Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

feat(examples): Hardening management access to PAN-OS devices #51

Merged
merged 7 commits into from
Jan 10, 2025
Merged

feat(examples): Hardening management access to PAN-OS devices #51

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
a68e28d
Updating PAN-OS version; removing pub IP from the management intf; up…
pavelrn Nov 28, 2024
b54bb7e
Removing Panorama public IP; adding GCP IAP connection info to the ex…
pavelrn Nov 28, 2024
444975c
FW rule rename; minor comment fixes
pavelrn Nov 28, 2024
be1262e
FW rule fix
pavelrn Nov 28, 2024
dc5b6d6
Fixing comments in variables.tf
pavelrn Nov 28, 2024
3250096
Using public IP; setting mgmt vpc ACL
pavelrn Jan 7, 2025
2c97515
Removing generated config files
pavelrn Jan 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions examples/multi_nic_common/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -211,13 +211,13 @@ please see https://cloud.google.com/iap/docs/using-tcp-forwarding#increasing_the
| <a name="input_lbs_internal"></a> [lbs\_internal](#input\_lbs\_internal) | A map containing each internal loadbalancer setting.<br><br>Example of variable deployment :<pre>lbs_internal = {<br> "internal-lb" = {<br> name = "internal-lb"<br> health_check_port = "80"<br> backends = ["fw-vmseries-01", "fw-vmseries-02"]<br> ip_address = "10.10.12.5"<br> subnetwork_key = "fw-trust-sub"<br> vpc_network_key = "fw-trust-vpc"<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/lb_internal#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_linux_vms"></a> [linux\_vms](#input\_linux\_vms) | A map containing each Linux VM configuration that will be placed in SPOKE VPCs for testing purposes.<br><br>Example of varaible deployment:<pre>linux_vms = {<br> spoke1-vm = {<br> linux_machine_type = "n2-standard-4"<br> zone = "us-east1-b"<br> linux_disk_size = "50" # Modify this value as per deployment requirements<br> vpc_network_key = "fw-spoke1-vpc"<br> subnetwork_key = "fw-spoke1-sub"<br> private_ip = "192.168.1.2"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> service_account_key = "sa-linux-01"<br> }<br>}</pre> | `map(any)` | `{}` | no |
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | A string to prefix resource namings. | `string` | `"example-"` | no |
| <a name="input_networks"></a> [networks](#input\_networks) | A map containing each network setting.<br><br>Example of variable deployment :<pre>networks = {<br> fw-mgmt-vpc = {<br> vpc_name = "fw-mgmt-vpc"<br> create_network = true<br> delete_default_routes_on_create = false<br> mtu = "1460"<br> routing_mode = "REGIONAL"<br> subnetworks = {<br> fw-mgmt-sub = {<br> name = "fw-mgmt-sub"<br> create_subnetwork = true<br> ip_cidr_range = "10.10.10.0/28"<br> region = "us-east1"<br> }<br> }<br> firewall_rules = {<br> allow-mgmt-ingress = {<br> name = "allow-mgmt-vpc"<br> source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.<br> priority = "1000"<br> allowed_protocol = "all"<br> allowed_ports = []<br> }<br> }<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc#input_networks)<br><br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_networks"></a> [networks](#input\_networks) | A map containing each network setting.<br><br>Example of variable deployment :<pre>networks = {<br> fw-mgmt-vpc = {<br> vpc_name = "fw-mgmt-vpc"<br> create_network = true<br> delete_default_routes_on_create = false<br> mtu = "1460"<br> routing_mode = "REGIONAL"<br> subnetworks = {<br> fw-mgmt-sub = {<br> name = "fw-mgmt-sub"<br> create_subnetwork = true<br> ip_cidr_range = "10.10.10.0/28"<br> region = "us-east1"<br> }<br> }<br> firewall_rules = {<br> allow-mgmt-ingress = {<br> name = "allow-mgmt-ingress"<br> source_ranges = ["10.10.10.0/24"]<br> priority = "1000"<br> allowed_protocol = "all"<br> allowed_ports = []<br> }<br> }<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc#input_networks)<br><br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_project"></a> [project](#input\_project) | The project name to deploy the infrastructure in to. | `string` | `null` | no |
