Supporting Palo Alto Networks Firewalls in CloudStack. April 10, 2014

Transcription

1 Supporting Palo Alto Networks Firewalls in CloudStack April 10, 2014

2 Introductions Syed Ahmed CloudOps CloudOps builds and operates clouds of all shapes and sizes Develops cloud infrastructure solutions and operational models 24x7x365 managed service for CloudStack based cloud infrastructures Customers are global Based in Montreal, Canada

3 To be covered Palo Alto Networks firewall appliance integration Feature overview Challenges and decisions

4 Motivations for Palo Alto integration CloudStack virtual router: For Advanced Networking it often handles NAT, LB, FW, VPN in addition to DHCP, DNS. Great approach for horizontally scaled commodity networking services BUT can be a bottleneck and a bit of a black box security wise

5 More reasons why Customer driven - Palo Alto is an increasingly popular enterprise security product Many enterprises require greater visibility and advanced policies (i.e. content filtering, heuristics, intrusion detection) Use cases: Enterprise private clouds, PCI compliance, service providers to enterprise

6 Resulting network services CloudStack Virtual Router DHCP DNS Palo Alto Service Provider Source NAT Firewall Rules (Ingress & Egress) Static NAT Port Forwarding

7 Overview of the implementation

8 Pre-configure the Palo Alto device Setup a Virtual Router on the Palo Alto to handle the routing of the Public traffic Setup a Static Route for the next hop

9 Pre-configure the Palo Alto device Setup the Public and Private interfaces on the PA Pre-configure the Public interface according to the Public IP range in CS

10 Add the PA as a service provider Add the PA device as a guest network service provider Enable the provider

11 Create a Network Offering Expose the PA through a network offering PA provides: Source NAT, Static NAT, Port Forwarding and Firewall services Enable the new offering

12 Use the Palo Alto Add a network using the service offering Launch a VM on the new network

13 What actually happened A Source NAT IP is allocated on ae1 A guest network has been setup on ae2 A Source NAT rule now connects the guest network to the public IP A policy isolates the guest network

14 Egress firewall rules

15 Ingress firewall rules

16 Static NAT rules

17 Port Forwarding rules

18 Support for Palo Alto profiles Added support for Palo Alto Networks Security Profile Groups and Log Forwarding Profiles Globally configured at the device level (for now) and are associated with every allow firewall rule Enables basic support for IDS/IPS/Network AV threats, Wildfire (Anti-Malware), Data Protection, URL Filtering

19 PA VM Appliance Support Special considerations to support the Palo Alto virtual appliance Simplify the implementation to the lowest common denominator Using sub-interfaces instead of vsys for configuration isolation Ensuring support for the Palo Alto VM appliance enables support for Palo Alto running on the NetScaler SDX (currently in beta)

20 Known limitations Requires some initial configuration, it is not entirely plug and play (yet) Currently only supports a single Public IP range Public IP usage tracking is currently not handled Fine grain control of ICMP is currently not handled Not validating SSL certificates when ACS communicates with the Palo Alto device