About aberger

Welcome to a new year of security opportunity and innovation! We hope this January edition of our monthly software firewall update finds you healthy, rested, and ready to make the most of our recent developments with VM-Series virtual firewalls and CN-Series container firewalls.    Kick off 2021 by being among the first to know about the many ways we continue to make deploying firewalls in public clouds faster and more efficient. You’ll find several exciting developments about VM-Series firewalls in Azure, as well as Alibaba and Oracle Cloud. Read on to learn about the latest VMware NSX certifications, running VM-Series on the Aryaka SD-WAN platform, and more.   Radically Simplify VM-Series Deployments in Azure Building and operating your firewall deployments in Azure is radically simpler with the availability of Panorama Orchestrated VM-Series Firewall Deployments in Azure. This feature eliminates the need to manage complex templates for firewall deployments in Azure. You can use the integrated workflow in Panorama to build and manage scalable firewall deployments without the steep learning curve associated with Azure networking constructs. Learn more about this important productivity-enhancing feature by reading this blog post and watching this video demo. This feature is available beginning with Panorama Plugin for Azure 3.0. Make sure to review the compatibility requirements in the Plugin Compatibility Matrix before you install this plugin.   Consistently Enforce Security Policy in Azure with New Monitoring Enhancements The Azure monitoring capabilities in the Panorama plugin for Azure have been extended to include Service, Subnet, VNET, and Load Balancer tags. You can use these new tags to dynamically update security policy rules and to consistently enforce security policy across all assets deployed within your Azure subscription. This feature is available beginning with Panorama Plugin for Azure 3.0. Make sure to review the compatibility requirements in the Plugin Compatibility Matrix before you install this plugin.   Discover Support for Dv3-series, Dsv3-series, and Fsv2-series Azure VM Types Along with simplifying deployment and extending policy enforcement in Microsoft Azure, VM-Series firewalls now run on additional Azure VM types: Dv3: D8_v3, D16_v3 Dsv3: D8s_v3, D16s_v3 Fsv2: F8s_v2, F32s_v2   Discover Real-World Flexibility with the Oracle Cloud Marketplace PAYG Listing for VM-Series Firewalls Deploying VM-Series firewalls on Oracle Cloud just got a whole lot simpler with the availability of pay-as-you-go (PAYG) options on the Oracle Cloud Marketplace. You can choose from the VM-500 and VM-700 VM-Series firewalls with either the Bundle 1 or Bundle 2 subscription. Additionally, you can bootstrap PAYG VM-Series firewalls in the same way that you bootstrap with a bring-your-own-license (BYOL) firewall.   Simplify Deployments on Alibaba Cloud Deploying VM-Series firewalls on Alibaba Cloud has never been easier. To secure traffic to and from an Alibaba virtual private cloud (VPC), use the latest VM-Series firewall BYOL image from the Alibaba Marketplace and deploy the firewall as an Elastic Compute Service (ECS) instance. When you configure the instance, just provide your BYOL license and enter your basic bootstrap configuration information as user data. This feature is available beginning with VM-Series Plugin 2.0.3.   Stay Current with the Latest VMware NSX-T and NSX-V Certifications We work closely with VMware to ensure that your VM-Series firewalls work well with and are certified for the latest NSX releases:  VMware NSX-T 3.1 Certification—VM-Series firewalls are qualified with NSX-T 3.1 and included as certified firewalls in the VMware compatibility guide. PAN-OS 10.0 or later and Panorama Plugin for VMware NSX 3.2.0 or later is required. Make sure to review the compatibility requirements in the Plugin Compatibility Matrix before you install this plugin. NSX-V 6.4.8 Certification—VM-Series firewalls are qualified with NSX-V 6.4.8 and included as certified firewalls in the VMWare compatibility guide. Panorama Plugin for VMware NSX 3.1.0 or later is required. Make sure to review the compatibility requirements in the Plugin Compatibility Matrix before you install this plugin.   Help Others Understand Why You Need Virtual Firewalls in NSX You understand that microsegmentation by itself won’t detect or respond to threats. But do the people in your organization understand why you need virtual firewalls in VMware NSX environments? Send them this short video that explains how NSX can dynamically route allowed traffic to a VM-Series firewall so that you can see and control every packet and prevent both known and unknown attacks from getting past open ports.   Aryaka Partner Driven Qualification If you depend on Aryaka managed service WAN, you’ll be glad to know VM-Series firewalls are partner-qualified by Aryaka to run on the Aryaka 2600 and Aryaka 3000 hardware platforms.   Don’t Miss Other Recent VM-Series and CN-Series Firewall Technical Updates Looking back can help you look ahead. Did you miss December's update? Take a look for information about the VM-Series firewall integration with the AWS Gateway Load Balancer (GWLB), tips for migrating VM-Series deployments from VMware NSX-V to VMware NSX-T, and more.     ... View more

