1. Secure workloads with Palo Alto Networks VM-Series Firewall using flexible network load balancer
  2. Secure Workloads with Palo Alto Networks VM-Series Firewall Using Flexible Network Load Balancer

Secure Workloads with Palo Alto Networks VM-Series Firewall Using Flexible Network Load Balancer

Palo Alto Networks VM-Series virtual next-generation firewalls secure multicloud environments by providing full application traffic visibility and control over custom applications, consistent cross-cloud firewall management and policy enforcement, machine-language-powered threat protection and exfiltration prevention, and automated deployment and provisioning capabilities to keep up with even the most dynamic environments.

VM-Series virtual next-generation firewalls augments Oracle Cloud Infrastructure’s native network security controls by protecting against exploits, malware, known and unknown threats, and data exfiltration.

VM-Series virtual next-generation firewalls provide all the capabilities of physical next-generation firewalls in a virtual machine (VM) form factor, delivering inline network security and threat prevention to consistently protect public and private clouds, virtualized data centers, and branch locations. VM-Series virtual firewalls offer the features that security teams need to secure public cloud environments, including full visibility and control, consistent policy enforcement, application security, exfiltration prevention, compliance and risk management, security automation, and cloud-agnostic management.

  • Full Visibility and Control Finds Threats Across Environments
  • Consistent Policy Enforcement Delivers Best-in-Class Security
  • Compliance and Risk Management Become Easier
  • Security Automation Safeguards DevOps


Description of palo_alto_nlb_adv_sec.png follows
Description of the illustration palo_alto_nlb_adv_sec.png

Architecture

This reference architecture illustrates how organizations can protect Oracle applications, like Oracle E-Business Suite and PeopleSoft, deployed in Oracle Cloud Infrastructure (OCI) using Palo Alto Networks VM Series Firewall with flexible network load balancer.

To protect these traffic flows, Palo Alto Networks recommends segmenting the network using a hub and spoke topology, where traffic is routed through a central hub and is connected to multiple distinct networks (spokes). Ensure that you have deployed multiple VM-Series instances between flexible network load balancers considered as Sandwich Topology. All traffic between spokes, whether to and from the internet, to and from on-premises, or to the Oracle Services Network, is routed through the hub and inspected with Palo Alto Networks VM Series Firewall’s multilayered threat prevention technologies.

Deploy each tier of your application in its own virtual cloud network (VCN), which acts as a spoke. The hub VCN contains a Palo Alto Networks VM Series Firewall active/active cluster, Oracle internet gateway, dynamic routing gateway (DRG), Oracle Service Gateway, local peering gateways (LPGs), internal and external flexible network load balancers.

The hub VCN connects to the spoke VCNs through LPGs. All spoke traffic uses route table rules to route traffic through the LPGs to the hub using flexible network load balancer for inspection by the Palo Alto Networks VM series Firewall cluster.

You can configure and manage the Palo Alto Networks firewall locally, or you can manage it centrally using Panorama, the Palo Alto Networks centralized security management system. Panorama helps customers reduce the complexity and administrative overhead in managing configuration, policies, software, and dynamic content updates. Using device groups and templates on Panorama, you can effectively manage firewall-specific configuration locally on a firewall and enforce shared policies across all firewalls or device groups.

The following diagram illustrates this reference architecture.


Description of palo_alto_nlb_nw_vm_oci.png follows
Description of the illustration palo_alto_nlb_nw_vm_oci.png

For each traffic flow, ensure that network address translation (NAT) and security policies are open on Palo Alto Networks VM Series Firewall.

North-South Inbound Traffic

The following diagram illustrates how north-south inbound traffic accesses the web application tier from the internet and from remote data centers.


Description of palo_alto_nlb_north_south_inbound.png follows
Description of the illustration palo_alto_nlb_north_south_inbound.png

North-South Outbound Traffic

The following diagram illustrates how outgoing connections from the web application and database tiers to the internet provide software updates and access to external web services.


Description of palo_alto_nlb_north_south_outbound.png follows
Description of the illustration palo_alto_nlb_north_south_outbound.png

East-West Traffic (Web to Database)

The following diagram illustrates how traffic moves from the web application to the database tier.


