Launch the VM-Series Firewall in OCI

Select
Compute
Instances
and click
Create Instance
.
Enter a descriptive
Name
for your VM-Series firewall instance.
Select an
Availability Zone
.
Select your VM-Series image file.
Select
Change Image Source
Custom Images
.
Select your VM-Series image file.
Click
Select Image
.
Select
Virtual Machine
under
Shape Type
.

Select the shape with the number of CPUs, amount of RAM, and number of interfaces required for the VM-Series firewall model. See the Compute Shapes page for the amount resources provided by the different compute shapes. See VM-Series Systems Requirements for more information about the resources required for each VM-Series firewall model.

Under Networking, select your
Virtual cloud network compartment
,
Virtual cloud network
,
Subnet compartment
, and
Subnet
for your management interface.

Click
Create Instance
.
(
optional
) If you need more storage than the minimum 60GB required by the VM-Series firewall, you can create and attach a storage volume to your VM-Series firewall instance.
Select

Storage

Block Volumes

Create Block Volume

.

Select your compartment.

Enter a descriptive

Name

for your block storage volume.

Select an

Availability Zone

.

Enter the size for your block volume.

Click

Create Block Volume

.



Select

Compute

Instances

, click on your newly-created instance, and select

Attached Block Volumes

Attach Block Volume

.

Select

Paravirtualized

.

Select your compartment.

Select the block volume you created previously from the Block Volume drop-down.

Select

Read/Write

.

Click

Attach

.

Reboot the VM-Series firewall instance by clicking

Reboot

on the Instance Details page.


Attach a vNIC to your VM-Series firewall instance for each subnet your created previously.
Select your newly launched VM-Series firewall instance and select
Attached VNICs
Create VNIC
.
Enter a descriptive
Name
for your vNIC.
Select your VCN from the
Virtual Cloud Network
drop-down.
Select your subnet from the
Subnet
drop-down.
Specify a
Private IP Address
. This is only required if your want to choose a particular IP for the vNIC. If you do not specify an IP, OCI will assign an IP address from the CIDR block you assigned to the subnet.
Select
Assign Public IP Address
for public facing vNICs such as your untrust subnet.
Click
Create VNIC
.
Repeat this procedure for each vNIC your deployment requires.

Assign a private IP address to your trust subnet.
Select
Networking
Virtual Cloud Networks
<your VCN>
Route Tables
<your trust route table>
Edit Route Rules
.
Change the Target Type to
Private IP
.
Enter the IP address you assigned to your trust vNIC.
Click
Save
.

Change the default password through a console connection to the firewall.
Configure a console connection.
Generate a public key and copy it.
Log in to the OCI console.
Select
Compute
Instances
and click your VM-Series firewall instance.
Select
Console Connections
Create Console Connection
Paste SSH Keys
.
Paste your key and click
Create Console Connection
.

Open a console connection to the VM-Series firewall.
Select
Connect with SSH
.

Copy the string used to open the console connection to the VM-Series firewall.

Open a terminal on your computer and, from the directory containing your keypair, paste the string you copied above and hit Enter.
Change the password.
Enter config mode.
admin@PA-VM> configure
Execute the following command to change the password. When prompted, enter your new password and enter it again to confirm.
admin@PA-VM# set mgt-config users admin password
Commit your changes.
Disable DPDK on the firewall. The VM-Series firewall on OCI supports Packet MMAP only. DPDK is enabled by default and must be disabled.
Log in to the firewall CLI.
Disable DPDK.
admin@PA-VM> set system setting dpdk-pkt-io off
Restart the firewall.
Add route table rules to the management route table to give yourself SSH and web interface access to the firewall.
Select
Networking
Virtual Cloud Networks
and click your VCN.
Select
Route Tables
and click your management route table.
Select
Edit Route Rules
+ Another Route Rule
.
Select your compartment.
Enter a descriptive
Name
for your route table.
Select a target type. For subnets that are publicly accessible, select Internet Gateway.
Enter a
Destination CIDR Block
.
Select the internet gateway you created previously from the
Target Internet Gateway
drop-down.
Click Create
Save
.

Edit security lists to give yourself SSH and web interface access to the firewall.
From your VCN, select
Security Lists
mgmt-security-list
Edit All Rules
.
mgmt-security-list is the default name used in the Terraform Template file. If you have changed this value, locate you management security list.
Select CIDR from the
Source Type
drop-down and
Source CIDR
block.
Select TCP from the
IP Protocol
drop-down.
(Optional) Enter source and destination ports or port ranges. If you leave these fields blank, all ports are allowed. Port 22 is required for SSH access and port 443 is required for SSL access to the firewall web interface.
Click
Create Security List
.

Configure the dataplane network interfaces as Layer 3 interfaces on the firewall.
Log in to the firewall.
Select
Network
Interfaces
Ethernet
.
Click the link for
ethernet 1/1
and configure as follows:
Interface Type
:
Layer3
On the
Config
tab, assign the interface to the default router.
On the
Config
tab, expand the
Security Zone
drop-down and select
New Zone
. Define a new zone, for example untrust-zone, and then click
OK
.
On the
IPv4
tab, select either
Static
.
Click
Add
in the IP section and enter the IP address and network mask for the interface. Make sure that the IP address matches the IP address that you assigned to the corresponding subnet in VCN. For example, if you add this interface to your untrust zone, make sure you assign the untrust vNIC IP address configured in your VCN.
Repeat this procedure for each vNIC configured in your VCN except your management vNIC.
Always only delete interfaces at the bottom of the interface list. Deleting firewall interfaces in the wrong order results in a interface mismatch between the firewall and OCI. For example, say you have five data interfaces, then delete interface two on the firewall and add a new interface at the bottom. After rebooting the firewall, the newly added interface will take the place of the deleted interface two instead of taking a place at the bottom of the list.
Create NAT rules to allow inbound and outbound traffic form the servers deployed in VCN.
Select
Policies
NAT
on the web interface of the firewall.
Create a NAT rule that allows traffic from the external-facing or untrust dataplane network interface on the firewall to the trust interface in the VCN.
Create a NAT rule that allows outbound access for traffic from inside the VCN to the internet.