Launch the VM-Series Firewall Template

1. Review the checklist for Plan the VM-Series Auto Scaling Template for AWS (v2.0).
   Make sure that you have completed the following tasks:

   • (For PAYG only) Reviewed and accepted the EULA for the PAYG bundle you plan to use.
   • (For BYOL only) Obtained the auth code. You need to enter this auth code in the /license folder of the bootstrap package.
   • Downloaded the files required to launch the VM-Series Auto Scaling template from the GitHub repository.
2. Modify the init-cfg.txt file. You must add the device certificate auto-registration PIN to the init-cfg.txt file to automatically install a device certificate when your VM-Series firewall instance is deployed.
   vm-series-auto-registration-id=

   vm-series-auto-registration-pin-value=

   For more details read about the bootstrapping process and the init-cfg.txt file.

   If you’re using Panorama to manage the firewalls, complete the following tasks:
   1. Generate the VM Auth Key on Panorama. The firewalls must include a valid key in the connection request to Panorama. Set the lifetime for the key to 8760 hours (1 year).
   2. Open the init-cfg.txt file with a text editor, such as Notepad. Make sure that you do not alter the format as this causes a failure in deploying the VM-Series Auto Scaling template. Add the following information as name-value pairs:
      • IP addresses for the primary Panorama and optionally a secondary Panorama. Enter:
        panorama-server=
        panorama-server-2=
      • Specify the template stack name and the device group to which you want to assign the firewall. Enter:
        tplname=
        dgname=
      • VM auth key. Enter:
        vm-auth-key=
   3. Verify that you have not deleted the command for swapping the management interface (mgmt) and the dataplane interface (ethernet 1/1) on the VM-Series firewall on AWS. For example, the file must include name-value pairs as shown here:
      op-command-modes=mgmt-interface-swap

      vm-auth-key=755036225328715

      panorama-server=10.5.107.20

      panorama-server-2=10.5.107.21

      tplname=FINANCE_TG4

      dgname=finance_dg
   4. Save and close the file.
3. (For BYOL only) Add the license auth code in the /license folder of the bootstrap package. For more information see Prepare the Bootstrap Package.
   1. Create a new .txt file with a text editor, such as Notepad.
   2. Add the authcode for your BYOL licenses to this file,then save the file with authcodes (no file extension) and upload it to the /license folder. The auth code must support the number of firewalls that may be required for your deployment. You must use an auth code bundle instead of individual auth codes so that the firewall can simultaneously fetch all license keys associated with a firewall. If you use individual auth codes instead of a bundle, the firewall retrieves only the license key for the first auth code included in the file.

4. Change the default credentials for the VM-Series firewall administrator account defined in the bootstrap.xml file.
   Required for using the VM-Series Auto Scaling template in a production environment.

   The bootstrap.xml file in the GitHub repository is provided for testing and evaluation only. For a production deployment, you must Customize the Bootstrap.xml File (v2.0) prior to launch.
5. Prepare the Amazon Simple Storage (S3) buckets for launching the VM-Series Auto Scaling template to a production environment.
   Make sure to create the S3 buckets in the same region in which you plan to deploy the template; the bootstrapping files hosted in the public S3 bucket are provided only to make it easier for you to evaluate the template.
   1. Create a new S3 bucket for the bootstrap files.
      1. Sign in to the AWS Management Console and open the S3 console.
      2. Click Create Bucket.
      3. Enter a Bucket Name and a Region, and click Create. The bucket must be at the S3 root level. If you nest the bucket, bootstrapping fails because you cannot specify a path to the location of the bootstrap files.
   2. Upload the bootstrap files to the S3 bucket. The bootstrap folders must be in the root folder of the S3 bucket.
      1. Click the name of bucket and then click Create folder.
      2. Create the following folder structure for bootstrapping.

      3. Click the link to open the config folder.
      4. Select ActionsUpload and Add Files, browse to select the init-cfg.txt file and bootstrap.xml file, and click Open.
      5. Click Start Upload to add the files to the config folder. The folder can contain only two files: init-cfg.txt and the bootstrap.xml.

      6. (For BYOL only) Click the link to open the license folder and upload the txt file with the auth code required for licensing the VM-Series firewalls.

   3. Upload the AWS Lambda code (panw-aws.zip file) to an S3 bucket. In this example, the AWS Lambda code is in the same S3 bucket as the bootstrap package.
      1. Click the bucket name.
      2. Click Add Files to select the panw-aws.zip file, click Open.
      3. Click Start Upload to add the zip file to the S3 bucket.

