What Components Does the VM-Series Auto Scaling Template
for AWS Deploy (Version 1.2 and earlier)?
The VM-Series Auto Scaling template for AWS versions 1.2 and earlier provide two deployment options. The first option offers the flexibility to deploy a complete AWS environment along with the auto scaling tier of VM-Series firewalls in one streamlined workflow. The second option allows you to deploy only the auto-scaling tier of VM-Series firewalls into your existing AWS deployment.
The VM-Series Auto Scaling template for AWS does not deploy Panorama, and Panorama is optional in this solution.
If you want to use Panorama to manage the VM-Series firewalls that the solution deploys, you can either use an M-Series appliance inside your corporate network, or a Panorama virtual appliance on a VMware ESXi server inside your corporate network or in vCloud Air; you cannot deploy Panorama on AWS.
The VM-Series Auto Scaling template for AWS includes the following building blocks that make these options possible:
The VPC templates automate the process of deploying a VPC with two or three Availability Zones (AZs). It deploys an external ELB, a web server farm and an internal ELB that load balances traffic to the web server farm. In addition to the subnets, route tables, and security groups required for routing traffic across these AZs, it also creates the Auto Scaling Group (ASG) for the web server farm and an AWS NAT gateway, if you opt for one.
Depending on your preference for the internal ELB, you can choose from these two templates:
Both templates, deploy the classic ELB for internet-facing traffic.
The VPC template invokes the
firewall.templateto launch the VM-Series firewall.
If you have an existing VPC with the required subnets, security groups, web servers, and ELBs, and want to only deploy the VM-Series firewall at scale, you can use the firewall.template instead of the vpc.template.
The firewall.template creates an initial ASG with a single VM-Series firewall to secure the web servers in each AZ, adds the ENIs for the trust and management interfaces, and triggers the bootstrap process including registration with Panorama. To enable auto scaling of the VM-Series firewalls, this template leverages PAN-OS metrics from the VM-Series firewall and publishes data on your preferred metric to AWS CloudWatch.
You can select one of the following PAN-OS metrics—active sessions, dataplane CPU utilization, or dataplane CPU buffer utilization.
AWS Lambda provides robust, event-driven automation without the need for complex orchestration software. In this template, AWS Lambda monitors the custom PAN-OS metrics and the internal ELB to enable dynamic scaling of the VM-Series firewalls. The Lambda functions add or remove elastic network interfaces (ENIs) when the firewall is launched or terminated, collect and publish CloudWatch metrics so that you can define auto scaling policy using CloudWatch alarms, delete all the associated resources when an instance is terminated or the stack is deleted, and remove the firewall as a managed device on Panorama. The Lambda functions also monitor the VIP addresses on the internal ELB so that it can add or remove an ASG for the VM-Series firewall so that it can ensure a 1:1 ratio between the internal ELB VIP and the VM-Series firewalls ASG.
The bootstrap.xml file provided in the GitHub repository is provided for testing and evaluation only. For a production deployment, you must modify the bootstrap.xml prior to launch. See Customize the Bootstrap.xml File.
This solution requires the init-cfg.txt file and the bootstrap.xml file so that the VM-Series firewall has the basic configuration for handling traffic from the ELB.
To deploy the solution, see Launch the VM-Series Auto Scaling Template for AWS.
Recommended For You
Recommended videos not found.