Skip to content

Commit

Permalink
Updating PAN-OS version; removing pub IP from the management intf; up…
Browse files Browse the repository at this point in the history 
…dating FW rules
  • Loading branch information
@pavelrn
pavelrn committed Nov 28, 2024
1 parent 73cd8f3 commit a68e28d
Show file tree
Hide file tree
Showing 29 changed files with 66 additions and 66 deletions.
4 changes: 2 additions & 2 deletions examples/multi_nic_common/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -211,13 +211,13 @@ please see https://cloud.google.com/iap/docs/using-tcp-forwarding#increasing_the
| <a name="input_lbs_internal"></a> [lbs\_internal](#input\_lbs\_internal) | A map containing each internal loadbalancer setting.<br><br>Example of variable deployment :<pre>lbs_internal = {<br> "internal-lb" = {<br> name = "internal-lb"<br> health_check_port = "80"<br> backends = ["fw-vmseries-01", "fw-vmseries-02"]<br> ip_address = "10.10.12.5"<br> subnetwork_key = "fw-trust-sub"<br> vpc_network_key = "fw-trust-vpc"<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/lb_internal#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_linux_vms"></a> [linux\_vms](#input\_linux\_vms) | A map containing each Linux VM configuration that will be placed in SPOKE VPCs for testing purposes.<br><br>Example of varaible deployment:<pre>linux_vms = {<br> spoke1-vm = {<br> linux_machine_type = "n2-standard-4"<br> zone = "us-east1-b"<br> linux_disk_size = "50" # Modify this value as per deployment requirements<br> vpc_network_key = "fw-spoke1-vpc"<br> subnetwork_key = "fw-spoke1-sub"<br> private_ip = "192.168.1.2"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> service_account_key = "sa-linux-01"<br> }<br>}</pre> | `map(any)` | `{}` | no |
| <a name="input_name_prefix"></a> [name\_prefix](#input\_name\_prefix) | A string to prefix resource namings. | `string` | `"example-"` | no |
| <a name="input_networks"></a> [networks](#input\_networks) | A map containing each network setting.<br><br>Example of variable deployment :<pre>networks = {<br> fw-mgmt-vpc = {<br> vpc_name = "fw-mgmt-vpc"<br> create_network = true<br> delete_default_routes_on_create = false<br> mtu = "1460"<br> routing_mode = "REGIONAL"<br> subnetworks = {<br> fw-mgmt-sub = {<br> name = "fw-mgmt-sub"<br> create_subnetwork = true<br> ip_cidr_range = "10.10.10.0/28"<br> region = "us-east1"<br> }<br> }<br> firewall_rules = {<br> allow-mgmt-ingress = {<br> name = "allow-mgmt-vpc"<br> source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.<br> priority = "1000"<br> allowed_protocol = "all"<br> allowed_ports = []<br> }<br> }<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc#input_networks)<br><br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_networks"></a> [networks](#input\_networks) | A map containing each network setting.<br><br>Example of variable deployment :<pre>networks = {<br> fw-mgmt-vpc = {<br> vpc_name = "fw-mgmt-vpc"<br> create_network = true<br> delete_default_routes_on_create = false<br> mtu = "1460"<br> routing_mode = "REGIONAL"<br> subnetworks = {<br> fw-mgmt-sub = {<br> name = "fw-mgmt-sub"<br> create_subnetwork = true<br> ip_cidr_range = "10.10.10.0/28"<br> region = "us-east1"<br> }<br> }<br> firewall_rules = {<br> allow-mgmt-ingress = {<br> name = "allow-mgmt-vpc"<br> source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Set your own management source IP range.<br> priority = "1000"<br> allowed_protocol = "all"<br> allowed_ports = []<br> }<br> }<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc#input_networks)<br><br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_project"></a> [project](#input\_project) | The project name to deploy the infrastructure in to. | `string` | `null` | no |
