VM-Series NSX Edition Firewall —Per Tenant Security Policy on Dedicated Infrastructure
|
Enable Communication Between the NSX Manager and Panorama.
|
This is one-time task and is required if you have not enabled access between the NSX Manager and Panorama.
|
|
Create Template(s), and Device Group(s) on Panorama.
|
Log in to the Panorama web interface.
Select
Panorama > Templates
to add templates. This use case has two template named NSX-Template-TOYOTA and NSX-Template-BMW.
Select
Panorama > Device Groups
and add device groups. This use case has two device groups named NSX-DG-BMW and NSX-DG-TOYOTA.
Create NSX service profile zones within each template. To isolate traffic for each tenant in this use case, you need three zones for each tenant.
Select
Network > Zones.
Select a template in the
Template
drop-down.
Select
Add
and enter a zone
Name. For example,
Tenant1.
Select the
Service Profile Zone for NSX
check box. This selection automatically sets the interface
Type
to
Virtual Wire. Click
OK.
Repeat the steps a-d to add additional zones for each sub-tenant.
Verify that the zones are attached to the correct template.
Repeat step
4
for the other template.
|
|
Create the Service Definitions on Panorama.
|
Select
Panorama > VMware Service Manager.
Select
Add
in the VMware Service Definition section. Fill in the details for the service definition for each tenant. In this example, the two service definitions are Palo Alto Networks - Toyota and Palo Alto Networks - BMW.
Click
Commit, and select
Panorama
as the
Commit Type
to save the changes to the running configuration on Panorama.
|
|
Prepare the ESXi Host for the VM-Series Firewall
|
The ESXi hosts in the cluster must have the necessary NSX components that allow the NSX firewall and the VM-Series firewall to work together. The NSX Manager will install the components— the Ethernet Adapter Module (.eam) and the SDK —required to deploy the VM-Series firewall.
|
|
Deploy the Palo Alto Networks NGFW Service
|
Select
Networking and Security > Installation > Service Deployments.
Click
New Service Deployment
(green plus icon), and select the service definition for the Palo Alto Networks next generation firewall you want to deploy,
Palo Alto Networks NGFW Test 1
in this example, make your selections and click
Finish.
Verify that the NSX Manager reports the
Installation Status
as
Successful.
Verify that the VM-Series firewall is successfully deployed.
On the vCenter server, select
Hosts and Clusters
to check that every host in each cluster has one instance of the firewall.
View the management IP address(es) and the PAN-OS version running on the firewall directly from vCenter server. VMware Tools is bundled with the PAN-OS software image and is automatically enabled when you launch the VM-Series firewall.
|
|
Define Policies on the NSX Manager
Do not apply the traffic redirection policies unless you understand how rules work on the NSX Manager as well as on the VM-Series firewall and Panorama. The default policy on the VM-Series firewall is set to deny all traffic, which means that all traffic redirected to the VM-Series firewall will be dropped.
|
Select
Networking and Security > Service Composer > Security Groups, and add new NSX Security Groups for each tenant’s virtual machines. For example, this use case has nine security groups for each tenant. Each sub-tenant has three security groups—one security group for the application servers, one for the database servers the third security group for the web servers.
Select
Networking and Security > Firewall > Configuration, and click
Partner Security Services, to set up redirection rules for sending traffic to the VM-Series firewall. You will select the service definition and the service profile associated with each tenant for which you want to redirect traffic.
The service profile names on the NSX Manager must match the zone names you defined in the template on Panorama.
|
|
Apply Policies to the VM-Series Firewall
|
Create dynamic address groups for each sub-tenant on Panorama. The dynamic address group(s) match on the name of the security group(s) you defined on the NSX Manager.
On Panorama, select
Objects > Address Groups.
Select a
Device Group
from the drop-down and click
Add.
Add a
Name
for the address group and set Type as
Dynamic
and
Add Match Criteria. For ease of managing these groups, use the same name for the dynamic address group as that of the security group on the NSX Manager.
Create the dynamic address groups for the sub-tenants for the other tenant, BMW in this example.
On Panorama, create Security policies and use the dynamic address groups as source or destination address objects in security policy rules and push it to the firewalls.
Select
Policies > Security > Pre Rules.
Select a
Device Group
from the drop-down and click
Add.
Create rules for each sub-tenant. Make sure to keep the source and destination zone the same in a policy rule. To ensure that only the application that is running on the server is allowed, allow the service on the application-default port only.
This use case has the following policy rules for the tenant Toyota:
|
|
|
|
|
Select the other
Device Group
from the drop-down and create the Security policies for the each sub-tenant for the other tenant, BMW in this example.
Click Commit, and select Commit Type as Device Groups. Select the device groups, NSX-DG-BMW and NSX-DG-TOYOTA in this example and click OK.
The commit pushes the Security policies to the firewalls that belong to each device group, and they can enforce policy on the traffic redirected by the NSX Manager.
|
|
Verify that traffic from each tenant is secured.
|
On Panorama, go to
Monitor > Logs > Traffic
and
Monitor > Logs > Threat
to view the Traffic logs and Threat logs. Select the device group for a tenant and sort on the Zone name for full visibility in to traffic from each sub-tenant.
On Panorama, use the ACC for visibility into traffic patterns and actionable information on threats. Use the widgets and filters to interact with the data on the ACC.
On the VM-Series firewall, select
Objects > Address Groups
to view the IP address for the members of each Dynamic Address Group.
|
|
|
|
(Optional) Enable role-based access for tenant administrators to manage the configuration and policies for the VM-Series firewalls.
|
Create an access domain. An access domain allows you to restrict admin access to a specific device group and template. In this example, you create two access domains and restrict access to the device group and template for the respective tenant.
Configure an admin role
for
Device Group and Template
role and allow the administrator to manage the access domain. The administrator can only manage the firewalls that belong to the access domain.
Create an administrative account
and associate the access domain and admin role with the account.
|
|
|
