PaloAlto Networks VM-100 Guida di riferimento rapido

Palo Alto Networks®

VM-Series Deployment Guide

PAN-OS 6.0

Contact Information

Corporate Headquarters:

Palo Alto Networks

4401 Great America Parkway

Santa Clara, CA 95054

http://www.paloaltonetworks.com/contact/contact/

About this Guide

This guide describes how to set up and license the VM-Series firewall; it is

intended for administrators who want to deploy the VM-Series firewall.

For more information, refer to the following sources:

PAN-OS Administrator's Guide– for instructions on configuring the

features on the firewall.

https://paloaltonetworks.com/documentation– for access to the

knowledge base, complete documentation set, discussion forums, and

videos.

https://support.paloaltonetworks.com– for contacting support, for

information on the support programs, or to manage your account or

devices.

For the latest release notes, go to the software downloads page at

https://support.paloaltonetworks.com/Updates/SoftwareUpdates.

To provide feedback on the documentation, please write to us at:

documentation@paloaltonetworks.com.

Palo Alto Networks, Inc.

www.paloaltonetworks.com

Palo Alto Networks, PAN-OS, and Panorama are trademarks of Palo Alto

Networks, Inc. All other trademarks are the property of their respective owners.

VM-Series Deployment Guide iii

Table of Contents

About the VM-Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1

VM-Series Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

VM-Series Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

License the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Create a Support Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

Register the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Activate the License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

Upgrade the PAN-OS Software Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Upgrade the VM-Series Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Set Up a VM-Series Firewall on an ESXi Server . . . . . . . . . . . . . . . . . . . . . . .9

Supported Deployments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

System Requirements and Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

Install a VM-Series firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Provision the VM-Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Perform Initial Configuration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Troubleshoot ESXi Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Basic Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Installation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

Licensing Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

Connectivity Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

Set Up a VM-Series Firewall on the Citrix SDX Server . . . . . . . . . . . . . . . . .21

About the VM-Series Firewall on the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

System Requirements and Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Supported Deployments. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Scenario 1—Secure North-South Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

Scenario 2—Secure East-West Traffic. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

Install the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Upload the Image to the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

Provision the VM-Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Secure North-South Traffic with the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Deploy the VM-Series Firewall Using L3 Interfaces. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

Deploy the VM-Series Firewall Using Layer 2 (L2) or Virtual Wire Interfaces. . . . . . . . . . . . . . . . . . . 33

Deploy the VM-Series Firewall Before the NetScaler VPX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

Secure East-West Traffic with the VM-Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

iv VM-Series Deployment Guide

Table of Contents

The VM-Series NSX Edition Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

VM-Series NSX Edition Firewall Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

What are the Components of the Solution? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42

How Do the Components Work Together?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

What are the Benefits of the Solution? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

Deploy the VM-Series NSX Edition Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

Create a Device Group and Template on Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

Deploy the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Create Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

VM-Series Deployment Guide 1

About the VM-Series Firewall

The Palo Alto Networks VM-Series firewall is the virtualized form of the Palo Alto Networks next-generation

firewall. It is positioned for use in a virtualized data center environment where it can protect and secure traffic

for private and public cloud deployments.

VM-Series Models

VM-Series Deployments

License the VM-Series Firewall

2VM-Series Deployment Guide

VM-Series Models

The VM-Series firewall is available in four models—VM-100, VM-200, VM-300, and VM-1000-HV.

All four models can be deployed as guest virtual machines on VMware ESXi and on Citrix NetScaler SDX; on

VMWare NSX, only the VM-1000-HV is supported. The software package (.xva or .ovf file) that is used to deploy

the VM-Series firewall is common across all models. The VM-Series model is driven by license; when you apply

the license on the VM-Series firewall, the model number and the associated capacities are implemented on the

firewall.

Each model can be purchased as an Individual or an Enterprise version. The Individual version is in multiples

of 1. The orderable SKU, for example PA-VM-300, includes an auth-code to license one instance of the

VM-Series firewall. The Enterprise version is available in multiples of 25. For example, the orderable SKU

PAN-VM-100-ENT has a single auth-code that allows you to register 100 instances of the VM-100.