Description of palo_alto_nlb_east_west_web_db.png follows
Description of the illustration palo_alto_nlb_east_west_web_db.png

East-West Traffic (Database to Web)

The following diagram illustrates how traffic moves from the database tier to the web application.


Description of palo_alto_nlb_east_west_db_web.png follows
Description of the illustration palo_alto_nlb_east_west_db_web.png

East-West Traffic (Web Application to Oracle Services Network)

The following diagram illustrates how traffic moves from the web application to the Oracle Services Network.


Description of palo_alto_nlb_east_west_webapp_osn.png follows
Description of the illustration palo_alto_nlb_east_west_webapp_osn.png

East-West Traffic (Oracle Services Network to Web Application)

The following diagram illustrates how traffic moves from the Oracle Services Network to the web application.


Description of palo_alto_nlb_east_west_osn_webapp.png follows
Description of the illustration palo_alto_nlb_east_west_osn_webapp.png

The architecture has the following components:

  • Palo Alto Networks VM-Series firewall

    Provides all the capabilities of physical next generation firewalls in a virtual machine (VM) form, delivering inline network security and threat prevention to consistently protect public and private clouds.

  • Region

    An Oracle Cloud Infrastructure region is a localized geographic area that contains one or more data centers, called availability domains. Regions are independent of other regions, and vast distances can separate them (across countries or even continents).

  • Availability domains

    Availability domains are standalone, independent data centers within a region. The physical resources in each availability domain are isolated from the resources in the other availability domains, which provides fault tolerance. Availability domains don’t share infrastructure such as power or cooling, or the internal availability domain network. So, a failure at one availability domain is unlikely to affect the other availability domains in the region.

  • Fault domains

    A fault domain is a grouping of hardware and infrastructure within an availability domain. Each availability domain has three fault domains with independent power and hardware. When you distribute resources across multiple fault domains, your applications can tolerate physical server failure, system maintenance, and power failures inside a fault domain.

  • Virtual cloud network (VCN) and subnets

    A VCN is a customizable, software-defined network that you set up in an Oracle Cloud Infrastructure region. Like traditional data center networks, VCNs give you complete control over your network environment. A VCN can have multiple non-overlapping CIDR blocks that you can change after you create the VCN. You can segment a VCN into subnets, which can be scoped to a region or to an availability domain. Each subnet consists of a contiguous range of addresses that don't overlap with the other subnets in the VCN. You can change the size of a subnet after creation. A subnet can be public or private.

  • Hub VCN

    The hub VCN is a centralized network where Palo Alto Networks VM-Series firewalls are deployed. It provides secure connectivity to all spoke VCNs, Oracle Cloud Infrastructure services, public endpoints and clients, and on-premises data center networks.

  • Application tier spoke VCN

    The application tier spoke VCN contains a private subnet to host Oracle E-Business Suite or PeopleSoft components.

  • Database tier spoke VCN

    The database tier spoke VCN contains a private subnet for hosting Oracle databases.

  • Load balancer

    The Oracle Cloud Infrastructure Load Balancing service provides automated traffic distribution from a single entry point to multiple servers in the back end.

  • Flexible network load balancer

    Oracle Cloud Infrastructure flexible network load balancer provides automated traffic distribution from one entry point to multiple, backend servers in your virtual cloud networks. It operates at the connection level and load balances incoming client connections to healthy backend servers based on Layer3/Layer4 (IP protocol) data.

  • Security list

    For each subnet, you can create security rules that specify the source, destination, and type of traffic that must be allowed in and out of the subnet.

  • Route Table

    Virtual route tables contain rules to route traffic from subnets to destinations outside a VCN, typically through gateways.

    In the hub VCN, you have the following route tables:

    • Management route table attached to the management subnet that has a default route connected to the internet gateway.
    • Untrust route table attached to the untrust subnet or default VCN for routing traffic from the hub VCN to the internet or on-premises targets.

      This route table also has an additional entry pointing to your on-premises subnets using a dynamic routing gateway. This ensures that no traffic disruption occurs during future native network address translation support.

