{"id":8222,"date":"2019-10-22T07:37:20","date_gmt":"2019-10-22T07:37:20","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/deploy-the-palo-alto-firewall-on-amazon-web-services\/"},"modified":"2026-11-03T19:29:30","modified_gmt":"2026-11-03T19:29:30","slug":"deploy-the-palo-alto-firewall-on-amazon-web-services","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/de\/blogs\/deploy-the-palo-alto-firewall-on-amazon-web-services\/","title":{"rendered":"Deploy the Palo Alto firewall on Amazon Web Services"},"content":{"rendered":"<p><strong>Introduction<\/strong><\/p>\n<p>This article provides initial steps for deploying Palo Alto Firewall on AWS, but&nbsp;the configuration of advanced features in AWS is beyond the scope of this&nbsp;article.&nbsp;<\/p>\n<p>As the cloud computing world moves fast, network security over the cloud is of&nbsp;prime importance. Enterprises require consistent security in the cloud without&nbsp;sacrificing deployment flexibility and choice. Along with the inline threat&nbsp;prevention capabilities, the integration of the VM-series virtualized Palo Alto&nbsp;firewall with the newly announced Amazon Web Services (AWS) virtual private<br \/>\nconnection (VPC) traffic-mirroring capability gives organizations the following&nbsp;choices:<\/p>\n<ul>\n<li>&nbsp;To deploy the firewall out-of-band for application visibility.<\/li>\n<li>&nbsp;To deploy advanced threat detection in AWS cloud and extend your corporate network.<\/li>\n<\/ul>\n<p>You can move corporate applications to the cloud, launch additional web servers,&nbsp;or add more compute capacity to your network by connecting your VPC to your&nbsp;corporate network. Because you can host your VPC behind your corporate firewall,&nbsp;you can seamlessly move your IT resources into the cloud without changing how&nbsp;your users access these applications.&nbsp;<\/p>\n<p><strong>&nbsp;Overview:<\/strong><\/p>\n<p>The following detailed steps show you how to create and save key pairs,&nbsp;prepare your VPC for different subnets, and create an AWS instance with a&nbsp;Palo Alto image.<\/p>\n<p><strong>&nbsp;Step 1: Create the key pairs<\/strong><\/p>\n<p>1. Log in to your AWS account.<br \/>\n2. On the left navigation bar, choose <strong>Network Security -&gt; Key Pairs<\/strong>.<br \/>\n3. Create a key pair by giving it a name and saving the key pair. In the<br \/>\n&nbsp; &nbsp;PuTTY\u00a9&nbsp; Key Generator, choose type <em>RSA<\/em>.<br \/>\n4. Choose the PEM file you created.<br \/>\n5. Choose <strong>Save private key<\/strong>, but do not put in the password.<br \/>\n6. Save the file with a <strong>.ppk<\/strong>&nbsp;extension.<br \/>\n7. Go to PuTTY. On the left pane, choose <strong>SSH<\/strong>&nbsp;and select <strong>Auth<\/strong>.<br \/>\n8. Click <strong>Browse<\/strong>&nbsp;and point PuTTY to the <strong>.ppk<\/strong>&nbsp;file created that you just created.<br \/>\n9. Save the session by clicking on the session on the left-hand side of PuTTY<br \/>\n&nbsp; &nbsp;and select <strong>Save<\/strong>.<\/p>\n<p><strong>&nbsp;Step 2: Prepare the VPC<\/strong><\/p>\n<p>1. In AWS, choose <strong>Services -&gt; VPC<\/strong>&nbsp;and delete the default subnets.<br \/>\n2. Create four new subnets: Management, Inside, Outside, and DMZ. You can&nbsp;choose the IP addresses, but they should be in the VPC address range.<\/p>\n<p><strong>Step 3: Select the Palo Alto image<\/strong><\/p>\n<p>1. Log in to your AWS account, go to <strong>AWS Services -&gt; Under Services -&gt; EC2<\/strong>, and create an instance.<br \/>\n2. Choose <strong>Amazon Market Place<\/strong>, and search for <strong>Palo Alto<\/strong>.<br \/>\n3. Select <strong>VM-Series Next Generation Firewall Bundle 2<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture1_21.png\" alt=\"palo alto aws pic 1\" \/><\/p>\n<ul>\n<li>To choose an Amazon Machine Image (AMI), go to AWS Marketplace. On the left-hand side, search for <strong>Paloalto -&gt; Select VM-Series Next-Generation&nbsp;Firewall Bundle 2<\/strong><\/li>\n<li>Click <strong>Select<\/strong><\/li>\n<\/ul>\n<p><strong>Step 4: Create an instance<\/strong><\/p>\n<p>1. Launch a new EC2 instance by clicking the <strong>Launch Instance<\/strong>&nbsp;radio button&nbsp;as shown in the following image:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture2_18.png\" alt=\"palo alto aws pic 2\" \/><\/p>\n<ul>\n<li>To choose an Amazon Machine Image (AMI), go to AWS Marketplace. On the left-hand side, search for <strong>Paloalto -&gt; Select VM-Series Next-Generation&nbsp;Firewall Bundle 2<\/strong><\/li>\n<li>&nbsp; &nbsp; Click <strong>Select<\/strong><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture3_11.png\" alt=\"palo alto aws pic 3\" \/><\/p>\n<ul>\n<li>&nbsp;Highlight the instance type <strong>M3 Extra Large<\/strong><\/li>\n<li>&nbsp;Click <strong>Next: Configure Instance Details<\/strong><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture4_10.png\" alt=\"palo alto aws pic 4\" \/><\/p>\n<ul>\n<li>&nbsp; Configure the instance details. Select <strong>Management&nbsp;<\/strong>for the subnet,&nbsp;auto-assign the Public IP, and click <strong>Next: Add Storage&nbsp;<\/strong>as shown in&nbsp;the following images:<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture5_10.png\" alt=\"palo alto aws pic 5\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture6_7.png\" alt=\"palo alto aws pic 6\" \/><\/p>\n<ul>\n<li>Select <strong>General Purpose SSD (Solid State Drive) (GP2) Volume type&nbsp;<\/strong>and click <strong>Next: Add Tags<\/strong>.