We hope this December edition of our monthly software firewall update finds you getting ready for the holidays and looking forward to a new and promising year.   In this month’s digest covering the latest VM-Series and CN-Series developments, you’ll be among the first to know about getting 5G-native security in VMware Tanzu Kubernetes Grid environments with CN-Series container firewalls. In the spirit of providing the gift of security everywhere, you’ll see why VM-Series firewalls are easier to deploy in even more public clouds, including the latest details on integration with the AWS Gateway Load Balancer (GWLB). Plus you’ll find tips on how to start the new year right in private clouds with information about migrating VM-Series deployments from VMware NSX-V to VMware NSX-T.     Get 5G-Native Security with CN-Series Firewalls in VMware Tanzu Kubernetes Grid (TKG) Environments To secure highly distributed 5G networks—including edge clouds and across multivendor and multicloud environments—you can now enable three types of security on the CN-Series container firewall: network slice security, equipment ID security, and subscriber ID security. So how does this work? Starting with PAN-OS 10.0.3, CN-Series firewalls are supported on the VMware Tanzu Kubernetes Grid (TKG) platform, along with the Intel x710, macvlan, and Multus container network interfaces (CNIs). To learn more about what CN-Series firewalls can provide, visit our LIVECommunity page.   VM-Series Expands Its Ease of Deployment in Even More Public Clouds Simplifying deployment is the gift that keeps giving. That’s why we’ve made it easier to deploy VM-Series firewalls in public clouds with the following capabilities: AWS ELB Autoscaling Scripts Updated to Python 3—If you are autoscaling VM-Series firewalls on AWS using the AWS ELB autoscaling scripts, you’ll want to update your deployment to use these new scripts because AWS plans to deprecate support for Python 2.7 in Lambda on June 1, 2021. Alternatively, consider updating your deployment to use the new VM-Series firewall integration with AWS Gateway Load Balancer. Azure Custom VHD Support—You can now create a custom VM-Series firewall image for later use in your Azure deployment. You’ll thank yourself for using this approach because a custom image gives you the flexibility and consistency to deploy the VM-Series firewall with the PAN-OS version you want to use instead of being restricted to using only those images available though the Azure marketplace. Additionally, your custom image can include the latest content and antivirus updates. You can use this script to automate the process of creating the custom image. This feature is available beginning with VM-Series Plugin 2.0.3. Community-Supported Terraform Template for IBM Cloud—You can use this Terraform template to create a VM-Series instance on IBM Cloud. The template is community supported.   Find the latest details about VM-Series Integration with AWS Gateway Load Balancer Last month we announced the availability of integration between VM-Series virtual firewalls and the new AWS Gateway Load Balancer (GWLB). This integration makes it easy to deploy, scale, and manage VM-Series firewalls on Amazon Web Services (AWS). Here is additional information about this milestone integration: The deployment guide is now available. Cloud Formation and Terraform templates for the AWS GWLB integration are published on GitHub. You can use these templates to create your own customized deployments. The templates are community supported.  Demo videos are available on the LIVEcommunity blog page.   Migrate Your VM-Series Deployments from NSX-V to NSX-T Use the VMware in-host migration capability to move your VM Series deployments from NSX-V to NSX-T. This capability supports only operations-centric NSX-V deployments and is available beginning with Panorama plugin for NSX 3.2.0 and VMWare NSX-T Manager 3.1.0. Make sure to review the compatibility requirements in the Plugin Compatibility Matrix before installing this plugin and, if you need an overview of the NSX integration, review the VM-Series on NSX-T data sheet.   Help Colleagues Understand Your Vital Security Work Do folks on your team need a primer covering the complexities of hybrid infrastructure security? Point them toward this white paper full of helpful illustrations. From public and private clouds to on-premises data centers, they’ll see just why increased infrastructure complexity and interconnectivity significantly expand the attack surface. What’s more, this resource will walk them through the key characteristics of a security platform designed specifically for hybrid architectures and they’ll discover how our approach repels real-world threats such as ransomware, cryptojacking, and container worms.   Don’t Miss Other Recent VM-Series and CN-Series Firewall Technical Updates Did you miss November’s update? Take a look for information about the exciting integration with the brand new AWS Gateway Load Balancer along with news about simplified public cloud bootstrapping options, support for new CNI plugins for CN-Series firewalls, added platform support, and more. ... View more