    • Trust route table attached to the trust subnet pointing to the CIDR block of the spoke VCNs through the associated LPGs.
    • Network load balancer (NLB) route table attached to the NLB subnet that points to the CIDR block of on-premises subnets using dynamic routing gateways.
    • For each spoke attached to the hub, a distinct route table is defined and attached to an associated LPG. That route table forwards all traffic (0.0.0.0/0) from the associated spoke LPG through the internal flexible network load balancer, or you can define it at granular level too.
    • Oracle service gateway route table attached to the Oracle service gateway for Oracle Services Network communication. That route forwards all traffic (0.0.0.0/0) to the Internal load balancer VIP IP.
    • To maintain traffic symmetry, routes are also added to each Palo Alto Networks VM-Series Firewall to point the CIDR block of spoke traffic to the trust (internal) subnet’s default gateway IP (the default gateway IP available in the trust subnet on the hub VCN) and default CIDR block (0.0.0.0/0) pointing to Untrust subnet default gateway IP.
  • Internet gateway

    The internet gateway allows traffic between the public subnets in a VCN and the public internet.

  • NAT gateway

    The NAT gateway enables private resources in a VCN to access hosts on the internet, without exposing those resources to incoming internet connections.

  • Local peering gateway (LPG)

    An LPG enables you to peer one VCN with another VCN in the same region. Peering means the VCNs communicate using private IP addresses, without the traffic traversing the internet or routing through your on-premises network.

  • Dynamic routing gateway (DRG)

    The DRG is a virtual router that provides a path for private network traffic between a VCN and a network outside the region, such as a VCN in another Oracle Cloud Infrastructure region, an on-premises network, or a network in another cloud provider.

  • Service gateway

    The service gateway provides access from a VCN to other services, such as Oracle Cloud Infrastructure Object Storage. The traffic from the VCN to the Oracle service travels over the Oracle network fabric and never traverses the internet.

  • FastConnect

    Oracle Cloud Infrastructure FastConnect provides an easy way to create a dedicated, private connection between your data center and Oracle Cloud Infrastructure. FastConnect provides higher-bandwidth options and a more reliable networking experience when compared with internet-based connections.

  • Virtual network interface card (VNIC)

    The services in Oracle Cloud Infrastructure data centers have physical network interface cards (NICs). Virtual machine instances communicate using virtual NICs (VNICs) associated with the physical NICs. Each instance has a primary VNIC that's automatically created and attached during launch and is available during the instance's lifetime. DHCP is offered to the primary VNIC only. You can add secondary VNICs after instance launch. You should set static IPs for each interface.

  • Private IPs

    A private IPv4 address and related information for addressing an instance. Each VNIC has a primary private IP and you can add and remove secondary private IPs. The primary private IP address on an instance is attached during instance launch and doesn’t change during the instance’s lifetime. Secondary IPs should also belong to the same CIDR of the VNIC’s subnet. The secondary IP is used as a floating IP because it can move between different VNICs on different instances within the same subnet. You can also use it as a different endpoint to host different services.

  • Public IPs

    The networking services define a public IPv4 address chosen by Oracle that's mapped to a private IP.

    • Ephemeral: This address is temporary and exists for the lifetime of the instance.
    • Reserved: This address persists beyond the lifetime of the instance. It can be unassigned and reassigned to another instance.
  • Source and destination check

    Every VNIC performs the source and destination check on its network traffic. Disabling this flag enables CGNS to handle network traffic that's not targeted for the firewall.

  • Compute shape

    The shape of a compute instance specifies the number of CPUs and amount of memory allocated to the instance. The compute shape also determines the number of VNICs and maximum bandwidth available for the compute instance.

Recommendations

Use the following recommendations as a starting point to secure Oracle E-Business Suite or PeopleSoft workloads on Oracle Cloud Infrastructure using Palo Alto Networks VM-Series Firewall. Your requirements might differ from the architecture described here.
  • VCN

    When you create a VCN, determine the number of CIDR blocks required and the size of each block based on the number of resources that you plan to attach to subnets in the VCN. Use CIDR blocks that are within the standard private IP address space.

