paloaltonetworks / azure-autoscaling

Azure autoscaling solution using VMSS

Palo Alto Networks Azure-Autoscaling Gallery

Gallery (https://gallery.pan.dev/) is a separate forum used to appropriately structure and organize repositories. Easier method of searching Repositories and maintaining each Repository.

Auto Scaling the VM-Series-firewall on Azure

Palo Alto Networks now provides templates to help you deploy an auto-scaling tier of VM-Series firewalls using several Azure services such as Virtual Machine Scale Sets, Application Insights, Azure Load Balancers, Azure functions, Panorama and the Panorama plugin for Azure, and the VM-Series automation capabilities including the PAN-OS API and bootstrapping. The templates allow you to leverage the scalability features on Azure that are designed to manage sudden surges in demand for application workload resources by independently scaling the VM-Series firewalls with the changing workloads.

History

Version 1.1 - Sep 2020

The release of version 1.1 is provided as a community supported, i.e. best effort, release. You can consider this as an open beta to introduce new features and collect feedback for improving the generally available release that will be officially supported.

Azure Auto Scale Template 1.1 introduces two new options for your VM-Series firewall on Azure autoscaling deployment.

• Application Insight Resource Region—in the inbound and hub templates, you can now specify the region for your Application Insight Resource. A new drop-down has been added to the template that allows you to specify the region. See Parameters in the Auto Scaling Templates for Azure for more information.

• Hardware-Based VM-Series Model PAYG License—beginning with PAN-OS 9.1.3, a PAYG license applies a VM-Series capacity license based on the hardware allocated to the instance. the PAYG instance checks the amount of hardware resources available to the instance and applies the largest VM-Series firewall capacity license allowed for the resources available. See VM-Series Firewall Licenses for Public Clouds for more information.

Version 1.0 - Feb 2019

The initial release of version 1.0 is provided as a community supported, i.e. best effort, release. You can consider this as an open beta to introduce new features and collect feedback for improving the generally available release that will be officially supported.

Version 1.0.0-6 GA Release - July 2019

This release is now generally available. The hub and inbound template, as well as the infra template, is released under the official support policy of Palo Alto Networks through the support options that you've purchased, for example Premium Support, support teams, or ASC (Authorized Support Centers) partners and Premium Partner Support options. The support scope is restricted to troubleshooting for the stated/intended use cases and product versions specified in the project documentation and does not cover customization of the scripts or templates.

The application template is Community Supported.

Only projects explicitly tagged with "Supported" information are officially supported. Unless explicitly tagged, all projects or work posted in our GitHub repository or sites other than our official Downloads page are provided under the best effort policy.

Proceed with Caution:

These repositories contain default password information and should be used for Proof of Concept purposes only. If you wish to use this template in a production environment it is your responsibility to change the default passwords.

azure-autoscaling's Issues

Regions not showing up

Regions for US East 2 and Central not showing up as options. Tried to track down location parameter variables and could not find a reference.

infra and inbound script bugs

Describe the bug

1. The infra script has "East US" hard coded for appinsight.
2. The inbound script will not deploy to an existing vnet, if the existing vnet is a in a different resource group than the firewalls. It will also deploy appinsight to East US, and not to the region selected.

Expected behavior

1. appinsight should be deployed to the region selected
2. inbound script should be capable of deploying to a vnet that exists in different resource group, this is a very common scenario

Current behavior

1. As described above, appinsight for infra script will always deploy in "East US", no matter what region is selected
2. If existing vnet option is selected for deployment, and the existing vnet is in a different resource group the deployment fails during vnet execution

Possible solution

1. Update the infra script with a region variable selected, rather then having the region hardcoded
2. I believe the inbound script fails because if vnet exists in a different resource group you must specify what that resource group is, and the current script does not allow for that. It tries to deploy to the region selected for the firewalls

Steps to reproduce

1. Execute infra script and select region any other then East US
2. Build a vnet with subnets that exists in a different resource groups to where the firewalls will be. Execute inbound script, create new resource group, and attempt to deploy to existing vnet previously created

[Community Health Assessment] Changes needed

This issue was opened by a bot called Community Health (PANW) because this repo has failed too many community health checks.

Repo maintainers: Please take the time to fix the issues in the table to reach the target score. These improvements will help others find your work and contribute to it. This issue will update as your score improves until it hits the target score.

Click More info for instructions to fix each item.

Health Check	Pass	Score	More Info
Contains a meaningful README.md file	✅	20 / 20	More info
SUPPORT.md file exists	❌	0 / 20	More info
Repo has a description	✅	15 / 15	More info
Has a recognized open source license	❌	0 / 15	More info
Has a descriptive repo name	✅	15 / 15	More info
Required topics attached to repo	❌	0 / 15	More info
CONTRIBUTING.md file with contribution guidelines	❌	0 / 5	More info
Has custom issue and pull request templates	❌	0 / 5	More info

Current score: 50
Target threshold: 100
Total possible: 110

Exisiting Vnets

We have existing vnets defined and dont need no new vnets to get deployed.
Can you help me out with that

Unable to change the image version

Unable to change the image version other than (8.1.0 or latest). Tried to change in the Parameter and gives an error while creating. Even tried to remove the whole allowedValues section (lines 66-69). Still give then same error.

Service Bus

Service Bus does not seem to create a Queue.

I deployed Infra, and Hub and it didn't seem to create the Queue