Deploy the VM-Series Firewall
After registering the VM-Series firewall as a service
(Palo Alto Networks NGFW) on the NSX Manager and creating security groups
and steering rules, complete the following tasks on the NSX Manager.
- Define an IP Address Pool (Required only if the management interface is not configured for DHCP)
- Prepare the ESXi Host for the VM-Series Firewall
- Deploy the Palo Alto Networks NGFW Service
- Enable Large Receive Offload
Support for vMotion of guest virtual machines in the vSphere/NSX
Environment
When a guest VM is vMotioned from one host to
another within a cluster, the target host NSX distributed firewall
will steer all new sessions to the VM-Series firewall on the destination
host. To ensure that all active (existing sessions) remain uninterrupted during
and after the guest vMotion, the NSX Manager polls the VM-Series
firewall for existing allowed sessions and then shares these sessions
with the NSX distributed firewall on the destination host. All existing
sessions that were allowed by the original VM-Series will be allowed by
the NSX distributed firewall (filtering module) on the destination
host without steering to the target host VM-Series firewall to prevent
session loss.
The VM-Series firewall runs as a service on
each host of the cluster and therefore is never vMotioned.
Related Documentation
VM-Series Firewall for NSX Deployment Checklist
VM-Series Firewall for NSX Deployment Checklist To deploy the VM-Series firewall for NSX, use the following workflow: Step 1: Set up the Components —To deploy ...
Steer Traffic from Guests that are not Running VMware Tools
Steer Traffic from Guests that are not Running VMware Tools VMware Tools contains a utility that allows the NSX Manager to collect the IP address(es) ...
Set Up the VM-Series Firewall on VMware NSX
Set Up the VM-Series Firewall on VMware NSX The VM-Series firewall for VMware NSX is jointly developed by Palo Alto Networks and VMware. This solution ...
Integrated Policy Rules
Integrated Policy Rules Panorama serves as the single point of configuration that provides the NSX Manager with the contextual information required to redirect traffic from ...
Panorama > VMware NSX
Panorama > VMware NSX To automate the provisioning of a VM-Series NSX edition firewall, you must enable communication between the NSX Manager and Panorama. When ...
Create Steering Rules
Create Steering Rules Panorama > VMware NSX > Steering Rules Steering rules determine what traffic from which guests in the cluster is steered to the ...
How Do the Components in the VM-Series Firewall for NSX Solution Work Together?
How Do the Components in the VM-Series Firewall for NSX Solution Work Together? To meet the security challenges in the software-defined data center, the NSX ...
Create Security Groups and Steering Rules in an Operations Centric Deployment
Create Security Groups and Steering Rules in an Operations Centric Deployment In an operations-centric deployment, you create security groups and traffic redirection rules on the ...