Deploy the VM-Series Firewall in a Multi-NSX Manager Environment

1. Install the VMware NSX Plugin version 2.0 as it allows you to connect up to 16 NSX Managers. This version of the plugin allows you to add more than one Service Manager to your VM-Series firewall for NSX configuration on Panorama.
2. Enable Communication Between the NSX Manager and Panorama.

   

3. Create Template(s) and Device Group(s) on Panorama. Device groups and template stacks push the security policy and network settings to the VM-Series firewalls in each ESXi cluster.
   When configuring policy rules and objects, verify that you have selected the correct device group.

   

   When configuring network and device settings, verify that you have selected the correct template stack.

   

4. Create the Service Definitions on Panorama and attach them to the service manager. Each service definition can reference one device group and one template stack. Panorama supports up to 32 service definitions across all service managers.

   

5. Configure dynamic address groups or security groups and redirect traffic to the VM-Series firewall.
   • For security-centric deployments Set Up Dynamic Address Groups on Panorama and Create Steering Rules on Panorama.
   • For operations-centric deployments Set Up Security Groups on the NSX Manager and Create Steering Rules on NSX Manager.
   Verify that you have selected the correct device group so the right steering rules are sent to the corresponding NSX Manager.
6. Deploy the Palo Alto Networks NGFW Service on each ESXi cluster by using the relevant service definitions.

   

7. Repeat this process for each NSX Manager.
   1. Select PanoramaVMware NSXService Managers and click Add.
   2. Enable Communication Between the NSX Manager and Panorama.