As the days grow shorter, our list of virtual and container firewall capabilities grows longer. In this month’s digest covering the latest VM-Series and CN-Series developments, you’ll find news about an exciting integration with the brand new AWS Gateway Load Balancer, simplified public cloud bootstrapping options, support for new CNI plugins for CN-Series firewalls, added platform support, and more.   Leverage VM-Series Integration with AWS Gateway Load Balancer Security scalability meets cloud simplicity! The newly announced integration between VM-Series virtual firewalls and the new AWS Gateway Load Balancer (GWLB) introduces customers to massive security scaling and performance acceleration while bypassing the awkward complexities traditionally associated with inserting virtual appliances in public cloud environments. The AWS GWLB makes it easy to deploy, scale, and manage VM-Series firewalls on Amazon Web Services (AWS). To learn more about the new VM-Series integration with the GWLB, check out our technical deep dive blog. This feature is available beginning in PAN-OS 10.0.2 and VM-Series plugin 2.0.2.   Discover More Public Cloud Bootstrap Options for VM-Series Firewalls We’ve made it easier to bootstrap VM-Series firewalls in public clouds with the following capabilities: Improvements for bootstrapping from shared storage on AWS, Azure, and GCP — Until now, managing the bootstrap package of each VM-Series deployment in your environment required you to dedicate a cloud storage container (such as an AWS S3 bucket, a GCP storage bucket, or an Azure storage account). This is no longer necessary! VM-Series Plugin 2.0.2 now allows for subdirectories within your cloud storage container. This enables you to store multiple bootstrap packages in a single storage container so that you can identify a bootstrap package using the full path (for example, MyBucket/MyConfigs/Configuration_003).  Secure bootstrapping on AWS — We continue to simplify bootstrapping to save you effort, such as the recent introduction of a simpler alternative to bootstrap your VM-Series firewalls with user data in VM-Series Plugin 2.0.1. By allowing basic configuration with user data, you can rapidly launch, license, and register your VM-Series firewall and connect it to Panorama. Now, with VM-Series plugin 2.0.2, you can use AWS Secrets Manager to store your basic configuration as a secret and then use that secret as the only entry in user data for bootstrapping your firewalls.   CN-Series Firewalls Add New CNI Plugins We continue to enhance the industry’s first next-generation firewall for Kubernetes with features vital for securing containers, namespaces, and pods. Support for SR-IOV and macvlan CNI plugins — How do you secure those pods? It’s an increasingly important consideration in a 5G world. For example, OpenShift Multus allows pods to have multiple network interface connections, which can address various use cases in 5G environments. Beginning with PAN-OS 10.0.2, we support macvlan and SR-IOV CNI plugins for creating additional networks and helping to protect application pods using CN-Series firewalls. Review this documentation for more information.  Panorama plugin for Kubernetes 1.0.1 — The Panorama Plugin for Kubernetes 1.0.1 is here — our first maintenance release after the CN-Series firewall launch. It includes customer requested enhancements such as service monitoring and offline licensing enhancements. This plugin is available beginning in PAN-OS 10.0.1.   VM-Series Firewalls Now Run on More Platforms We’ve qualified VM-Series firewalls to run on more platforms. This includes:  Microsoft Hyper-V 2019 (starting with PAN-OS 9.0.11, PAN-OS 9.1.5, and PAN-OS 10.0.0) Azure VMware Solutions (AVS) (starting with PAN-OS 9.1.0 and PAN-OS 10.0.0. Requires Panorama Plugin for VMware NSX 3.2.0 or later) Openstack 13 (Queens) (starting with PAN-OS 9.1.5 and PAN-OS 10.0.2)   Simplify VM-Series Deployments in Azure with This Beta As many of our customers know, building and operating firewall deployments in Azure is now a simpler task with the beta availability of “Panorama Orchestrated VM-Series Firewall Deployments in Azure.” This feature eliminates the need to manage complex templates for firewall deployments in Azure. Additionally, you can use the workflow on the console to build and manage scalable firewall deployments without the steep learning curve associated with Azure networking constructs. Learn more about this important productivity-enhancing beta in the Panorama Orchestrated Azure Deployments blog post.   Find Other Recent VM-Series and CN-Series Technical Updates Did you miss October’s update? Review that October update to find information about new, cross-environment CN-Series firewall features, new VM-Series Azure deployment options, and ways to fine-tune HA deployments.   ... View more

