Planning Your Palo Alto Networks VM-Series MVE Deployment

This topic provides an overview of the provisioning process and describes deployment considerations for the Megaport Virtual Edge (MVE).

Palo Alto Networks VM-Series Firewall

You will need a VM-Series license from Palo Alto Networks to use on the Megaport software-defined network (SDN). For more information, see Licensing.

Megaport provides you with:

• A Virtual Machine to host the Next Generation Firewall (NGFW) image
• A Megaport Internet connection to terminate the tunnel between MVE and CPE at branch via internet
• Access to the Megaport ecosystem.

VM-Series features

VM-Series delivers NGFW services on a virtual machine. Hosting VM-Series on MVE not only optimizes edge-to-cloud network connectivity, but also enforces advanced security services and policies across the Megaport backbone segments.

The Palo Alto Networks Secure Access Service Edge (SASE) offering is for customers that are adopting the SASE architecture and need additional security for their network at the edge.

Embedding VM-Series into Megaport’s NaaS platform extends the following core SASE elements between the edge and cloud network fabric:

• Next-generation firewall, including stateful corporate firewall policies, network address translation (NAT), intrusion protection services, Secure Sockets Layer (SSL) inspection, and threat intelligence.

• Secure web gateway (SWG) services protect devices from malicious internet destinations using web content filtering and malware scanning.

• Zero trust network access (ZTNA), which controls access to applications by verifying users and devices before every application session and confirms that they meet the organization’s policy to access that application.

• Segmentation and whitelisting control applications communicating across different subnets, block lateral threat movement, and assist in achieving regulatory compliance.

• Threat Prevention, DNS Security, and WildFire services that apply application-specific policies that prevent malware and stop previously unknown threats from infecting the cloud.

VM-Series also supports remote user integration with Palo Alto Networks SASE solutions with Prisma Access. Prisma Access provides two remote user access connection methods:

• GlobalProtect – Extends Prisma Access’ visibility and control of all network traffic, applications, ports, and protocols to the user for secure access to internet or data center-based applications.
• Explicit proxy – Allows SWG access to internet-based SaaSSoftware as a Service (SaaS) is a form of cloud computing in which the provider offers the use of application software to a client and manages all the physical and software resources used by the application. SaaS is sometimes referred to as “on-demand software” and is usually priced on a pay-per-use basis or using a subscription fee.
  applications using HTTP and HTTPS.

For more information about these features, see the VM-Series Tech Docs.

Deployment considerations

This section provides an overview of the MVE deployment options and features.

Palo Alto Networks uses virtual or physical appliances much like many other platforms. However, with Palo Alto Networks, you can configure the appliances for several different uses. For example, you can configure a Palo Alto Networks appliance for use:

• Strictly as a next-generation firewall (NGFW) for remote offices with local configuration and local logging only.

• As central management with central logging, or as central management without central logging.

SD-WAN vendors

MVE is integrated with Palo Alto Networks, which uses Palo Alto network orchestrator Panorama (VM-Series) to create the private overlay network.

For information about all supported NFVsThe MVE is an on-demand, vendor-neutral Network Function Virtualization (NFV) platform that provides virtual infrastructure for network services at the edge of Megaport’s global software-defined network (SDN). Network technologies such as SD-WAN and NGFW are hosted directly on Megaport’s global network via Megaport Virtual Edge.
on the MVE platform, see the Megaport Virtual Edge (MVE) product page.

MVE locations

For a list of global locations where you can connect to an MVE, see Megaport Virtual Edge Locations.

Sizing your MVE instance

The instance size determines the MVE capabilities, such as how many concurrent connections it can support.

When choosing an MVE instance size, keep in mind these items:

• Any increase on the network data stream load can degrade performance. For example, establishing secure tunnels with IPsec, adding traffic path steering, or using deep packet inspection (DPI) can affect the maximum throughput speed.

• Future plans to scale the network.

To check which MVE instance sizes are available for your deployment, use the Megaport Portal during the MVE setup process. Instance size availability depends on both the selected vendor and the deployment location, and might vary accordingly. The Megaport Portal displays the sizes that are available for your selected vendor and location.

To check the MVE instance sizes in the Megaport Portal

1. In the Megaport Portal, go to the Services page.

2. Click Create MVE.
   

3. Select Palo Alto VM-Series.

4. Select the software version.

5. Click Next.

6. Select an MVE location.

   Select a location geographically close to your target branch and/or on-premises locations.

   You can use the Search field to find the Port name, Country, Metro City, or address of your destination Port. You can also filter by diversity zone.

7. A list of available instance sizes appear based on the selected location. Available sizes are highlighted in green and labeled Available. The sizes support varying numbers of concurrent connections, and individual partner product metrics vary slightly.

   Note

   If the MVE size you want is not in the list, then there is not enough capacity at the selected location. You can either select another location with enough capacity or contact your Account Manager to discuss requirements.

What if I need more MVE capacity in the future?

To increase your MVE capacity, you have these options:

• You can provision another MVE instance, add it to your overlay network, and split the workload between the two MVEs.

• You can provision a larger MVE instance, add it to your overlay network, migrate connections from the old MVE to the new larger MVE, and then retire the old MVE.

If you need more cores (vCPUs), you can either:

• Create a new MVE with more cores and terminate the old one (this option will require you to reconfigure your firewall).
• Create a new MVE as a second firewall to offload the capacity from the first firewall.

You can adjust the Megaport Internet bandwidth at any time without having to tear down the virtual machine.

Security

MVE provides secure capacity to and from your internet-enabled branch locations, to any endpoint or service provider on the Megaport SDN. CSP-hosted instances of partner SD-WAN products route critical traffic across the Megaport SDN, reducing internet dependence. Traffic remains encrypted and under your policy control while traveling across the Megaport SDN, to or from, MVE.

Licensing

You bring your own VM-Series license for use with MVE. It is your responsibility to have the appropriate licenses for the endpoints created on the Megaport network.

To acquire a VM-Series license, we recommend that you start with Palo Alto Networks’ credit estimator tool.

Recommendations:

• Ensure that the number of vCPUs you select suits your requirements.
• Choose Kernel-based Virtual Machine (KVM) as the Environment.
• For the best performance, we recommend that you match the number of vCPUs from your VM-Series license with the number of vCPUs on your MVE.

VLAN tagging

Megaport uses Q-in-Q802.1Q tunneling (also known as Q-in-Q or 802.1ad) is a technique used by OSI Layer 2 providers for customers. 802.1ad provides for both an inner and an outer tag whereby the outer (sometimes called S-tag for service provider) can be removed to expose the inner (C-tag or customer) tags that segment the data.
to differentiate VXCs and MVEs on a host hardware system. The tenant MVE receives untagged traffic for the internet-facing link, and single-tagged 802.1Q traffic for VXCs toward other destinations on the Megaport network (such as CSP on-ramps or other MVEs). For more information, see Configuring Q-in-Q.

vNICs

Each MVE can have up to five vNICs. A VM-Series MVE is created with two vNICs by default. You can add up to three more, making a total of five.

Before specifying the number of vNICs on your MVE:

• Be aware that the number of vNICs cannot be changed after an MVE has been ordered. Decide in advance how many vNICs to specify when you create the MVE.

• Consult your service provider to make sure that functionality won’t be affected if you add a vNIC.

For more information, see Types of vNIC Connections.