Use the ARM Template to Deploy the VM-Series Firewall

In addition to Marketplace based deployments, Palo Alto Networks provides a GitHub repository which hosts sample ARM templates that you can download and customize for your needs. ARM templates are JSON files that describe the resources required for individual resources such as network interfaces, a complete virtual machine or even an entire application stack with multiple virtual machines. ARM templates are for advanced users; refer to the Microsoft documentation on ARM Templates.

To simplify the deployment of all the required resources, the template includes two json files:

Template File —The azureDeploy.json is the main resources file that deploys all the components within the resource group. Parameters File —The azureDeploy.parameters.json is the file that includes the parameters required to successfully deploy the VM-Series firewall in the VNet. It includes details such as the virtual machine tier and size, username and password for the firewall, the name of the storage container for the firewall. You can customize this file for your Azure VNet deployment.

To help you deploy the firewall as a gateway for Internet-facing applications, the template provisions the VM-Series firewall, a database server, and a web server. The VNet uses the private non-routable IP address space 192.168.0.0/16. You can modify the template to use 172.16.0.0/12, or 10.0.0.0/8.

The ARM template also provides the necessary user-defined rules and IP forwarding flags to enable the VM-Series firewall to secure the Azure resource group. For the five subnets—Trust, Untrust, Web, and DB—included in the template, you have four route tables, one for each subnet with user defined rules for routing traffic to the VM-Series firewall.

Deploying VM-Series Firewall using the ARM Template

Use the ARM Template to Deploy the VM-Series Firewall
Download the ARM template from the GitHub repository.	Download and save the files to a local client: https://github.com/PaloAltoNetworks/azure
Create a Resource Group in Azure.	Log in to the Azure CLI using the command: azure login If you need help, refer to the Azure documentation on installing the CLI. Switch to Resource Manager mode using the command: azure config mode arm Create a resource group.
Deploy the ARM template.	Open the Parameters File with a text editor and modify the values for your deployment: Deploy the template in the resource group you created. azure group create -v -n “<YourResourceGroupName>” -l “<YourAzureLocation>” -d “<GiveASmallDeploymentLabel>” -f azureDeploy.json -e azureDeploy.parameters.json Check the progress/status of the deployment from the Azure CLI: azure group deployment show "<YourResourceGroupName>" “<YourDeploymentLabel>“ When the template is successfully deployed the ProvisioningState is Running . If the ProvisioningState is Failed , you must check for errors on the Azure portal at Resource Group > Events. Filter for only events in the last one hour, select the most recent events, and drill down to find the errors. Verify that you have successfully deployed the VM-Series firewall. Select Dashboard >Resource Groups, select the resource group. Select All Settings > Deployments > Deployment History for detailed status.
The address space within the VNet uses the prefix 192.168, which is defined in the ARM template.
Configure the firewall as a VNet gateway to protect your Internet-facing deployment.	Log in to the management interface IP address on the firewall. Configure the dataplane network interfaces as Layer 3 interfaces on the firewall ( Network > Interfaces > Ethernet). Add static rules to the virtual router on the firewall. To route traffic through the firewall in this example, you need three static routes on the firewall ( Network > Virtual Routers, select the router and click Static Routes): Route all outbound traffic through the UnTrust zone, ethernet1/1 to the Azure router at 192.168.1.1. Route all inbound traffic destined to the web server subnet through the Trust zone, ethernet1/2 to the Azure router at 192.168.2.1. Route all inbound traffic destined to the database server subnet through the Trust zone, ethernet1/2 to the Azure router at 192.168.2.1. Create security policy rules ( Policies > Security) to allow inbound and outbound traffic on the firewall. You also need security policy rules to allow appropriate traffic from the web server subnet to the database server subnet and vice versa. Commit the changes on the firewall. Verify that the VM-Series firewall is securing traffic ( Monitor > Logs > Traffic).

Document:VM-Series Deployment Guide

Use the ARM Template to Deploy the VM-Series Firewall

Related Documentation

Document:VM-Series Deployment Guide

Use the ARM Template to Deploy the VM-Series Firewall

Related Documentation

About the VM-Series Firewall in Azure

VM-Series Firewall in Microsoft Azure

Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)

Deploy the VM-Series Firewall in Azure (Solution Template)

VM-Series and Azure Application Gateway Template

Set up the VM-Series Firewall in Azure

Start Using the VM-Series & Azure Application Gateway Template

Deployments Supported in Azure

Deploy the VM-Series and Azure Application Gateway Template

Bootstrap the VM-Series Firewall in Azure