  October VM-Series and CN-Series Updates     Welcome to October—and this short and sweet edition of our monthly virtual and container firewall news digest. This month you’ll find information about the latest CN-Series features, new VM-Series Azure deployment options, and ways to fine-tune HA deployments. Plus, get details about a VM-Series beta that bypasses complex templates so you can protect workloads quickly and cost-effectively in Azure.   CN-Series firewalls add more cross-environment features We’ve added even more ways to boost your overall security posture with the industry’s first Next-Generation Firewall for Kubernetes. Secure Red Hat OpenShift 4.5 Need to secure pods on-prem? See how we’ve qualified Red Hat Openshift 4.5. This feature is available beginning in PAN-OS 10.0.1. Make the most of Kubernetes 1.17 and 1.18 qualifications Customers in both public (GKE, EKS, and AKS) and private (OpenShift, native k8s) clouds can now adopt CN-Series firewalls in Kubernetes 1.17 and 1.18 environments. This feature is available beginning in PAN-OS 10.0.0.   New VM-Series Azure options speed deployment With the introduction of  Azure Auto Scale Template 1.1 you now have two new capabilities when autoscaling your VM-Series firewalls in Azure deployments: Application Insight Resource Region—in the inbound and hub templates, you can now specify the region for your Application Insight Resource. Support for Instance-Based VM-Series Model PAYG Licenses—the template has been updated to support the new Instance-Based VM-Series Model PAYG Licenses that were introduced with PAN-OS 9.1.3. See VM-Series Licenses for Public Clouds for more information on how this license type works.   Fine-tune HA deployments with VM-Series Plugin 1.0.13 Take a look at the maintenance release of VM-Series Plugin 1.0.13 for high-availability (HA) fixes you’ll want in Azure and AWS. This release addresses occasional instances of UI freezing in HA deployments on Azure and ensures that  interfaces move to the new active peer during a failover event for an HA pair deployed on AWS. We’ve also made sure user interfaces won’t show plugin mismatches after upgrading an HA pair from VM-Series Pugin 1.0.11 to 1.0.12.   Simplify VM-Series deployments in Azure with this beta Building and operating your firewall deployments in Azure is a whole lot easier with the beta availability of “Panorama Orchestrated VM-Series Firewall Deployments in Azure”. This feature eliminates the need to manage complex templates for firewall deployments in Azure. Plus, you can use the console’s workflow to build and manage scalable scalable firewall deployments without climbing the steep curve of learning Azure networking constructs. Get information about this important productivity-enhancing beta here.   Find other recent VM-Series and CN-Series technical updates Did you miss last September’s update digest? You can find information about improved support and deployment options, NSX and virtualization enhancements and accelerated boot time here.   ... View more

September VM-Series and CN-Series Updates Threats never rest--and neither do we. Get caught up on the latest VM-Series virtual and CN-Series container firewalls capabilities so they can work tirelessly on your behalf. In this September update, you’ll find news about improved support and deployment options, plugin developments, NSX and virtualization enhancements, accelerated boot time, and an exciting Azure beta. CN-Series Firewalls Add New Capabilities and Deployment Options The industry’s first Next-Generation Firewall for Kubernetes continues to provide more and more capabilities for securing container environments. Expand Kubernetes firewall capabilities with Openshift 4.4 and Multus CNI support More ways to secure pods are at hand, because we’ve qualified Red Hat Openshift 4.4 and added support for Multus CNI. Multus CNI is a container network interface (CNI) plugin for Kubernetes, which enables you to simply attach multiple network interfaces to pods. For example, you can attach Calico as the primary network interface and Weave as a secondary network interface. This feature is available beginning in PAN-OS 10.0.1. Get added flexibility with Kubernetes 1.16 qualification Keeping pace with the evolution of Kubernetes allows the CN-Series to keep protecting Kubernetes environments. Customers in both public (GKE, EKS, and AKS) and private (native k8s) clouds can now adopt CN-Series firewalls in Kubernetes 1.16. This feature is available beginning in PAN-OS 10.0.0. Speed deployment with GCP Marketplace listing You can now deploy CN-Series firewalls directly from GCP Marketplace using a bring-your-own license (BYOL). VM-Series Public Cloud Developments Streamline Deployment Speed is of the essence in public clouds - and security is no exception to the rule. Stay current with Panorama Plugin for Azure 2.0.3 We’ve addressed an issue in the Azure plugin. Do also take a look at the Plugin Compatibility Matrix. Auto-register PAYG VM-Series firewalls to Customer Support Portal Make it easier to get support. You can now automatically register your pay-as-you-go (PAYG) VM-Series firewalls to your CSP account. This feature is available beginning in PAN-OS 10.0.0. Get automatic site license activation on PAYG VM-Series Firewalls Pay-as-you-go (PAYG) VM-Series firewalls can now use AutoFocus™ and Cortex™ Data Lake site licenses. This feature is available beginning in PAN-OS 10.0.0. Leverage simplified bootstrapping for public clouds You now have a simpler option to bootstrap your VM-Series firewalls without using cloud storage accounts and buckets. Firewalls can be bootstrapped