Palo Alto as a NAT Gateway

Use the instructions below to work with a Private Node group through Palo Alto.

Prerequisites

To be able to use Palo Alto as NAT Gateway for Cluster on VKS system, you need:

• A Windows server (VM) has been initialized on the vServer system with the following configuration:

• A Palo Alto server (VM) is initialized on the vMarketPlace system according to the instructions below with the following configuration:

Initialize Palo Alto

Step 1: Visit https://marketplace.console.vngcloud.vn/

Step 2: At the main screen, search for Palo Alto , at Palo Alto services , select Launch .

Step 3: Now, you need to configure Palo Alto. Specifically, you can select the desired Volume, IOPS, Network, Security Group . You need to choose the same VPC and Subnet as the VPC and Subnet you choose to use for your Cluster. In addition, you also need to select an existing Server Group or select Dedicated SOFT ANTI AFFINITY group so we can automatically create a new server group.

Step 4: Proceed to pay like normal resources on VNG Cloud.

Configure parameters for Palo Alto

Step 1: After initializing Palo Alto from vMarketPlace according to the instructions above, you can access the vServer interface here to check if the server running Palo Alto has been initialized. Next, open the Any rule on the Security Group for the Palo Alto server you just created. Opening the Any rule on the Security Group will allow all traffic to the Palo Alto server.

Step 2: After the server running Palo Alto is successfully initialized . To access the Palo Alto GUI you need a vServer running Windows. Then you access it using IP Internal Interface with the default login name and password: admin/admin

Note: Go to the Network section of vServer Windows to access the Palo Alto GUI. You need to create the same VPC and use a different subnet than the subnet with priority 1 when initializing Palo Alto

Step 3 : After logging in, you need to change your password for the first time. Please enter a new password according to your wishes.

Step 4: You need to create 1 Zone Inside and 1 Zone Outside according to the instructions below:

• Select Add pen

• Name the Zone : Inside then select OK

• Do the same for Zone Outside

Step 5 : Configure External Interface

• Interface Type: Layer 3

• Virtual Router: default

• Security Zone: Outside

• Switch to IPv4 Tab and select Add to enter Static IP for External Interface

• To get this IP information, go to Palo Alto 's Network Interface section to view the information

• Switch to the Advanced tab , in the MTU section you need to set it to 1400

Step 6: Perform similar configuration for Internal Interfaces

• At the IPv4 tab: you proceed to set up Static IP

• Switch to the Advanced tab , in the MTU section , set it to 1400

Step 7: Create static route

• Go to Network -> Virtual Routers -> Select default -> Switch to Static Routes

• Create a route as shown below

Step 8: Create Security Policy Rule

• Go to Policies -> Security -> Add

• On the General tab , you need to name the rule

• At the Source tab , set information such as Source Zone , Source Address , Source User, Source Device

• At the Destination tab , set information such as Destination Zone, Destination Address, Destination Device

• At the Application tab , set information such as Application, Depend On

• At the Service/URL Category tab , set information such as Service, URL Category

• At the Actions tab , set information such as Action, Log, Profile, Other Settings

Step 9 : Create a NAT rule so that VMs can go out to the Internet

• Go to Policies -> NAT -> Add

• On the General tab , name the NAT rule

• At the Original Packet tab, select Source Zone, Destination Zone, Destination Interface, Service, Source Address, Destination Address

• Create the Translated Packet tab and perform configuration as shown below

Note: Need to change the IP Address to the Static IP address that you configured in step 6

Step 10 : Proceed to Commit

Initialize Route Table

After Palo Alto is successfully initialized and configured, you need to create a Route table to connect to different networks. Specifically, follow these steps to create a Route table:

Step 1: Visit https://hcm-3.console.vngcloud.vn/vserver/network/route-table

Step 2: In the navigation menu bar, select Network Tab/ Route table.

Step 3: Select Create Route table.

Step 4: Enter a descriptive name for the Route table. Route table names can include letters (az, AZ, 0-9, '_', '-'). The input data length is between 5 and 50. It must not include leading or trailing spaces.

Step 5: Select VPC for your Route table. If you do not have a VPC, you need to create a new VPC according to the instructions on the VPC Page . The VPC used to set up the Route table must be the VPC selected for your Palo Alto and Cluster.

Step 6 : Select Create to create a new Route table.

Step 8: In the add new Route section , enter the following information:

• For Destination, enter Destination CIDR as 0.0.0.0/0

• For Target, enter Target CIDR as the Palo Alto Network Interface 2 IP address.

For example:

Checking connection

• Proceed to ping 8.8.8.8 or google.com