    Select CIDR blocks that don't overlap with any other network (in Oracle Cloud Infrastructure, your on-premises data center, or another cloud provider) to which you intend to set up private connections.

    After you create a VCN, you can change, add, and remove its CIDR blocks.

    When you design the subnets, consider your traffic flow and security requirements. Attach all the resources within a specific tier or role to the same subnet, which can serve as a security boundary.

    Use regional subnets.

    Verify the maximum number of LPGs per VCN in your service limits, in case you want to extend this architecture for multiple environments and applications.

  • Palo Alto Networks VM-Series Firewall
    • Deploy an active/active cluster and, if needed, add additional instances.
    • Whenever possible, deploy in distinct fault domains at a minimum or different availability domains.
    • Ensure that MTU is set to 9000 on all VNICs.
    • Utilize VFIO interfaces.
  • Palo Alto Networks VM-Series Firewall Security Management
    • If you’re creating a deployment hosted in Oracle Cloud Infrastructure, create a dedicated subnet for management.
    • Use security lists or NSGs to restrict inbound access to ports 443 and 22 sourced from the internet for administration of the security policy and to view logs and events.
  • Palo Alto Networks VM-Series Firewall Policies

    Ensures that you have configured the required network address translation policies enabled on VM-Series Firewall instances. Refer to the firewall documentation in the Explore More section for the most up-to-date information on required security policies, ports, and protocols.

Considerations

When securing Oracle E-Business Suite or PeopleSoft workloads on Oracle Cloud Infrastructure using Palo Alto Networks VM-Series Firewall, consider the following:

  • Performance
    • Selecting the proper instance size, which is determined by the compute shape, determines the maximum available throughput, CPU, RAM, and number of interfaces.
    • Organizations need to know what types of traffic traverses the environment, determine the appropriate risk levels, and apply proper security controls as needed. Different combinations of enabled security controls impact performance.
    • Consider adding dedicated interfaces for FastConnect or VPN services.
    • Consider using large compute shapes for higher throughput and access to more network interfaces.
    • Run performance tests to validate the design can sustain the required performance and throughput.
  • Security

    Deploying Palo Alto Networks VM-Series Firewall in Oracle Cloud Infrastructure allows for centralized security policy configuration and monitoring of all physical and virtual Palo Alto Networks VM-Series instances.

  • Availability
    • Deploy your architecture to distinct geographic regions for greatest redundancy.
    • Configure site-to-site VPNs with relevant organizational networks for redundant connectivity with on-premises networks.
  • Cost
    • Palo Alto Networks VM-Series Firewall is available in bring-your-own-license (BYOL) and pay-as-you-go license models for Bundle 1 and Bundle 2 in the Oracle Cloud Marketplace.
      • Bundle 1 includes the VM-Series capacity license, threat prevention license, and a premium support entitlement.
      • Bundle 2 includes the VM-Series capacity license with the complete suite of licenses that includes threat prevention, WildFire, URL filtering, DNS security, GlobalProtect, and a premium support entitlement.

Deploy

You can deploy Palo Alto Networks VM-Series Firewall on Oracle Cloud Infrastructure using Oracle Cloud Marketplace. You can also download the code from Github and customize it to suit your specific business requirements.

Oracle recommends deploying the architecture from Oracle Cloud Marketplace.

  • Deploy using the stack in Oracle Cloud Marketplace:
    1. Set up the required networking infrastructure as shown in the architecture diagram. See Set up a hub-and-spoke network topology.
    2. Deploy the application (Oracle E-Business Suite or PeopleSoft) on your environment.
    3. Oracle Cloud Marketplace has multiple listing for different configurations and licensing requirements. For example, the following listings feature bring your own licensing (BYOL). For each listing you choose, click Get App and follow the on-screen prompts:
  • Deploy using the Terraform code in GitHub:
    1. Go to the GitHub repository.
    2. Clone or download the repository to your local computer.
    3. Follow the instructions in the README document.

Explore More

Learn more about the features of this architecture and about related resources.