Deploying Palo Alto VM-Series Firewall in OCI with Network Load Balancer (NLB)

Securing cloud infrastructure requires robust network controls and traffic inspection. In Oracle Cloud Infrastructure (OCI), integrating third-party firewalls like Palo Alto VM-Series enhances security by enabling deep packet inspection and controlled routing.

In this article, I demonstrate a hands-on deployment of Palo Alto Firewall in OCI integrated with a Private Network Load Balancer (NLB).

🔹 Architecture Overview

This deployment follows a hub-based architecture where Palo Alto firewalls act as centralized security gateways.

Components:

• OCI Virtual Cloud Network (VCN)
• Load Balancer Subnet and Trust Subnet
• Palo Alto VM-Series Firewall (2 instances)
• Network Load Balancer (Private)
• NAT Gateway

Traffic Flow:

Client → NLB → Firewall → Backend Servers ↓ NAT Gateway → Internet

🔹 VCN and Subnet Configuration

• VCN CIDR: 10.130.0.0/16
• Load Balancer Subnet: 10.130.1.0/24
• Trust Subnet: 10.130.0.160/28

🔹 Security Configuration

Security lists were configured to allow required traffic:

• Ingress: 0.0.0.0/0 (All protocols)
• Egress: 0.0.0.0/0 (All protocols)

This ensured no restrictions at the OCI layer during testing.

🔹 Route Table Configuration

• Default Route: 0.0.0.0/0 → NAT Gateway

This enables outbound internet connectivity for private resources.

🔹 Palo Alto Firewall Deployment

Two firewall instances were deployed:

• pa-srvsgmt-01
• pa-srvsgmt-02

Access:

• SSH access verified
• Web UI successfully accessed

🔹 License Activation Issue & Fix

Issue:

License activation failed due to lack of internet connectivity.

Resolution:

• Configured NAT Gateway route
• Enabled outbound traffic

Result:

License activation completed successfully.

🔹 MTU Configuration

• Enabled Jumbo Frames
• MTU configured to ~9000+
• Firewall rebooted to apply changes

🔹 Interface (VNIC) Configuration

Issue:

VNICs created in OCI were not visible in the firewall.

Fix:

Interfaces appeared after refresh.

Mapping:

• ethernet1/1 → Trust
• ethernet1/2 → Untrust

🔹 Security Policy Configuration

• Rule: intrazone-default
• Action: Allow
• Logging: Enabled

🔹 Virtual Router Configuration

Configured routes:

• 0.0.0.0/0 → Internet
• Internal CIDRs → Trust

🔹 Network Load Balancer (NLB) Setup

• Type: Private
• Listener: TCP/UDP (Any Port)
• Backends:
• 10.130.0.162
• 10.130.0.163

🔹 Connectivity Issue & Troubleshooting

Problem:

• 100% packet loss when pinging external IP (8.8.8.8)

Root Cause:

• Incorrect routing configuration
• Improper traffic flow between NLB and firewall
• Missing management profile on interfaces

Fix:

• Updated route tables
• Enabled management profile (Ping & SSH)
• Allowed Load Balancer subnet in firewall rules

Result:

Connectivity restored successfully.

🔹 Final Outcome

• Secure traffic flow established
• Firewall successfully integrated with NLB
• Backend connectivity stabilized
• Internet access restored

🔹 Conclusion

Deploying Palo Alto VM-Series Firewall in OCI with NLB provides a scalable and secure architecture for managing network traffic. Proper routing, IAM configuration, and firewall policies are critical to ensuring seamless connectivity and security.

This hands-on implementation provided practical insights into real-world cloud security architecture and troubleshooting in OCI.