Each model of the VM-Series firewall is licensed for a maximum capacity. Capacity is defined in terms of the

number of sessions, rules, security zones, address objects, IPSec VPN tunnels and SSL VPN tunnels that the

VM-Series firewall is optimized to handle. When purchasing a license, make sure to purchase the correct model

for your network requirements. The following table depicts some of the capacity differences by model:

Model Sessions Security

Rules Dynamic IP

Addresses Security Zones IPSec VPN

Tunnels SSL VPN

Tunnels

VM-100 50000 250 1000 10 25 25

VM-200 100000 2000 1000 20 500 200

VM-300 250000 5000 1000 40 2000 500

VM-1000-HV 250000 10000 100000 40 2000 500

VM-Series Deployment Guide 3

VM-Series Deployments

The VM-Series firewall can be deployed on the following platforms:

VM-Series for VMware vSphere Hypervisor (ESXi)

VM-100, VM-200, VM-300, or VM-1000-HV is deployed as guest virtual

machine on VMware ESXi; ideal for cloud or networks where virtual form

factor is required.

For details, see Set Up a VM-Series Firewall on an ESXi Server.

VM-Series for VMware NSX

The VM-1000-HV is deployed as a network introspection service with

VMware NSX, and Panorama. This deployment is ideal for east-west

traffic inspection.

For details, see The VM-Series NSX Edition Firewall

VM-Series for Citrix SDX

VM-100, VM-200, VM-300, or VM-1000-HV is

deployed as guest virtual machine on Citrix NetScaler

SDX; consolidates ADC and security services for

multi-tenant and Citrix XenApp/XenDesktop

deployments.

For details, see Set Up a VM-Series Firewall on the

Citrix SDX Server

4VM-Series Deployment Guide

License the VM-Series Firewall

When you purchase a VM-Series firewall, you receive a set of auth-codes over email. Typically the email includes

a capacity auth-code for the model purchased (VM-100, VM-200, VM300, VM-1000-HV), a software and

support auth-code (for example, PAN-SVC-PREM-VM-100 SKU auth-code) that provides access to

software/content updates and support. If you purchased additional subscriptions for Threat Prevention, URL

Filtering, GlobalProtect, or WildFire, a list of the other auth-codes purchased with the order are included.

If you do not have an existing support account, you must use the capacity auth-code to register and create an

account on the support portal. After your account is verified and the registration is complete, you will be able

to log in and download the software package required to install the VM-Series firewall. If you have an existing

support account, you can access the VM-Series Authentication Code link on the support portal to manage your

VM-Series firewall licenses and download the software.

To license your VM-Series firewall, see the following sections:

Create a Support Account

Register the VM-Series Firewall

Activate the License

Upgrade the PAN-OS Software Version

Upgrade the VM-Series Model

For instructions on installing your VM-Series firewall, see VM-Series Deployments.

Create a Support Account

A support account is required to manage your VM-Series firewall licenses and to download the software package

required to install the VM-Series firewall. If you have an existing support account, continue with Register the

VM-Series Firewall.

If you have an evaluation copy of the VM-Series firewall and would like to convert it to a fully licensed

(purchased) copy, clone your VM-Series firewall and use the instructions to register and license the

purchased copy of your VM-Series firewall. For instructions, see Upgrade the VM-Series Model.

Create a Support Account

1. Log in to https://support.paloaltonetworks.com.

2. Click Register and fill in the details in the user registration form. You must use the capacity auth-code and the

purchase or sales order number to register and create an account on the support portal.

3. Submit the form. You will receive an email with a link to activate the user account; complete the steps to activate the

account.

After your account is verified and the registration is complete, you will be able to log in and download the software

package required to install the VM-Series firewall.

VM-Series Deployment Guide 5

Use the instructions in this section to register your capacity auth-code with your support account.

Activate the License

To activate the license on your VM-Series firewall, you must have deployed the VM-Series firewall and

completed initial configuration. For instructions to deploy the VM-Series firewall, see VM-Series Deployments.

Until you activate the license on the VM-Series firewall, the firewall does not have a serial number, the MAC

address of the dataplane interfaces are not unique, and only a minimal number of sessions are supported.

Because the MAC addresses are not unique until the firewall is licensed, to prevent issues caused by overlapping

MAC addresses, make sure that you do not have multiple, unlicensed VM-Series firewalls.

1. Log in to https://support.paloaltonetworks.com with your account credentials.

2. Select Assets and click Add VM-Series Auth-Codes.

3. In the Add VM-Series Auth-Code field, enter the capacity auth-code you received by email, and click the checkmark

to save your input. The page will display the list of auth-codes registered to your support account.

You can track the number of VM-Series firewalls that have been deployed and the number of licenses that are still

available for use against each auth-code. When all the available licenses are used, the auth-code does not display on

the VM-Series Auth-Codes page. To view all the assets that are deployed, select Assets > Devices.

6VM-Series Deployment Guide

When you activate the license, the licensing server uses the UUID and the CPU ID of the virtual machine to

generate a unique serial number for the VM-Series firewall. The capacity auth-code in conjunction with the serial

number is used to validate your entitlement.

