Configure AWS Warm Pools for VM-Series Auto Scaling Groups

Table of Contents

VM-Series Integration with AWS Warm Pool

Simplified Onboarding of VM-Series Firewall on AWS

Configure AWS Warm Pools for VM-Series Auto Scaling Groups

Accelerate VM-Series firewall scaling in AWS using warm pools. Reduce boot times to 90 sec for continuous security and rapid traffic handling.

Leveraging AWS Warm Pools significantly reduces the time required for VM-Series firewalls to scale out and become ready to inspect traffic, improving application availability and performance during traffic surges.

Deploy your AWS Auto Scaling Group (ASG) with Warm Pool configuration.
Configure the warm pool settings within your ASG. The Warmed:Running state ensures the firewall is fully booted and ready to receive configuration, which is essential for rapid scale-out.
1. Navigate to EC2 > Auto Scaling groups and click the ASG on which you wish to configure the warm pool.
2. Click Actions > Edit in the warm pool section.
3. Select Running in the warm pool instance state drop-down and click Save changes.
Create the necessary IAM role and attach the required permissions to your VM-Series instances.
1. Navigate to EC2 > Instances > click the required instance on which you wish to create the IAM role.
2. Create an IAM role that you will attach to your VM-Series instances.
3. Attach a custom policy to this role with the Create the necessary IAM role.
Configure two mandatory lifecycle hooks for your Auto Scaling Group.
1. Click Create Lifecycle Hook in the ASG page.
  1. Set Lifecycle transition to Instance Launch.
  2. Set Default result to CONTINUE.
  3. Configure Heartbeat timeout to allow sufficient time for firewall configuration and content push. This timeout should be equal to the time it takes for the configuration to be pushed to the device and can range from 5 to 20 minutes (for example, 600-1200 seconds), depending on the size and complexity of your security policy. A heartbeat timeout of at least 600 seconds (10 minutes) is recommended.
2. Create a Terminate Lifecycle Hook:
  1. Set Lifecycle transition to Instance Terminate.
  2. Set Default result to ABANDON.
  3. Configure Heartbeat timeout (for example, 300 seconds) to allow for any necessary cleanup tasks, such as releasing public IPs. A default of 30 seconds is generally sufficient for termination as no delicensing is performed by the firewall.
Monitor your VM-Series instance logs in AWS CloudWatch for provisioning and operational status.
1. Navigate to CloudWatch > Logs > Log groups in the AWS console.
2. Search for the log group named PaloAltoNetworksFirewalls.
3. Within this log group, locate log streams. Click the required instance ID. All warm pool specific logs are pushed to this designated CloudWatch log group, allowing you to easily track the lifecycle and health of your VM-Series instances. Per instance ID, only one stream is created, which contains all transition logs.