Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)

The following instructions show you how to deploy the solution template for the VM-Series firewall that is available in the Azure Marketplace. To use the customizable ARM templates available in the GitHub repository, see Use the ARM Template to Deploy the VM-Series Firewall.

Set up an Azure account.
Create a Microsoft account.
Log in to the Azure portal (
https://portal.azure.com
) using your Microsoft account credentials.
If you are using a trial subscription, you may need to open a support request (
Help + Support
New Support Request
) to increase the quota of allocated VM cores.
Find the VM-Series solution template in the Azure Marketplace.
Select
Azure Marketplace
Virtual Machines
.
Search for Palo Alto Networks. The offerings for the VM-Series firewall display. For the differences in the BYOL and PAYG models, see VM-Series Firewall in Amazon Web Services (AWS) and Azure Licenses.

Select an offering and click
Create
.
Deploy the firewall.
Configure basic settings for the firewall.

Enter a
Username
for the firewall administrator.
Enter a
Password
(of up to 31 characters) or copy and paste an
SSH public key
for securing administrative access to the firewall.
Select your Azure
Subscription
.
Create a new resource group for holding all the resources associated with the VM-Series firewall for this deployment.
Azure has removed the option to select an existing resource group for Marketplace solutions that enable multiple NICs. To deploy the firewall into an existing resource group, use the ARM template in the GitHub Repository or your own custom ARM template.
Select the Azure
Location
. This is the region in which you are deploying the firewall.

Configure storage and networking.

Select an existing storage account or create a new one.
Select an existing VNet or create a new one, and enter the IP address space for the VNet. By default the CIDR is 10.0.0.0/16.
Configure the subnets for the network interfaces. If you use an existing VNet, you must have defined three subnets, one each for the management, trust and untrust interfaces. If you create a new VNet, verify or change the prefixes for each subnet. The default subnets are 10.0.0.0/24 for the management subnet, 10.0.1.0/24 for the untrust subnet, and 10.0.2.0/24 for the trust subnet.
Enter the source IP address or IP range (include CIDR) that can access the VNet.
Network Security Group: inbound source IP
allows you to restrict inbound access to the Azure VNet.

Define management access to the firewall.

Use the default variable (new PublicIP) to assign a
Public IP address
to the management interface (eth0) of the firewall.
Enter a prefix to access the firewall using a DNS name. You must combine the prefix you enter with the suffix displayed on screen for example <yourname>centralus.cloudapp.azure.com to access the web interface of the firewall.
Enter a display name to identify the VM-Series firewall within the resource group.
Select the Azure virtual machine tier and size to meet your needs. See Minimum System Requirements for the VM-Series on Azure.

Review the summary, accept the terms of use and privacy policy, and click

Create

to deploy the firewall.

Verify that you have successfully deployed the VM-Series firewall.

Select

Dashboard

Resource Groups

, select the resource group.

Select

All Settings

Deployments

Deployment History

for detailed status


Attach a public IP address for the untrust interface of the VM-Series firewall. When you create a new public IP address you get one from the block of IP addresses Microsoft owns, so you can’t choose a specific one. The maximum number of public IP addresses you can assign to an interface is based on your Azure subscription.
On the Azure portal, select the network interface for which you want to add a public IP address. For example the eth1 interface.
Select
IP Configurations
Add
and for Public IP address, select
Enabled
. Create a new public IP address or select one that you have available.
Verify that you can view the secondary IP address associated with the interface.

When you attach a secondary IP address to a network interface, the VM-Series firewall does not automatically acquire the private IP address assigned to the interface. You will need to manually configure the private IP address using the VM-Series firewall web interface. See Configure the dataplane network interfaces as Layer 3 interfaces on the firewall.
Log in to the web interface of the firewall.
On the Azure portal, in
All Resources
, select the VM-Series firewall and view the full DNS name for the firewall.

