Deploy Palo Alto in Azure

There are many ways to deploy Palo Alto Firewall in Azure. Out of those options today I will discuss how Palo Alto can be configured to protect your Azure workload. This setup is suitable for Proof of Concept only.

Planning-Includes Minimum Requirement - Without HA

Logical Diagram: 

Create Virtual Network

Name: PAN-VNet
Address Space: 10.0.0.0/16
Subnet Name: Management
Subnet Address Space: 10.0.1.0/24

Subnet Name: Untrust
Subnet Address Space: 10.0.2.0/24

Subnet Name: Trust
Subnet Address Space: 10.0.3.0/24

Resource Group: PA-VNet

 

 Subnet

Spin Web Server Virtual Machine 

Name: SecureWebServices
Image: Windows Server 2016
Resource Group: Services
Network: PAN-VNet
Subnet: Trust
Role: Web Server (IIS) Installed

Change NSG rules of Web Server to accept request on port 80, if you wish to test the web request. However, later on, this behaviour will be controlled through firewall.

Spin Palo Alto Firewall Virtual Machine

Name: vmseries300
Image: VM-Series Next Generation Firewall (BYOL)
Storage Account: PANStorage
Network: PAN-VNet
Subnet: Match with the Existing subnet
Mgmt = Mgmt
Untrust = Untrust
Trust = Trust

Assign Public IP to xxxxxx-Eth1 - Untrust Interface

Apply DefaultNSG, which had been created while deploying Firewall Virtual Machine to all interface

Configuration of Palo Alto Firewall

Access Palo Alto Firewall via browser :
https://<PAFirewall VM Public address on Azure NIC eth0-Management>
Apply License: Device/Licenses/License Management and click the Activate feature using authorization code (Palo Alto Support Account is required for this)

Create Zone

Network> Zone: Create UnTrust and Trust Zone

Setup Interface

Network>Interface:

For Ethernet1/1
Virtual Route: Default
Security Zone: UnTrust
IPv4 tab: Type: Static
IPv4 tab: Address: Private IP address assigned by Azure in CIDR notation

For Ethernet1/2
Virtual Route: Default
Security Zone: Trust
IPv4 tab: Type: Static
IPv4 tab: Address: Private IP address assigned by Azure in CIDR notation

Configure Virtual Router 

Network> Virtual Router and Open Default
Add Static Route
Name: Default
Destination: 0.0.0.0/0
Interface: Ethernet1/1
Next Hop Type: IP Address
Value: The UnTrust network number with a .1 (UnTrust IP: so, Value= 10.0.2.1-gateway of Untrust Subnet)

Configure Security and NAT for Web Server

- Public IP Address assigned to UnTrusted NIC Eth1 will be used to access Web Services running inside the SecureWebService Virtual Machine

Configure NAT

Policies>NAT- Add
Name: SecureWebServices
Original Packet Tab > Source Zone: Untrust
Original Packet Tab > Destination Zone: Untrust
Original Packet Tabe > Destination Address: Private IP of Eth1/1
Translated Packet Tab: Translated Address: Private IP Address of SecureWebServices NIC

Configure Security

Policy>Security> Add
Name: WebServicesInbound
Source Zone: Untrust
Destination Zone: Trust
Destination Address: Private IP Address of Eth1/1
Application: ms-rdp, web-browsing

Securing Azure VNet
By default, Azure allow inbound and outbound communication with within virtual network and outbound access to the Internet. In order to control the flow of incoming and outgoing traffic from Trust Interface, we will create NSG and enforce rules.

Create Network Security Group (NSG)

Name: TrustedNSG
Add Inbound and Outbound Rules

This will enable unrestricted communication with the services/resources attached to 10.0.3.0/24 address space. However, it can't communicate with other subnets within the network.

Now, associate it to the WebServices NIC

Change the Default Routes behaviour of Azure Network via Default Route

Create new Route Table
Name: TrustedRouting

Once deployment is completed, Open TrustedRouting Route Table.

Click at Routes
Add the following
Route Name: DefaultviaFirewall
Address Prefix: 0.0.0.0/0
Next Hop type: Virtual Appliances
Next Hop address: Private IP of Eth1/2(Trust Interface)

Click at Subnet:
Click at Associate
Choose PaloAltoNetwork
Subnet: Trust

Now, access Web Server using the Ethernet1/1 Public IP address of the Palo Alto Firewall.