| <a name="input_region"></a> [region](#input\_region) | The region into which to deploy the infrastructure in to. | `string` | `"us-central1"` | no |
| <a name="input_routes"></a> [routes](#input\_routes) | A map containing each route setting. Note that you can only add routes using a next-hop type of internal load-balance rule.<br><br>Example of variable deployment :<pre>routes = {<br> "default-route-trust" = {<br> name = "fw-default-trust"<br> destination_range = "0.0.0.0/0"<br> vpc_network_key = "fw-trust-vpc"<br> lb_internal_name = "internal-lb"<br> }<br>}</pre>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_service_accounts"></a> [service\_accounts](#input\_service\_accounts) | A map containing each service account setting.<br><br>Example of variable deployment :<pre>service_accounts = {<br> "sa-vmseries-01" = {<br> service_account_id = "sa-vmseries-01"<br> display_name = "VM-Series SA"<br> roles = [<br> "roles/compute.networkViewer",<br> "roles/logging.logWriter",<br> "roles/monitoring.metricWriter",<br> "roles/monitoring.viewer",<br> "roles/viewer"<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/iam_service_account#Inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |
| <a name="input_vmseries"></a> [vmseries](#input\_vmseries) | A map containing each individual vmseries setting.<br><br>Example of variable deployment :<pre>vmseries = {<br> "fw-vmseries-01" = {<br> name = "fw-vmseries-01"<br> zone = "us-east1-b"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> tags = ["vmseries"]<br> service_account_key = "sa-vmseries-01"<br> scopes = [<br> "https://www.googleapis.com/auth/compute.readonly",<br> "https://www.googleapis.com/auth/cloud.useraccounts.readonly",<br> "https://www.googleapis.com/auth/devstorage.read_only",<br> "https://www.googleapis.com/auth/logging.write",<br> "https://www.googleapis.com/auth/monitoring.write",<br> ]<br> bootstrap_bucket_key = "vmseries-bootstrap-bucket-01"<br> bootstrap_options = {<br> panorama-server = "1.1.1.1"<br> dns-primary = "8.8.8.8"<br> dns-secondary = "8.8.4.4"<br> }<br> bootstrap_template_map = {<br> trust_gcp_router_ip = "10.10.12.1"<br> untrust_gcp_router_ip = "10.10.11.1"<br> private_network_cidr = "192.168.0.0/16"<br> untrust_loopback_ip = "1.1.1.1/32" #This is placeholder IP - you must replace it on the vmseries config with the LB public IP address after the infrastructure is deployed<br> trust_loopback_ip = "10.10.12.5/32"<br> }<br> named_ports = [<br> {<br> name = "http"<br> port = 80<br> },<br> {<br> name = "https"<br> port = 443<br> }<br> ]<br> network_interfaces = [<br> {<br> vpc_network_key = "fw-untrust-vpc"<br> subnetwork_key = "fw-untrust-sub"<br> private_ip = "10.10.11.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-mgmt-vpc"<br> subnetwork_key = "fw-mgmt-sub"<br> private_ip = "10.10.10.2"<br> create_public_ip = true<br> },<br> {<br> vpc_network_key = "fw-trust-vpc"<br> subnetwork_key = "fw-trust-sub"<br> private_ip = "10.10.12.2"<br> },<br> ]<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vmseries#inputs)<br><br>The bootstrap\_template\_map contains variables that will be applied to the bootstrap template. Each firewall Day 0 bootstrap will be parametrised based on these inputs.<br>Multiple keys can be added and will be deployed by the code. | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries settings.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-1029h1"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | `{}` | no |