6. Select the firewall template.
   If you need to Customize the Firewall Template Before Launch (v2.0), do that now and select the modified template.
   1. In the AWS Management Console, select CloudFormationCreate Stack.
   2. Select Upload a template to Amazon S3, choose the firewall-v2.0.template and click Open and Next.
   3. Specify the Stack name. The stack name allows you to uniquely identify all the resources that this template deploys.
7. Configure the parameters for the VPC.
   1. Enter the parameters for the VPC Configuration as follows:
      1. Enter a VPCName.
      2. Select the two Availability Zones that your setup spans in Select two AZs.
8. Select your preferences for the VM-Series firewalls.
   1. Look up the AMI ID for the VM-Series firewall and enter it. Make sure that the AMI ID matches the AWS region, PAN-OS version and the BYOL or PAYG licensing option you opted to use.
   2. Select the EC2 Key pair (from the drop-down) for launching the firewall. To log in to the firewalls, you must provide the name of this key pair and the private key associated with it.
   3. Restrict SSH access to the firewall’s management interface. Make sure to supply a CIDR block that corresponds to your dedicated management IP addresses or network. Do not make the allowed source network range larger than necessary and do not ever configure the allowed source as 0.0.0.0/0. Verify your IP address before configuring it on the template to make sure that you do not lock yourself out.
   4. Select Yes if you want to Enable Debug Log. Enabling the debug log generates more verbose logs that help with troubleshooting issues with the deployment. These logs are generated using the stack name and are saved in AWS CloudWatch.
   By default, the template uses CPU utilization as the scaling parameter for the VM-Series firewalls. Custom PAN-OS metrics are automatically published to the CloudWatch namespace that matches the stack name you specified earlier.
9. Specify the name of the Amazon S3 bucket(s).
   You can use one S3 bucket for the bootstrap package and the zip file.

   1. Enter the name of the S3 bucket that contains the bootstrap package.
      If the bootstrap bucket is not set up properly or if you enter the bucket name incorrectly, the bootstrap process fails and you cannot be able to log in to the firewall. Health checks for the load balancers also fail.
   2. Enter the name of the S3 bucket that contains the panw-aws.zip file.
10. Specify the keys for enabling API access to the firewall and Panorama.
    1. Enter the key that the firewall must use to authenticate API calls. The default key is based on the sample bootstrap.xml file and you should only use it for testing and evaluation. For a production deployment, you must create a separate PAN-OS login just for the API call and generate an associated key.
    2. Enter the API Key to allow AWS Lambda to make API calls to Panorama, if you are using Panorama for centralized management. For a production deployment, you should create a separate login just for the API call and generate an associated key.
    3. Copy and paste the license deactivation API key for your account. This key is required to successfully deactivate licenses on your firewalls when a scale-in event occurs. To get this key:
       1. Log in to the Customer Support Portal.
       2. Select AssetsAPI Key Management.
       3. Copy the API key.
11. Enter the name for the application load balancer.
12. (Optional) Apply tags to identify the resources associated with the VM-Series Auto Scaling template.
    Add a name-value pair to identify and categorize the resources in this stack.
13. Review the template settings and launch the template.
    1. Select I acknowledge that this template might cause AWS CloudFormation to create IAM resources.
    2. Click Create to launch the template. The CREATE_IN_PROGRESS event displays.
    3. On successful deployment the status updates to CREATE_COMPLETE.

       Unless you customized the template, the VM-Series Auto Scaling template launches an ASG that includes one VM-Series firewall in each AZ, behind the application load balancer.
14. Verify that the template has launched all required resources.
    1. On the AWS Management Console, select the stack name to view the Output for the list of resources.

    2. On the EC2 Dashboard, select Auto Scaling Groups. Verify that in each AZ, you have one ASG for the VM-Series firewalls with the one firewall in each ASG. The ASG name prefix includes the stack name.
    3. Log in to the VM-Series firewall. You must deploy a jump server or use Panorama to access the web interface on the firewall.
       • It can take up to 20 minutes for the firewalls to boot up and be available to handle traffic.
       • When you finish testing or a production deployment, the only way to ensure charges stop occurring is to completely delete the stack. Shutting down instances, or changing the ASG maximum to 0 is not sufficient.
15. Save the following information. You need to provide these values as inputs when deploying the application template.
    • IP addresses of the NAT Gateway in each AZ. You need this IP address to restrict HTTP access to the web servers if you deploy the application in a different VPC. Specifying this IP address ensures that the firewall secures access your applications in a different VPC, and that nobody can bypass the firewall to directly access the web server. The sample application template (panw_aws_nlb_vpc-2.0.template) displays a template validation error if you do not enter the NAT Gateway IP addresses; you must enter the IP addresses as a comma-separated list.
    • Network Load Balancer SQS URL. An AWS Lambda function in the firewall stack monitors this queue so that it can learn about any network load balancers that you deploy, and create NAT policy rules (one per application) on the VM-Series firewalls that enable the firewalls to send traffic to the network load balancer IP address.