by passing configuration information as key-value pairs in User Data on AWS, Azure, and GCP. The basic configuration includes information for licensing, registration, and connecting to Panorama. This feature is available beginning with VM-Series Plugin 2.0.1. Take advantage of AWS HA improvements Protect your traffic with faster failover times and improved throughput performance. A new mode of VM-Series active-passive high availability (HA) firewalls on AWS moves a secondary IP address from the failed firewall to the new active firewall after failover. This feature is available beginning with VM-Series Plugin 2.0.1.Find the documentation here and be sure to check out the GitHub CFT template. Easily deploy on Oracle Government Cloud You can now bring your own license (BYOL) for VM-Series firewalls on Oracle Government Cloud. This feature is available beginning with PAN-OS 9.1.3 and VM-Series plugin 1.0.12. Stay current with Panorama Plugin for AWS 2.0.2 We’ve addressed a few issues in the AWS plugin. Do also take a look at the Plugin Compatibility Matrix. Stay current with Panorama Plugin for Azure 2.0.3 We’ve addressed an issue in the Azure plugin. Do also take a look at the Plugin Compatibility Matrix. Private Cloud Updates Provide More NSX Capabilities Plugin updates and security policy extensions are designed to reduce a whole lot of effort on your part. Stay current with Panorama Plugin for NSX 3.2.0. Use this recommended Panorama plugin for NSX release when you upgrade to PAN-OS 9.0, PAN-OS 9.1, or PAN-OS 10.0 release, or when you migrate from NSX-V to NSX-T. Do also take a look at the Plugin Compatibility Matrix. Seamlessly extend your security policies from NSX-V to NSX-T. Save some time here. With Panorama plugin for NSX 3.2.0, you can now easily extend your existing NSX-V Security policy rules to your new NSX-T environment, which eliminates the need to rewrite all your Panorama policy rules for NSX-T. This feature is available beginning with Panorama plugin for NSX 3.2.0. Virtualization enhancements cover ESXi/vSphere and vMotion Take advantage of new ways to secure bare metal hypervisors and the migration of virtual machines. Discover ESXi/vSphere 7.0 support. VM-Series firewalls are now compatible with VMware ESXi/vSphere version 7.0. Leverage vMotion support with VM-Series Firewalls (CLI only) for ESXi and NSX-T. A simple configuration step in the CLI is now all it takes to support vMotion of your VM-Series running on ESXi hosts. This feature is available beginning in PAN-OS 10.0.1.  Platform Refinements Speed Firewall Operation Across Environments VM-Series deployment, performance, and use gets elevated even more with simplified deployment, faster boot time, and increased scale. Stay current with VM-Series Plugin 2.0.1. The maintenance release of VM-Series Plugin 2.0.1 addresses issues with fixes you’ll want. It also adds significant new functionality - such as simplified bootstrapping for public clouds, AWS HA Improvements, and SR-IOV Access Mode Configuration. Faster VM-Series boot time. As part of our effort to improve your experience with VM-Series firewall orchestration and automation, we improved the boot time by 20%. This is just a start—more optimizations are on the way! This feature is available beginning in PAN-OS 10.0.1. Increased flexibility with SR-IOV access mode configuration Scale your operations by configuring VM-Series firewalls in SR-IOV access mode using bootstrap methods. This feature is available beginning in PAN-OS 10.0.1 and VM-Series Plugin 2.0.1. Make the most of increased VM-700 scale limits on NAT Rules and Service Objects. The VM-700 firewall now supports up to 5,000 service objects and 15,000 NAT rules. This feature is available beginning in PAN-OS 10.0.0. Panorama Orchestrated Azure Deployments Beta Now Available We are excited to announce the beta availability of “Panorama Orchestrated VM-Series Firewall Deployments” in your Azure environment. With this feature, you can easily build and operate your firewall deployments and integrate them with your Azure cloud networks. You no longer need to operate complex templates to deploy firewalls that protect your cloud workloads. You can also now use the workflow available on the console to build and manage scalable firewall deployments without a steep learning curve on Azure networking constructs. More details about this beta can be found here.   Make sure you’re caught up with VM-Series and CN-Series news Miss last month’s update? You might be missing out. Check it out here. ... View more

