Panorama - use c5.4xlarge (16CPU and 32 GB of RAM). This is okay for managment mode only. However, if you want Panorama mode, you will need 16 CPU and 32 RAM and Panorama will only detect the c5.4xlarge as having 31 GB of RAM even though it has 32. This will cause an annoying popup on every login. (NOTE: I didn't see this issue on PAN-OS 10.2.3)
AWS CLI command to get AMI for PAN-OS 10.1.7 in region eu-west-1.
aws ec2 describe-images --filters "Name=product-code,Values=6njl1pau431dv1qxipg63mvah" Name=name,Values=PA-VM-AWS*10.1.7* --region eu-west-1 --output json
Or, even better
aws ec2 describe-images --filters "Name=product-code,Values=6njl1pau431dv1qxipg63mvah" Name=name,Values=PA-VM-AWS*10.1.7* --region eu-west-1 --output json | grep ImageId | awk -F "\"" '{print $4}'
because –query Images.ImageId didn't work.
Values specifies BND1, BND2 or BYOL
vm-series-auto-registration-pin-id= vm-series-auto-registration-pin-value=
c5.12xlarge is more expensive but has 48vCPU and 96GB RAM.
request system system-mode panorama
show system info | match system-mode
Create the security and spoke VPCs
For each spoke VPC, create the “instances” subnet and the “tgw” subnet. You will want a “tgw” subnet in each availability zone.
Create security groups for each VPC. All “all traffic” from RFC1918.
Create Transit Gateway with ASN = ?. Make sure you clear “Default route table association” and “Default route table propagation”.
Create two transit gateway route tables called “security” and “spokes”
Each spoke VPC needs a custom route table to point 0.0.0.0/0 at the TGW. Associate that route table to the two “instance” subnets in the VPC.
Create security VPC
Create security subnets
Create a VPC Internet Gateway and then attach it to the security VPC
Create Transit Gateway Attachments for each spoke VPC. Make sure you peer with the two “tgw” subnets.
Create Transit Gateway Attachments for the secuirty VPC.
You must enable appliance mode on the attachments in the securi ty VPC in order to ensure that traffic routes through the same attachment zone even when the source an d destination of the traffic are in different zones. If appliance mode is not enabled, it is possibl e to have asymmetric traffic flowing through different firewalls, which the firewalls drop.
Associate Attachments to Route Tables
Edit 'spokes' TGW route table and create static route 0.0.0.0/0 pointing at the security attachment
Probably don't need this bit as we create the target group as we create the Load Balancer.
Create Target Group (under EC2 instead of VPC)
Create Gateway Load Balancer (under EC2 instead of VPC)
Create Endpoint Service (back in VPC)
Create Endpoint
Create VPC Route tables
Create Security Groups (remember to add the tag 'Name' at the end with the name.)
plugin-op-commands=aws-gwlb-inspect:enabletype=dhcp-client panorama-server=10.255.0.4 panorama-server-2=10.255.1.4 tplname=AWS-a stack dgname=AWS dns-primary=169.254.169.253 authcodes=XXXXXXXX vm-auth-key=123456789012345 plugin-op-commands=aws-gwlb-inspect:enable,aws-gwlb-associate-vpce:vpce- 0903806b111111111@ethernet1/1.1,aws-gwlb-associate-vpce:vpce-0a81d66a111111111@ ethernet1/1.1,aws-gwlb-overlay-routing:enable dhcp-accept-server-hostname=yes dhcp-accept-server-domain=yes
Create four Elastic Network Interfaces
MAKE SURE AFTER YOU CREATE THEM THAT YOU SELECT EACH INTERFACE ONE-BY-ONE AND DISABLE Source/Dest CHECK.
Attach the network interface. Private to eth1 and public to eth2. To make this happen, add private first and then add public.
Create four public IP addreses and associated with the mgmt and public interfaces of the firewalls.
Log in and configure the boxes if you haven't bootstrapped them to Panoram.
Launch Instance
View Network Interfaces and be sure that each interface has a name (use descriptions above).
Wait for instance to finish deploying
use elastic IP to connect to firewall over ssh (admin@ipaddress) and use the key from the key pair to authenticate.
configure set mgt-config users admin password putapasswordhere set deviceconfig system hostname panorama set deviceconfig system timezone Europe/London set deviceconfig system dns-setting servers primary 169.254.169.253 set deviceconfig system dns-setting servers secondary 1.1.1.1 set deviceconfig system ntp-servers primary-ntp-server ntp-server-address 0.uk.pool.ntp.org set deviceconfig system ntp-servers secondary-ntp-server ntp-server-address 1.uk.pool.ntp.org commit exit request license api-key set key <key> request license fetch auth-code <authcode>
Do main config. Eth1/1 is Trust. DHCP and don't accept default route. Find default gateway looking at the runtime DHCP data and then use that to create a route to it for 10.0.0.0/8 etc.
Eth1/2 is Untrust. DHCP and accept default route.
create eth1/1.1 in trust and vr-1 and dhcp (no auto route) and mgmt interface with ping and https.
request plugins vm_series aws gwlb inspect enable yes
To enable overlay routing, run the following on the cli of each firewall.
request plugins vm_series aws gwlb overlay-routing enable yes
On the VM, enable Cloud Watch monitoring (Device → VM-Series)
request plugins vm_series aws gwlb disassociate vpc-endpoint vpce-0415cb80111111111 interface ethernet1/1 request plugins vm_series aws gwlb disassociate vpc-endpoint vpce-0479d893222222222 interface ethernet1/1 request plugins vm_series aws gwlb associate vpc-endpoint vpce-0415cb222222222 interface ethernet1/1.1 request plugins vm_series aws gwlb associate vpc-endpoint vpce-0479d8222222222 interface ethernet1/1.1
request plugins vm_series aws gwlb overlay-routing enable yes
show plugins vm_series aws gwlb
000710007935
Create VPC Customer Gateway definition of remote IP Then create Virtual Private Gateway Create site-to-site VPN Connection
I made it IKE2 only on the site firewall.
Create and find out the public IP under tunnel > Tunnel details
Create VPN at third party site
Update transit gatewy attachment that was automatically created and make sure it is names correctly for readability (e.g. site1)
after adding panorama, had to add panorama vpc to TGW as a spoke. Also had to create association to panorama vpc in spoke attacment and a propogation to panorama on security attagement.
Remember - On the Palo firewalls, set the MTU of the VPN tunnel interface to 1427 and set the /30 IP address using the AWS downloadable config as a reference for which IP to use (it will probably be the higher IP in the /30).
Create a static route in the secuity route table on the TGW in AWS that points 192.168.0.0/16 to the site1 VPN attachment.
Secuity
Associations: vpc-security Propergations: vpc-web vpc-db vpc-management vpc-security vpn-site1 Routes: summary of web vpc should be visible thanks to propagations summary of db vpc should be visible thanks to propagations summary of management vpc should be visible thanks to propagations summary of security vpc should be visible thanks to propagations static route to Site 1 pointing at the site1 VPN object should be created
Spokes
Associations: vpc-web vpc-db vpc-management vpn-site1 Propergations: vpc-security Routes: summary of security vpc should be visible thanks to propagations static route 0.0.0.0/0 pointing at the security VPC should be created
When creating VPN with BGP to third party
Association = Who gets these routes
Propergations = What routes get installed
When we connect GlobalProtect firewalls via VPN to VPN gateway attached to TGW, we create a dedicated TGW Route Table and set