| <a name="input_vmseries_common"></a> [vmseries\_common](#input\_vmseries\_common) | A map containing common vmseries settings.<br><br>Example of variable deployment :<pre>vmseries_common = {<br> ssh_keys = "admin:AAAABBBB..."<br> vmseries_image = "vmseries-flex-byol-10210h9"<br> machine_type = "n2-standard-4"<br> min_cpu_platform = "Intel Cascade Lake"<br> service_account_key = "sa-vmseries-01"<br> bootstrap_options = {<br> type = "dhcp-client"<br> mgmt-interface-swap = "enable"<br> }<br>}</pre>Majority of settings can be moved between this common and individual instance (ie. `var.vmseries`) variables. If values for the same item are specified in both of them, one from the latter will take precedence. | `any` | `{}` | no |
| <a name="input_vpc_peerings"></a> [vpc\_peerings](#input\_vpc\_peerings) | A map containing each VPC peering setting.<br><br>Example of variable deployment :<pre>vpc_peerings = {<br> "trust-to-spoke1" = {<br> local_network_key = "fw-trust-vpc"<br> peer_network_key = "fw-spoke1-vpc"<br><br> local_export_custom_routes = true<br> local_import_custom_routes = true<br> local_export_subnet_routes_with_public_ip = true<br> local_import_subnet_routes_with_public_ip = true<br><br> peer_export_custom_routes = true<br> peer_import_custom_routes = true<br> peer_export_subnet_routes_with_public_ip = true<br> peer_import_subnet_routes_with_public_ip = true<br> }<br>}</pre>For a full list of available configuration items - please refer to [module documentation](https://github.com/PaloAltoNetworks/terraform-google-swfw-modules/tree/main/modules/vpc-peering#inputs)<br><br>Multiple keys can be added and will be deployed by the code. | `map(any)` | `{}` | no |

### Outputs
Expand Down
10 changes: 5 additions & 5 deletions examples/multi_nic_common/example.tfvars
View file
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ networks = {
firewall_rules = {
allow-mgmt-ingress = {
name = "allow-mgmt-vpc"
source_ranges = ["1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
source_ranges = ["10.10.10.0/28"] # Set your own management source IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand All @@ -82,7 +82,7 @@ networks = {
firewall_rules = {
allow-untrust-ingress = {
name = "allow-untrust-vpc"
source_ranges = ["35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
source_ranges = ["35.191.0.0/16", "209.85.152.0/22", "209.85.204.0/22"] # Add app client IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand Down Expand Up @@ -171,7 +171,7 @@ routes = {

vmseries_common = {
ssh_keys = "admin:<YOUR_SSH_KEY>"
vmseries_image = "vmseries-flex-byol-1029h1"
vmseries_image = "vmseries-flex-byol-10210h9"
machine_type = "n2-standard-4"
min_cpu_platform = "Intel Cascade Lake"
service_account_key = "sa-vmseries-01"
Expand Down Expand Up @@ -229,7 +229,7 @@ vmseries = {
vpc_network_key = "fw-mgmt-vpc"
subnetwork_key = "fw-mgmt-sub"
private_ip = "10.10.10.2"
create_public_ip = true
create_public_ip = false
},
{
vpc_network_key = "fw-spoke1-vpc"
Expand Down Expand Up @@ -290,7 +290,7 @@ vmseries = {
vpc_network_key = "fw-mgmt-vpc"
subnetwork_key = "fw-mgmt-sub"
private_ip = "10.10.10.3"
create_public_ip = true
create_public_ip = false
},
{
vpc_network_key = "fw-spoke1-vpc"
Expand Down
4 changes: 2 additions & 2 deletions examples/multi_nic_common/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ variable "networks" {
firewall_rules = {
allow-mgmt-ingress = {
name = "allow-mgmt-vpc"
source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Replace 1.1.1.1/32 with your own souurce IP address for management purposes.
source_ranges = ["10.10.10.0/24", "1.1.1.1/32"] # Set your own management source IP range.
priority = "1000"
allowed_protocol = "all"
allowed_ports = []
Expand Down Expand Up @@ -185,7 +185,7 @@ variable "vmseries_common" {
```
vmseries_common = {
ssh_keys = "admin:AAAABBBB..."
vmseries_image = "vmseries-flex-byol-1029h1"
vmseries_image = "vmseries-flex-byol-10210h9"
machine_type = "n2-standard-4"
min_cpu_platform = "Intel Cascade Lake"
service_account_key = "sa-vmseries-01"
Expand Down
Loading

0 comments on commit a68e28d

Please sign in to comment.