Focus

VM-Series Deployment Guide

Onboarding External Load Balancer

Table of Contents

Onboarding External Load Balancer

The external TCP load balancer distributes TCP/UDP traffic from the internet to the VM-Series firewall. Internal applications can be onboarded by creating a forwarding rule for each application. Here, we will onboard two applications by allocating frontend IPs to an external TCP load balancer.

Before you begin, you need the following:

The IPs of the backend applications (i.e. app1: 10.1.0.10, app2: 10.2.0.10).
If you do not have an environment, use this Terraform plan to build a test bed environment.

Following are the steps to onboard external TCP load balancer:

Configure the backend service.

Here is an example:

gcloud compute health-checks create tcp vmseries-hc \
   --request=/php/login.php \
   --port=80 \
   --region=us-central1

gcloud compute backend-services create vmseries-external-lb \
   --load-balancing-scheme=EXTERNAL \
   --protocol=TCP \
   --health-checks=vmseries-hc \
   --health-checks-region=us-central1 \
   --region=us-central1

gcloud compute backend-services add-backend vmseries-external-lb \
   --instance-group=vmseries-us-central1-a \
   --instance-group-zone=us-central1-a \
   --region=us-centrall

Create a forwarding rule for each application.

gcloud compute forwarding-rules create app1 \
   --load-balancing-scheme=EXTERNAL \
   --region=us-central1 \
   --ports=ALL \
   --backend-service=vmseries-external-lb

gcloud compute forwarding-rules create app2 \
   --load-balancing-scheme=EXTERNAL \
   --region=us-central1 \
   --ports=ALL \
   --backend-service=vmseries-external-lb

Click Create.
On your VM-Series firewall web interface, create two NAT policies to IP map the load balancer forwarding rule address to the correct internal application.

You can see the following details in your traffic logs:

Automation Example:

Below is a Terraform code sample that automates the manual steps above.

A forwarding rule is created on an existing external TCP load balancer. The forwarding rule address is used within the VM-Series NAT policy to map to a backend application.

# Create GCP LB forwarding rule 

resource "google_compute_forwarding_rule" "default" {
 name                  = "my-forwarding-rule"
 target                = var.target
 region                = "us-central1"
 load_balancing_scheme = "EXTERNAL"
 all_ports             = true
}

# Create VM-Series NAT policy

resource "panos_nat_rule_group" "main" {
 provider         = panos
 position_keyword = "bottom"

 rule {
   name = "my-nat-policy"

   original_packet {
     source_zones          = ["untrust"]
     destination_zone      = "untrust"
     destination_interface = "ethernet1/1"
     service               = "any"
     source_addresses      = ["any"]
     destination_addresses = ["${google_compute_forwarding_rule.default.ip_address}"]
   }

   translated_packet {
     source {
       dynamic_ip_and_port {
         interface_address {
           interface = "ethernet1/2"
         }
       }
     }
     destination {
       dynamic_translation {
         address = "<ip-address>"
       }
     }
   }
 }

Configuring GCP Load Balancer

Onboarding Global HTTPS Load Balancer