    See Our Container Firewall in Action, Get Latest VM-Series and Hybrid Cloud News If summers are supposed to slow, we didn’t get the memo. We’ve been busy on your behalf releasing new products and updates designed to cut complexity across data center and hybrid cloud environments, such as the industry’s first next-generation firewall for Kubernetes and the release of PAN-OS 10.0.   Plus, we’ve introduced a new data processing card to boost hardware firewall performance, launched new high-availability (HA) features, added even more public cloud and private cloud capabilities to VM-Series, and more.   You can see the summaries of these developments below, which include links to helpful resources.   Watch CN-Series Take On Container Threats If you missed our virtual launch event in June, you can still access these on-demand hybrid cloud security sessions covering the state of heterogeneous network environments--which include a great demo of the just-made-available CN-Series firewall.   View the “What’s New in Hybrid Cloud Security: Speed, Scalability and Containers” session to see Palo Alto Networks Product Line Manager, Sudeep Padiyar, use the Graboid crypto-jacking worm attack to demonstrate the power of the CN-Series. In this session, I also walk you through some of the latest capabilities released in PAN-OS 10.0, including a Kubernetes plugin for Panorama to accompany the CN-Series firewall, our exciting new high-availability (HA) clustering capability, and a new data processing card for data center and hybrid cloud environments.   Detailed log view of Sudeep Padiyar’s demonstration showing how Panorama policy and the CN-Series container firewall thwart a cryptojacking attack. Get More CN-Series Information As you’ll see in our hybrid cloud webinar track, deploying the CN-Series firewall protects your containerized workloads running in Kubernetes from network-based threats. You get outbound traffic protection for pods accessing VMs/servers, repos and cloud services, and inbound traffic protection for Kubernetes services. East-west traffic is secured between pods and pods-to-services.    Supported environments include: Native Kubernetes in public or private cloud Amazon Elastic Kubernetes Service (EKS) Azure Kubernetes Service (AKS) Google Kubernetes Engine (GKE) Red Hat OpenShift   For an in-depth look at the container firewall’s capabilities, read the datasheet. And if you have colleagues new to Kuberenetes and containers, do point them to this eBook.   Find New Panorama Kubernetes Plugin Info, More VM-Series Features PAN-OS 10.0 is here and that means more ways to secure data centers and hybrid cloud environments. We’ve released a Kubernetes plugin (which Sudeep shows in his demo), along with more capabilities for VM-Series virtual firewalls: Panorama now supports multiple IP-tag sources — Now you can have multiple Panorama plugins send IP address-to-tag mappings to the same firewall device groups. This new functionality allows you to get visibility into your hybrid infrastructure with centralized policy enforcement. Please read the release notes and known issues to enable and optimize this feature. Collector group bootstrap parameters use automation for more efficient scaling — Collector group bootstrap parameters now let you automate the addition of firewalls to Panorama Log Collector Groups using the new bootstrap parameter. See the technical details for VM-Series here.   Boost Virtual Firewall Performance with Public Cloud Enhancements Four new features specific to VM-Series deployments in public clouds are now available to provide you with more performance, insight, and ease of use: Find more insight into firewall operational status, debugging, and automation. When the AWS Firewall Bootup and Health Status Logs are enabled, the firewall will post its bootup events and ongoing operation status into AWS CloudWatch. Available beginning in VM-Series Plugin 1.0.12. Get additional customer metrics. Via custom metrics in AWS, Azure, and GCP you can now gain insight into throughput and connections-per-second for visibility, debugging, and automation on your firewalls. This feature is available beginning in VM-Series Plugin 1.0.12. Make the most of broadened AWS support. You can now deploy VM-Series firewalls in the AWS Outpost and AWS South Africa regions. Enhance visibility with X-Forwarded-For (XFF) support. You can now use XFF IP addresses, such as source IP addresses, which enables better visibility and security policy control. This feature is available beginning in PAN-OS 10.0.   Get More Out of VMware NSX-V and NSX-T with Private Cloud Enhancements Extended IP address range support for dynamic address groups is here. This increases subnet and IP address range support for Dynamic Address Groups in both NSX-V and NSX-T environments. See details of this feature, which is available beginning in PAN-OS 10.0.   Discover New Ways to Expand Virtualization Resiliency Thanks to PAN-OS 10.0, your VM-Series firewalls now have more capabilities for continuous operation, as well as additional virtualization platform options: Scale more efficiently with high-availability (HA) clustering — Now you can improve horizontal scaling while providing session resiliency. Now you can create multi-node clusters using the new HA-4 link. This feature, which requires L2 connectivity, is available beginning in PAN-OS 10.0. Expand security with Corsa Networks support — The Network Virtualization Security Platform from Corsa Networks is now a supported, partner-qualified platform.   Be Sure to See Those On-Demand Hybrid Cloud Sessions As mentioned in the outset of this post, we’ve been busy launching products that provide solutions for hybrid cloud challenges that network security professionals face. Register today for our on-demand hybrid cloud seminars and make the most of resources designed to manage the complexity of securing in hybrid clouds. ... View more

