Use the ARM Template to Deploy the VM-Series Firewall
In addition to Marketplace based deployments, Palo Alto Networks provides a GitHub repository which hosts sample ARM templates that you can download and customize for your needs. ARM templates are JSON files that describe the resources required for individual resources such as network interfaces, a complete virtual machine or even an entire application stack with multiple virtual machines.
ARM templates are for advanced users, and Palo Alto Networks provides the ARM template under the community supported policy. To learn about ARM templates, refer to the Microsoft documentation on ARM Templates.
To simplify the deployment of all the required resources, the two-tier sample template (https://github.com/PaloAltoNetworks/azure/tree/master/two-tier-sample) includes two json files:
- Template File—The azureDeploy.json is the main resources file that deploys all the components within the resource group.
- Parameters File—The azureDeploy.parameters.json is the file that includes the parameters required to successfully deploy the VM-Series firewall in the VNet. It includes details such as the virtual machine tier and size, username and password for the firewall, the name of the storage container for the firewall. You can customize this file for your Azure VNet deployment.
To help you deploy the firewall as a gateway for Internet-facing applications, the template provisions the VM-Series firewall, a database server, and a web server. The VNet uses the private non-routable IP address space 192.168.0.0/16. You can modify the template to use 172.16.0.0/12, or 10.0.0.0/8.
The ARM template also provides the necessary user-defined rules and IP forwarding flags to enable the VM-Series firewall to secure the Azure resource group. For the five subnets—Trust, Untrust, Web, DB, and NAT—included in the template, you have five route tables, one for each subnet with user defined rules for routing traffic to the VM-Series firewall and the NAT virtual machine.
For the four subnets—Trust, Untrust, Web, and DB—included in the template, you have four route tables, one for each subnet with user defined rules for routing traffic to the VM-Series firewall.
- Download the two-tier sample ARM template from the GitHub repository.Download and save the files to a local client: https://github.com/PaloAltoNetworks/azure/tree/master/two-tier-sampleFor Azure China: github.com/PaloAltoNetworks/Azure-China
- (Only for Azure China) Copy the VHD image for the VM-Series firewall to your Azure storage account.
- Create a Resource Group on Azure.
- Log in to the Azure CLI using the command:azure login
- Switch to Resource Manager mode using the command:azure config mode arm
- Create a resource group.
- Deploy the ARM template.
- Open the Parameters File with a text editor and modify the values for your deployment:In Azure China, you must edit the path for the storage account that hosts the VHD image required to deploy the VM-Series firewall. In the variables section of the template file, find the parameter calleduserImageNameURIand replace the value with the location where you saved the VHD image.
- Deploy the template in the resource group you created.azure group create -v -n “<YourResourceGroupName>” -l “<YourAzureLocation>” -d “<GiveASmallDeploymentLabel>” -f azureDeploy.json -e azureDeploy.parameters.jsonCode copied to clipboardUnable to copy due to lack of browser support.
- Check the progress/status of the deployment from the Azure CLI:azure group deployment show "<YourResourceGroupName>" “<YourDeploymentLabel>“Code copied to clipboardUnable to copy due to lack of browser support.When the template is successfully deployed theProvisioningState is Running.If theProvisioningState is Failed, you must check for errors on the Azure portal at. Filter for only events in the last one hour, select the most recent events, and drill down to find the errors.Resource GroupEvents
- Verify that you have successfully deployed the VM-Series firewall.
- Select, select the resource group.DashboardResource Groups
- Selectfor detailed status.All SettingsDeploymentsDeployment HistoryThe address space within the VNet uses the prefix 192.168, which is defined in the ARM template.
- Attach a public IP address to the untrust interface on the firewall.
- Configure the firewall as a VNet gateway to protect your Internet-facing deployment.
- Log in to the management interface IP address on the firewall.
- Configure the dataplane network interfaces as Layer 3 interfaces on the firewall ().NetworkInterfacesEthernet
- Add static rules to the virtual router on the firewall. To route traffic through the firewall in this example, you need three static routes on the firewall (, select the router and clickNetworkVirtual RoutersStatic Routes):
- Route all outbound traffic through the UnTrust zone, ethernet1/1 to the Azure router at 192.168.1.1.
- Route all inbound traffic destined to the web server subnet through the Trust zone, ethernet1/2 to the Azure router at 192.168.2.1.
- Route all inbound traffic destined to the database server subnet through the Trust zone, ethernet1/2 to the Azure router at 192.168.2.1.
- Create security policy rules () to allow inbound and outbound traffic on the firewall. You also need security policy rules to allow appropriate traffic from the web server subnet to the database server subnet and vice versa.PoliciesSecurity
- Committhe changes on the firewall.
- Verify that the VM-Series firewall is securing traffic ().MonitorLogsTraffic
VM-Series Firewall Templates on Azure
VM-Series Firewall Templates on Azure You can deploy the VM-Series firewall on Azure using templates. Palo Alto Networks provides two kinds of templates—Solution templates and ...
Deploy the VM-Series Firewall on Azure Stack
Azure Stack is Microsoft’s Azure cloud within your own datacenter. Deploy the firewall to secure your workloads in your Azure Stack (on-premise) implementation and shift ...
Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)
Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template) The following instructions show you how to deploy the solution template for the VM-Series ...
Azure Security Center Integration
Forward firewall logs to the Azure Security Center dashboard for a consolidated view on the security of your Azure deployment. Use this view to assess ...
Use Azure Security Center Recommendations to Secure Your Workloads
Based on a recommendation from the Azure Security Center dashboard, you can either deploy a new instance of the VM-Series firewall or connect your existing ...
Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)
Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template) The following instructions describe how to deploy the solution template for the VM-Series firewall that ...
Integration with Azure Security Center
View high-priority firewall logs as security alerts on the Azure Security Center dashboard with the default Azure Security Center Log Forwarding profile. ...
Start Using the VM-Series & Azure Application Gateway Template
Start Using the VM-Series & Azure Application Gateway Template The VM-Series & Azure Application Gateway template launches all the resources you need to deploy and ...
About the VM-Series Firewall on Azure
About the VM-Series Firewall on Azure The VM-Series firewall on Azure must be deployed in a virtual network (VNet) using the Resource Manager deployment mode. ...