| <a name="input_region"></a> [region](#input\_region) | The region into which to deploy the infrastructure in to. | `string` | `"us-central1"` | no |
| <a name="input_routes"></a> [routes](#input\_routes) | A map containing each route setting. Note that you can only add routes using a next-hop type of internal load-balance rule.<br><br>Example of variable deployment :<pre>routes = {<br> "default-route-trust" = {<br> name = "fw-default-trust"<br> destination_range = "0.0.0.0/0"<br> vpc_network_key = "fw-trust-vpc"<br> lb_internal_name = "internal-lb"<br> }<br>}</pre>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_service_accounts"></a> [service\_accounts](#input\_service\_accounts) | A map containing each service account setting.<br><br>Example of variable deployment :<pre>service_accounts = {<br> "sa-vmseries-01" = {<br> service_account_id = "sa-vmseries-01"<br> display_name = "VM-Series SA"<br> roles = [<br> "roles/compute.networkViewer",<br> "roles/logging.logWriter",<br> "roles/monitoring.metricWriter",<br> "roles/monitoring.viewer",<br> "roles/viewer"<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/iam_service_account#Inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_vmseries"></a> [vmseries](#input\_vmseries) | A map containing each individual vmseries setting.<br><br>Example of variable deployment :<pre>vmseries = {<br> "fw-vmseries-01" = {<br> name = "fw-vmseries-01"<br> zone = "us-east1-b"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> tags = ["vmseries"]<br> service_account_key = "sa-vmseries-01"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> bootstrap_bucket_key = "vmseries-bootstrap-bucket-01"<br> bootstrap_options = {<br> panorama-server = "1.1.1.1"<br> dns-primary = "8.8.8.8"<br> dns-secondary = "8.8.4.4"<br> }<br> bootstrap_template_map = {<br> trust_gcp_router_ip = "10.10.12.1"<br> untrust_gcp_router_ip = "10.10.11.1"<br> private_network_cidr = "192.168.0.0/16"<br> untrust_loopback_ip = "1.1.1.1/32" #This is placeholder IP - you must replace it on the vmseries config with the LB public IP address after the infrastructure is deployed<br> trust_loopback_ip = "10.10.12.5/32"<br> }<br> named_ports = [<br> {<br> name = "http"<br> port = 80<br> },<br> {<br> name = "https"<br> port = 443<br> }<br> ]<br> network_interfaces = [<br> {<br> vpc_network_key = "fw-untrust-vpc"<br> subnetwork_key = "fw-untrust-sub"<br> private_ip = "10.10.11.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-mgmt-vpc"<br> subnetwork_key = "fw-mgmt-sub"<br> private_ip = "10.10.10.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-trust-vpc"<br> subnetwork_key = "fw-trust-sub"<br> private_ip = "10.10.12.2"<br> },<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vmseries#inputs)<br><br>The bootstrap\_template\_map contains variables that will be applied to the bootstrap template. Each firewall Day 0 bootstrap will be parametrised based on these inputs.<br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries settings.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries settings.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-10210h9"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | `{}` | no |
| <a name="input_vpc_peerings"></a> [vpc\_peerings](#input\_vpc\_peerings) | A map containing each VPC peering setting.<br><br>Example of variable deployment :<pre>vpc_peerings = {<br> "trust-to-spoke1" = {<br> local_network_key = "fw-trust-vpc"<br> peer_network_key = "fw-spoke1-vpc"<br><br> local_export_custom_routes = true<br> local_import_custom_routes = true<br> local_export_subnet_routes_with_public_ip = true<br> local_import_subnet_routes_with_public_ip = true<br><br> peer_export_custom_routes = true<br> peer_import_custom_routes = true<br> peer_export_subnet_routes_with_public_ip = true<br> peer_import_subnet_routes_with_public_ip = true<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc-peering#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |

