewall interfaces must be assigned an IPv4 address when deployed in a public cloud environment. IPv6 addresses are not supported.
- Set up an Azure account.
- If you don’t have one already, create a Microsoft® account.
- Log in to the Azure portal (https://portal.azure.comorhttps://portal.azure.us) using your Microsoft account credentials.If you are using a trial subscription, you may need to open a support request () to increase the quota of allocated VM cores.Help + SupportNew Support Request
- Find the VM-Series solution template in the Azure Marketplace.
- Select.MarketplaceVirtual Machines
- Search for Palo Alto Networks® and a list of offerings for the VM-Series firewall will display. For the differences in the BYOL (bring your own license) and PAYG (pay as you go) models, see VM-Series Firewall Licenses for Public Clouds.
- Select an offering toCreatea new VM-Series firewall.
- Deploy the firewall.
- Configure basic settings for the firewall.
- Select your AzureSubscription.
- Create a new resource group or select an existing resource group that is empty. The resource group will hold all the resources associated with the VM-Series firewall for this deployment.Azure has removed the option to select an existing resource group for Marketplace solutions that enable multiple network interface controllers (NICs). To deploy the firewall into an existing resource group, use the ARM template in the GitHub Repository or use your own custom ARM template.
- Select the AzureRegionin which you are deploying the firewall.
- Enter aUsernamefor the firewall administrator.
- Select theAuthentication type—Password or SSH Public Key.You must enable SSH key authentication if you plan to use the firewall in FIPS-CC operational mode. Although you can deploy the VM-Series firewall using a username and password, you will be unable to authenticate using the username and password after changing the operational mode to FIPS-CC. After resetting to FIPS-CC mode, you must use the SSH key to log in and can then configure a username and password that you can use for subsequently logging in to the firewall web interface. For details on creating the SSH key, refer to the Azure documentation.
- Enter aPassword(up to 31 characters) or copy and paste anSSH public keyfor securing administrative access to the firewall.
- Configure networking.
- Select an existing Azure Virtual Network (VNet) or create a new one and enter the IP address space for the VNet. By default, the Classless Inter-Domain Routing (CIDR) IP address is 10.8.0.0/16.
- Configure the subnets for the network interfaces.If you use the default subnets, you must review the configuration. If you use an existing VNet, you must have set up three subnets: one each for the management,trust, and untrust interfaces. If you create a new VNet, verify or change the prefixes for each subnet. The default subnets are 10.8.0.0/24 for the management subnet, 10.8.1.0/24 for the untrust subnet, and 10.8.2.0/24 for the trust subnet.
- Enter the source IP address or IP range (include the CIDR block) that can access the VNet.Network Security Group: inbound source IPallows you to restrict inbound access to the Azure VNet.Restrict access to the firewall. Make sure to supply a CIDR block that corresponds to your dedicated management IP addresses or network. Do not make the allowed source network range larger than necessary and never configure the allowed source as 0.0.0.0/0. Verify your IP address before you configure it on the template to make sure that you do not lock yourself out.
- Define management access to the firewall.
- Use the default variable ((new) fwMgmtPublicIP)) to assign aPublic IP addressto the management interface (eth0) of the firewall.Azure accelerated networking is not supported on the management interface.
- Enter a prefix to access the firewall using a DNS name. You must combine the prefix you enter with the suffix displayed on screen to access the web interface of the firewall. For example:<yourname><your-region>.cloudapp.azure.com
- Select latestVM-Series Version.
- Enter a display name to identify the VM-Series firewall within the resource group.
- Add the information to configure the firewall at launch. See Bootstrap the VM-Series Firewall on Azure.
- SelectyestoEnable Bootstrap.
- Enter theStorage Account Namethat holds the Bootstrap Package.
- Enter theStorage Account Access Key. This firewall needs this access key to authenticate to the storage account and access the files stored within.
- Add theFile share nameto which you have uploaded the files required for bootstrapping the firewall. The storage account must be in the same region in which you are deploying the firewall and it must have the correct folder structure for bootstrapping.
- Verify that you have successfully deployed the VM-Series firewall.
- Selectand select the resource group.DashboardResource Groups
- Select your resource group and see theOverviewfor detailed status on which resources are deployed successfully.
- Attach a public IP address for the untrust interface of the VM-Series firewall. When you create a new public IP address, you get one from the block of IP addresses that Microsoft owns, so you can’t choose a specific one. The maximum number of public IP addresses you can assign to an interface is based on your Azure subscription.
When you attach a secondary IP address to a network interface, the VM-Series firewall does not automatically acquire the private IP address assigned to the interface. You will need to manually configure the private IP address using the VM-Series firewall web interface. See Configure the dataplane network interfaces as Layer 3 interfaces on the firewall.
- On the Azure portal, select the network interface for which you want to add a public IP address (such as theeth1interface).
- Selectand, for Public IP address, selectIP ConfigurationsAddEnabled. Create a new public IP address or select one that you have available.
- Verify that you can view the secondary IP address associated with the interface.
- Log in to the web interface of the firewall.
- On the Azure portal, inAll Resources, select the VM-Series firewall and view the full DNS name for the firewall.
- Using a secure (https) connection from your web browser, log in to the DNS name for the firewall.
- Enter the usernamepassword that you defined in the parameters file. You will see a certificate warning but that is OK—continue to the web page.
- Activate the licenses on the VM-Series firewall.For the BYOL version
For the PAYG version
- On the firewall web interface, selectand selectDeviceLicensesActivate feature using authentication code.
- Enter the capacity authentication code (auth-code) that you registered on the support portal. The firewall will connect to the update server (updates.paloaltonetworks.com), and download the license and reboot automatically.
- Log back in to the web interface and confirm the following on theDashboard:
- A valid serial number displays inSerial#.If the termUnknowndisplays, it means the firewall is not licensed. To view traffic logs on the firewall, you must install a valid capacity license.
- TheVM Modedisplays as Microsoft Azure.
- Configure the dataplane network interfaces as Layer 3 interfaces on the firewall.If you are hosting multiple websites or services with different IP addresses and SSL certificates on a single server, you might need to configure more than one IP address on the VM-Series firewall interfaces.
- Clickethernet 1/1and configure as follows:
- SetInterface TypetoLayer3(default).
- On theConfigtab, assign the interface to the default router.
- Also on theConfigtab, expand theSecurity Zonedrop-down and selectNew Zone. Define a new zone calledUnTrust, and then clickOK.
- On theIPv4tab, selectDHCP Clientif you