Using a secure connection (https) from your web browser, log in to the DNS name for the firewall.
Enter the username/password you defined in the parameters file. You will see a certificate warning; that is okay. Continue to the web page.
Activate the licenses on the VM-Series firewall.
For the BYOL version
Create a Support Account.
Register the VM-Series Firewall (with auth code).
On the firewall web interface, select
Device
Licenses
and select
Activate feature using authentication code
.
Enter the capacity auth-code that you registered on the support portal. The firewall will connect to the update server (updates.paloaltonetworks.com), and download the license and reboot automatically.
Log back in to the web interface and confirm the following on the
Dashboard
:
A valid serial number displays in
Serial#
.
If the term Unknown displays, it means the device is not licensed. To view traffic logs on the firewall, you must install a valid capacity license.
The
VM Mode
displays as Microsoft Azure.
For the PAYG version
Create a Support Account.
Register the Usage-Based Model of the VM-Series Firewall in AWS and Azure (no auth code).
Configure the dataplane network interfaces as Layer 3 interfaces on the firewall.
If you are hosting multiple websites or services with different IP addresses and SSL certificates on a single server, you might need to configure more than one IP address on the VM-Series firewall interfaces.
With the support for multiple public IP address for the firewall interfaces, the NAT VM is no longer required. If you have an existing deployment that uses the NAT VM, reassign the public IP address from the NAT VM to the untrust interface on the firewall, and then delete the NAT VM, the UDR, and subnet.
Select
Network
Interfaces
Ethernet
.
Click the link for
ethernet 1/1
and configure as follows:
Interface Type
: Layer3 (default).
On the Config tab, assign the interface to the default router.
On the
Config
tab, expand the
Security Zone
drop-down and select New Zone. Define a new zone called UnTrust, and then click OK.
On the
IPv4
tab, select
DHCP Client
if you plan to assign only one IP address on the interface. The private IP address assigned in the ARM template will be automatically acquired. If you plan to assign more than one IP address select
Static
and manually enter the primary and secondary IP addresses assigned to the interface on the Azure portal.
Clear the
Automatically create default route to default gateway provided by server
check box. Disabling this option ensures that traffic handled by this interface does not flow directly to the default gateway in the VNet.
Click the link for
ethernet 1/2
and configure as follows:
Set
Interface Type
to Layer3 (default).
Security Zone
: Trust
IP address
: Select
DHCP Client
or
Static
.
Clear the
Automatically create default route to default gateway provided by server
check box. Disabling this option ensures that traffic handled by this interface does not flow directly to the default gateway in the VNet.
Click
Commit
. Verify that the link state for the interfaces is up.
Add a stati c route on the virtual router of the VM-Series firewall for any networks that the firewall needs to route.
For example, to add a default route to the destination subnets for the servers that the firewall secures:
Select
Network
Virtual Router
default
Select
Static Routes
IPv4
, and add the next hop IP address for the destination servers. You can set x.x.x.1 as the next hop IP address for all traffic (destined to 0.0.0.0/0 from interface ethernet1/1).
Configure the firewall for your specific deployment.
Gateway—Deploy a 3rd party load balancer in front of the UnTrust zone.
Hybrid and Inter-VNet—Deploy an Azure VPN Gateway or a NAT virtual machine in front the UnTrust zone.
Inter-Subnet—On the VM-Series firewall, add an intra-zone security policy rule to allow traffic based on the subnets attached to the Trust interface.
GlobalProtect—Deploy a NAT virtual machine in front of the UnTrust zone.
Direct traffic to the VM-Series firewall.
To ensure that the VM-Series firewall secures all traffic within the Azure resource group, configure static routes on the firewall.
Configure UDRs to direct all traffic through the interfaces on the VM-Series firewall. Refer to the Azure documentation on UDRs for details.
The UDRs on the internal subnets must send all traffic through the Trust interface. The UDRs on the UnTrust side direct all traffic from the Internet through the UnTrust interface on the VM-Series firewall. The traffic from the Internet may be coming from an Azure Application Gateway or Azure Load Balancer, or through the Azure VPN Gateway in case of a hybrid deployment that connects your on-premises network with the Azure cloud.