VM-Series Now Integrates with GCP Packet Mirroring Announcing New VM-Series Integration with Google Cloud Packet Mirroring Service   Google Cloud announced the general availability of a new Packet Mirroring service, allowing you to troubleshoot your existing Virtual Private Clouds (VPCs). This feature provides a non-intrusive way to monitor the network traffic to and from your Google Compute Engine and Google Kubernetes Engine (GKE).   Palo Alto Networks has built integration of our VM-Series Virtualized Next-Generation Firewall with the new Google Cloud Packet Mirroring service. The VM-Series is the industry-leading virtualized firewall protecting your applications and data with next-generation security features that deliver superior visibility, precise control, and threat prevention at the application level.   The VM-Series virtual firewall on Google Cloud deployed out of band now supports two critical security outcomes: Granular visibility into application traffic and detection of network-borne threats through inspection of mirrored traffic. Rapid detection and response against advanced attacks using an AI-driven approach, such as Cortex by Palo Alto Networks.   Application visibility and threat detection The VM-Series virtual firewall on Google Cloud can analyze, filter, and process the raw traffic available through the Packet Mirroring service within Google Cloud and provide contextually rich application, content, and threat information. The need for extracting data out of Google Cloud for further processing is eliminated, saving cost and providing deep insight into network traffic. Based on this more in-depth inspection, customers can choose to enable alerts for a wide range of security issues, including:   High priority security alerts – Attacks for known exploits, for example, an attempt to exploit CVE-2017-5638 for Apache Struts-based web servers running in Google Cloud. Primarily, the VM-Series virtual firewall is serving as an intrusion detection system (IDS). Traffic to inappropriate, malicious destinations and command-and-control systems – Detect if the source/destination is inappropriate or malicious, whether there are geo-blocking restrictions to be met or if there is Bitcoin traffic or an SSH session to a known command-and-control (C2) domain.   Based on the visibility and detection (in logs), you can filter for events and enable alerts and actions that can trigger remediation using Action-Oriented Log Forwarding using HTTP(S). This provides a webhook to create a ticket in a service desk system or a security orchestration and response tool, such as Demisto, or launch a Google Cloud function, which can quarantine by shutting down the instance or lock down the firewall rule.   Rapid detection and response against advanced attacks The VM-Series virtual firewall supports enhanced application logging, which converts raw packet data from Google Cloud mirrored network traffic into context-aware network activity information for storage in Palo Alto Networks cloud services, including Cortex Data Lake. Security applications, such as Cortex XDR, can start analyzing the rich data collected, using analytics and machine learning to detect stealthy attacks and expedite security investigations accurately. Identified threats can be mitigated through automated response from Demisto and other security orchestration and response tools.   To learn more about VM-Series Integrating with GCP Packet Mirroring, we encourage you to follow these links: Packet Mirroring Launch Blog Google Cloud Packet Mirroring Overview Using Packet Mirroring  VM-Series on Google Cloud Action-Oriented Log Forwarding Using HTTP(S) VM-Series on Google Cloud   ... View more

Palo Alto Networks announces the VM-Series Virtual Next-Generation Firewall can now integrate with Amazon Virtual Private Cloud Ingress Routing. Got questions? Get answers on LIVEcommunity! VM-Series Virtual Next-Generation Firewall can now integrate with Amazon Virtual Private Cloud Ingress Routing   We are excited to announce that the Palo Alto Networks VM-Series Virtual Next-Generation Firewall now integrates with the new Amazon Virtual Private Cloud (Amazon VPC) Ingress Routing feature to more efficiently protect your applications and data from inbound threats coming from the internet.   VM-Series Virtual Firewalls and Amazon VPC VM-Series virtual firewalls augment native Amazon Web Services (AWS) security groups in your Amazon VPC to protect your web-facing applications with next-generation security features that deliver superior visibility, control, and threat prevention. The VM-Series virtual firewalls apply application-specific threat prevention policies to prevent exploits, malware, and previously unknown threats from compromising applications and exfiltrating data from your AWS environment. With the new integration between the Amazon VPC Ingress Routing feature and VM-Series virtual firewalls, you can now seamlessly insert a VM-Series virtual firewall as a bump-in-the wire in your greenfield and brownfield VPC environments.   