Activate the License

• If your VM-Series firewall has direct Internet

access.

1. Select Device >Licenses and select the Activate feature using

authentication code link.

2. Enter the capacity auth-code that you registered on the support

portal. The firewall will connect to the update server

(updates.paloaltonetworks.com), and download the license and

reboot automatically.

3. Log back in to the web interface and confirm that the

Dashboard displays a valid serial number. If the term Unknown

displays, it means the device is not licensed.

4. On Device > Licenses, verify that PA-VM license is added to the

device.

• If your VM-Series firewall does not have Internet

access.

1. Navigate to Device > Licenses and click the Activate Feature

using Auth Code link.

2. Click Download Authorization File, and download the

authorizationfile.txt on the client machine.

3. Copy the authorizationfile.txt to a computer that has access to the

Internet and log in to the support portal. Click My VM-Series

Auth-Codes link and select the applicable auth-code from the

list and click the Register VM link.

4. On the Register Virtual Machine tab upload the authorization

file. This will complete the registration process and the serial

number of your VM-Series firewall will be attached to your

account records.

5. Navigate to Assets > My Devices and search for the VM-Series

device just registered and click the PA-VM link. This will

download the VM-Series license key to the client machine.

6. Copy the license key to the machine that can access the web

interface of the VM-Series firewall and navigate to Device >

Licenses.

7. Click Manually Upload License link and enter the license key.

When the capacity license is activated on the firewall, a reboot

occurs.

8. Log in to the device and confirm that the Dashboard displays a

valid serial number and that the PA-VM license displays in the

Device > Licenses tab.

Questo manuale è adatto per i seguenti modelli

Indice

Altri manuali PaloAlto Networks Firewall

PaloAlto Networks

PaloAlto Networks PA-7050 PAN-AIRDUCT Manuale utente

PaloAlto Networks

PaloAlto Networks PA-800 SERIES Guida all'applicazione

PaloAlto Networks

PaloAlto Networks ION 1000 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-5200 Series Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-220 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-220 Manuale utente

PaloAlto Networks

PaloAlto Networks M-300 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-400 Series Manuale utente

PaloAlto Networks

PaloAlto Networks PA-5000 Series Manuale operativo e di manutenzione

PaloAlto Networks

PaloAlto Networks PA-5200 Series Manuale utente

PaloAlto Networks

PaloAlto Networks ION 7000 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-5000 Series Manuale operativo e di manutenzione

PaloAlto Networks

PaloAlto Networks PA-5450 Manuale utente

PaloAlto Networks

PaloAlto Networks PA-3000 Series Manuale utente

PaloAlto Networks

PaloAlto Networks ION 1000 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-5400 Series Guida all'applicazione

PaloAlto Networks

PaloAlto Networks ION 3000 Guida all'applicazione

PaloAlto Networks

PaloAlto Networks PA-5200 Series Guida all'applicazione

PaloAlto Networks

PaloAlto Networks VM series Guida di riferimento rapido

PaloAlto Networks

PaloAlto Networks PA-220R Manuale utente

PaloAlto Networks

PaloAlto Networks PA-200 Manuale utente

PaloAlto Networks

PaloAlto Networks PA-410 Manuale utente

PaloAlto Networks

PaloAlto Networks PA-4000 Series Manuale operativo e di manutenzione

PaloAlto Networks

PaloAlto Networks PA-445 Manuale utente

Manuali Firewall popolari di altre marche

Cisco

Cisco S190 Manuale utente

Fortinet

Fortinet FortiGate Voice Series Manuale utente

ADTRAN

ADTRAN NetVanta 2300 Manuale utente

SecureLogix

SecureLogix ETM System Manuale utente

NETGEAR

NETGEAR ProSafe FVX538 Manuale utente

Lanner

Lanner FW-8877 Manuale utente

Huawei

Huawei USG6000 Series Manuale di installazione e funzionamento

H3C

H3C SecPath F5000-AI-15 Manuale utente

Nexcom

Nexcom DNA 1150 Manuale utente

Fortinet

Fortinet FortiGate-60 series Manuale utente

Cisco

Cisco 3110 Manuale

Draytek

Draytek Vigor2860 Series Manuale utente

Lanner electronics

Lanner electronics FW-7650 Series Manuale utente

Swisscom

Swisscom Internet Backup Manuale utente

SonicWALL

SonicWALL NSa 5700 Manuale utente

DPtech

DPtech FW1000 SERIES Manuale utente

FEITIAN

FEITIAN MultiPass FIDO Manuale utente

EBLOCKER

EBLOCKER PRO Manuale utente