ASG Module - Automatically select a Panorama template based on Availability Zone

[mattdc10]

Is your feature request related to a problem?

The bootstrap data / userdata is the same no matter which AZ the ASG deploys VM-Series into, meaning that the Panorama template assignment also stays the same. Therefore, manually changing the template assignment is required after the firewall is deployed, which effectively breaks autoscaling.

Describe the solution you'd like

firewalls deployed into region-1a should ask for panorama template region-1a, and so on

Describe alternatives you've considered.

Manually reassign the template in Panorama after deployment
Modify the Lambda function to change the template after startup
Deploy the VM-series with only 1 interface and use an AWS IGW / NATGW (not sure this is even possible)

Additional context

According to the documentation, the public interface should be set to "Automatically create default route pointing to default gateway provided by server" and the GWLB interfaces should have static routes with a variable used for the Default Gateway address. (https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/guides/aws-transit-gateway-deployment-guide page 80)

Thanks!

[sebastianczech]

hi @mattdc10 , in all autoscale examples available in this repository, we used different approach with 1 template, in which we configured multiple static routes with path monitoring .

Please take a look e.g. on README for https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/tree/main/examples/combined_design_autoscale example, especially on chapter Details - static routes with path monitoring, where you find why and what to do to make it working.

Moreover you can also find here https://github.com/PaloAltoNetworks/terraform-aws-swfw-modules/blob/main/examples/combined_design_autoscale/template-asg-path-monitoring.xml example of template with path monitoring configured.

Using that approach we can avoid creating multiple templates per AZ. Is that approach applicable in your environment ?

[mattdc10]

Hey, thank you for the reply! Yes, this should work. Not sure how i missed it while reading these documents 500 times :)