Amazon VPC Ingress Routing With Amazon VPC Ingress Routing, you can define routing rules at the Internet Gateway (IGW) and Virtual Private Gateway (VGW) to redirect ingress traffic to third-party appliances, such as the VM-Series virtual firewalls, before it reaches the final destination. This makes it easier for you to deploy production-grade applications with the security services you require within your Amazon VPC.   Illustration of VM-Series virtual firewall integrated with Amazon VPC Ingress Routing as a bump-in-the wire in greenfield and brownfield VPC environments.   AWS provides a wide selection of flexible and compelling services, including AWS Lambda, Amazon API Gateway, Amazon Kinesis, and more. You may have created interface endpoints (a.k.a. AWS PrivateLink) in your Amazon VPC to enable your Amazon VPC workloads to privately access these services. Additionally, you may have enabled your on-premises hosts to privately access these AWS services using these interface endpoints via the virtual private gateway in your Amazon VPC.   With the new integration between Amazon VPC Ingress Routing and the VM-Series virtual firewalls, you can now associate route tables to your virtual private gateway and add route rules to redirect all ingress traffic to AWS services through the firewalls. This redirection ensures that all on-premises traffic accessing these AWS services will pass through the firewalls, strengthening your overall security posture.   Illustration of VM-Series virtual firewall integrated with Amazon VPC Ingress Routing to ensure on-premises traffic to Amazon services (Amazon Kinesis) will be filtered by the firewall.   You can now use the Amazon VPC Ingress Routing feature with VM-Series virtual firewalls to improve the security posture of your Amazon VPC. Security is now always turned on for inbound Amazon VPC traffic from the internet and your on-premises environment.   We encourage you to read more about this integration on our TechDocs portal: Overview of HA on AWS. You may also find more information about AWS on the LIVEcommunity VM-Series on AWS resource page.   We'd love to hear any feedback that you have.   ... View more

Attention: VM-Series customers. The first PAN-OS Accelerated Feature Release (XFR) is now available. Learn what PAN-OS XFR releases are and which features are in the first ever XFR release. Got questions? Get answers on LIVEcommunity! PAN-OS 9.0.3 XFR for VM-Series Now Available   We are thrilled to announce the first ever PAN-OS XFR feature release for the VM-Series firewall. You may be asking yourself, what is an “XFR release”?  XFR stands for "accelerated feature release." To keep up with the rapid rate of change in public and private cloud environments, we've introduced PAN-OS XFR releases to deliver new VM-Series firewall features more frequently than regular PAN-OS releases can accommodate.   In PAN-OS 9.0.3 XFR, customers using VM-Series to secure AWS C5 or M5 instances and customers using VM-Series to secure Cisco ENCS 5400 environments will see major throughput performance improvements. Customers using (or considering using) VMware NSX-T for micro-segmentation can now augment their east-west traffic security between VMs and containers with threat prevention capabilities from VM-Series.   Here’s a look at the features delivered in PAN-OS 9.0.3 XFR:   VM-Series Feature Platform Description Who should Care Performance Improvements for AWS C5/M5 Instances using DPDK AWS Support for Intel DPDK on AWS C5/M5 instances to improve throughput performance. Provides throughput improvements of 50-100% to improve cost-performance ratio for all use cases. Customers using AWS C5 or M5 instances who want to improve performance. DPDK Support for VM-Series on Cisco ENCS 5400 Cisco ENCS Support for Intel DPDK on Cisco Enterprise Network Compute System (ENCS) 5400 to improve throughput performance. Customers using Cisco ENCS 5400 who want to improve performance. VMware NSX-T East-West (Beta) VMware NSX-T Beta support for NSX-T East-West use cases. Customers can now secure container East-West (inter-Pod) traffic, construct DAG based policies on top of NS-groups, and manage up to 16 NSX-T environments from a single Panorama. Sign up for beta here: Registration for Beta VM-Series NSX Beta Customers using NSX-T who want to secure East-West traffic.   You can find the in-depth release notes for PAN-OS 9.0.3 XFR on TechDocs.   Are there any special considerations to be aware of? Yes. If you upgrade to the PAN-OS 9.0.3 XFR release, you must also upgrade to subsequent PAN-OS XFR maintenance releases until the next regular PAN-OS release is available.  There will be PAN-OS XFR maintenance releases that keep PAN-OS XFR releases in sync with regular PAN-OS maintenance releases. All PAN-OS XFR features will be aggregated into the following PAN-OS regular release.   How long will a PAN-OS XFR release be supported? PAN-OS XFR releases will be supported for 12 months from the date of each release, at which point you must upgrade to the next regular PAN-OS release in order to continue using your XFR features.    PAN-OS XFR Release Upgrade Cadence Should I upgrade to an XFR release? If there are specific features of interest in the PAN-OS 9.0.3 XFR release, then you should upgrade. Otherwise, you can remain on your current PAN-OS release cadence.   For any additional questions, please feel free to reach out to your Palo Alto Networks account team. ... View more