### Outputs
Expand Down
12 changes: 6 additions & 6 deletions examples/multi_nic_common/example.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,8 @@ networks = {
}
firewall_rules = {
allow-mgmt-ingress = {
name = "allow-mgmt-vpc"
source_ranges = ["1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
name = "allow-mgmt-ingress"
source_ranges = ["10.10.10.0/28"] # Set your own management source IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand All @@ -82,7 +82,7 @@ networks = {
firewall_rules = {
allow-untrust-ingress = {
name = "allow-untrust-vpc"
source_ranges = ["35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
source_ranges = ["35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22"] # Add app client IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand Down Expand Up @@ -171,7 +171,7 @@ routes = {

vmseries_common = {
ssh_keys = "admin:<YOUR_SSH_KEY>"
vmseries_image = "vmseries-flex-byol-1029h1"
vmseries_image = "vmseries-flex-byol-10210h9"
pavelrn marked this conversation as resolved.
Show resolved Hide resolved
machine_type = "n2-standard-4"
min_cpu_platform = "Intel Cascade Lake"
service_account_key = "sa-vmseries-01"
Expand Down Expand Up @@ -229,7 +229,7 @@ vmseries = {
vpc_network_key = "fw-mgmt-vpc"
subnetwork_key = "fw-mgmt-sub"
private_ip = "10.10.10.2"
create_public_ip = true
create_public_ip = false
},
{
vpc_network_key = "fw-spoke1-vpc"
Expand Down Expand Up @@ -290,7 +290,7 @@ vmseries = {
vpc_network_key = "fw-mgmt-vpc"
subnetwork_key = "fw-mgmt-sub"
private_ip = "10.10.10.3"
create_public_ip = true
create_public_ip = false
},
{
vpc_network_key = "fw-spoke1-vpc"
Expand Down
6 changes: 3 additions & 3 deletions examples/multi_nic_common/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,8 +100,8 @@ variable "networks" {
}
firewall_rules = {
allow-mgmt-ingress = {
name = "allow-mgmt-vpc"
source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
name = "allow-mgmt-ingress"
source_ranges = ["10.10.10.0/24"]
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand Down Expand Up @@ -185,7 +185,7 @@ variable "vmseries_common" {
```
vmseries_common = {
ssh_keys = "admin:AAAABBBB..."
vmseries_image = "vmseries-flex-byol-1029h1"
vmseries_image = "vmseries-flex-byol-10210h9"
machine_type = "n2-standard-4"
min_cpu_platform = "Intel Cascade Lake"
service_account_key = "sa-vmseries-01"
Expand Down
44 changes: 42 additions & 2 deletions examples/panorama_standalone/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,9 @@ panorama_public_ips = {

## Post build

Connect to the panorama instance(s) via SSH using your associated private key and set a password :
### Connect to Panorama directly via SSH

Connect to the Panorama instance(s) via SSH using your associated private key and set a password:

```
ssh admin@x.x.x.x -i /PATH/TO/YOUR/KEY/id_rsa
Expand All @@ -79,10 +81,48 @@ admin@Panorama# commit
Configuration committed successfully
```

## Check access via web UI
#### Check access via web UI

Use a web browser to access https://x.x.x.x and login with admin and your previously configured password

### Connect to Panorama via GCP IAP

>**Note**: This connection method is required when Panorama doesn't have a public IP address attached to the network interface and there is no IP connectivity from the management workstation to the Panorama's private IP address.

>**Note**: First time access provisioning takes some time. Please run the following command once again if it gets stuck while connecting.

```
gcloud compute ssh --zone "<ZONE>" "admin@<PANORAMA_VM_INSTANCE_NAME>" --tunnel-through-iap --project "<PROJECT_ID>" -- -i /PATH/TO/YOUR/KEY/id_rsa


To increase the performance of the tunnel, consider installing NumPy. For instructions,
please see https://cloud.google.com/iap/docs/using-tcp-forwarding#increasing_the_tcp_upload_bandwidth

Welcome admin.
admin@Panorama> configure
Entering configuration mode
[edit]
admin@Panorama# set mgt-config users admin password
Enter password :
Confirm password :

[edit]
admin@Panorama# commit
Configuration committed successfully
```

#### Check access via web UI

Start IAP TCP forwarding:

```
gcloud compute start-iap-tunnel <PANORAMA_VM_INSTANCE_NAME> 443 --local-host-port=localhost:4443 --zone=<ZONE> --project <PROJECT_ID>
```

Use a web browser to access https://localhost:4443 and login with admin and your previously configured password.

>**Note**: Because IAP TCP forwarding is using multiple source IP addresses, you might see a connection reset right after successful Panorama login. In that case, reestablish IAP TCP forwarding and try logging in again.

## Reference
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
### Requirements
Expand Down
13 changes: 10 additions & 3 deletions examples/panorama_standalone/example.tfvars
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,19 @@ networks = {
}
firewall_rules = {
"allow-panorama-ingress" = {
name = "panorama-mgmt"
source_ranges = ["1.1.1.1/32", "2.2.2.2/32"]
name = "allow-panorama-ingress"
source_ranges = ["172.21.21.0/24"] # Set your own management source IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
}
"allow-cloudiap-ingress" = {
name = "allow-cloudiap-ingress"
source_ranges = ["35.235.240.0/20"] # 35.235.240.0/20 corresponds to Cloud IAP.
priority = "1000"
allowed_protocol = "tcp"
allowed_ports = [22, 443]
}
}
}
}
Expand All @@ -42,7 +49,7 @@ panoramas = {
subnetwork_key = "panorama-sub"
panorama_version = "panorama-byol-1000"
ssh_keys = "admin:<ssh-rsa AAAA...>"
attach_public_ip = true
attach_public_ip = false
private_static_ip = "172.21.21.2"
}
}
Loading