&nbsp;<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture7_7.png\" alt=\"palo alto aws pic 7\" \/><\/p>\n<ul>\n<li>&nbsp;Keep the default settings for <strong>Add Tags<\/strong>&nbsp;and click&nbsp;<strong>Next: Configure Security Group<\/strong>, use the <strong>Unrestricted Security Group<\/strong>,&nbsp;and click <strong>Review and Launch<\/strong>.<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture8_7.png\" alt=\"palo alto aws pic 8\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture9_5.png\" alt=\"palo alto aws pic 9\" \/><\/p>\n<ul>\n<li>Review all the details of the instance and click <strong>Launch<\/strong>&nbsp;<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture10_7.png\" alt=\"palo alto aws pic 10\" \/><\/p>\n<ul>\n<li>&nbsp;Select the key pair that you created previously and click <strong>Launch Instances<\/strong><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture11_6.png\" alt=\"palo alto aws pic 11\" \/><\/p>\n<p>&nbsp;Go to <strong>Services -&gt; EC2 -&gt; Instances&nbsp;<\/strong>and validate that the new&nbsp;instance is running as shown in the following image:<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture12_4.png\" alt=\"palo alto aws pic 12\" \/><\/p>\n<p><strong>&nbsp;Configure the VPC&nbsp;<\/strong><\/p>\n<p>1. Go to the VPC dashboard from <strong>Services -&gt; &nbsp;VPC -&gt; Subnets<\/strong>.<br \/>\n2. Select the <strong>Management<\/strong>&nbsp;subnet and choose the <strong>Route Table<\/strong>&nbsp;Tab.<br \/>\n3. Click <strong>Edit<\/strong>&nbsp;and associate it with the <strong>Outside Routing table<\/strong>&nbsp;to reach&nbsp;it from the Internet. Verify that the new associated Route Entry is listed&nbsp;under <strong>Route Table<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture13_3.png\" alt=\"palo alto aws pic 13\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture14_3.png\" alt=\"palo alto aws pic 14\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture15_2.png\" alt=\"palo alto aws pic 15\" \/><\/p>\n<p><strong>&nbsp;&nbsp;Assign an IP address to the instance<\/strong><\/p>\n<p>1. Go to EC2 and select your instance.<br \/>\n2. Go to <strong>Network &amp; Security<\/strong>&nbsp;on left hand side, choose <strong>Elastic IPs<\/strong>, and&nbsp;click <strong>Allocate new address<\/strong>.<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture16_2.png\" alt=\"palo alto aws pic 16\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture17_0.png\" alt=\"palo alto aws pic 17\" \/><\/p>\n<ul>\n<li>&nbsp;Click <strong>Action -&gt; Associate Address -&gt; Assign the running instance<\/strong>.<\/li>\n<li>&nbsp;Select an IP address from the drop-down menu to assign it.<\/li>\n<li>&nbsp;Click <strong>Associate<\/strong><\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture18.png\" alt=\"palo alto aws pic 18\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture19.png\" alt=\"palo alto aws pic 19\" \/><\/p>\n<p><strong>Test the configuration&nbsp;<\/strong><\/p>\n<p>Because the management interface is associated with the outside Public IP, you&nbsp;should be able to connect to the management interface with the AWS Public IP&nbsp;address outside interface of the EC2 instance by using a PuTTY session a web&nbsp;browser (for example, https:\/\/&lt;public_IP&gt;).<\/p>\n<p><strong>The following images provide some examples of this test:<\/strong><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture20.png\" alt=\"palo alto aws pic 20\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture21.png\" alt=\"palo alto aws pic 21\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/wp-content\/uploads\/2026\/blog_article_images\/26627-body-Picture22.png\" alt=\"palo alto aws pic 22\" \/><\/p>\n<p><strong>&nbsp;&nbsp;Create a Palo Alto support account<\/strong><\/p>\n<p>1. Go to <a href=\"support.paloaltonetworks.com\">support.paloaltonetworks.com<\/a>&nbsp;and&nbsp;create an account.<br \/>\n2. Log in to your Palo Alto support account.<br \/>\n3. Click the <strong>Assets<\/strong> tab.<br \/>\n4. Click <strong>Register new device<\/strong>.<br \/>\n5. Choose <strong>Software Updates<\/strong> to verify that you have access to the software.<\/p>\n<p><strong>Conclusion<\/strong><\/p>\n<p>By using the steps in this post, you can deploy and provision a Palo Alto firewall&nbsp;in AWS. Be aware that AWS is not free for Palo Alto, and you are charged per&nbsp;hour when the instance is running. The charges are for EC2 and a software license&nbsp;for Palo Alto, which runs around $1.50 an hour. There is also a monthly cost&nbsp;associated with the storage. Make sure you have the budget before you opt for&nbsp;using Palo Alto.<\/p>\n<p>After you have finished working on the instance, ensure that you stop it so that&nbsp;you incur no further charges. Don&#8217;t terminate the instance, which deletes the&nbsp;instance altogether.<br \/>\n&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Deploy the Palo Alto firewall on Amazon Web Services<\/p>\n","protected":false},"author":2,"featured_media":8224,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26627","content_type":"blog","created_by":"10130","authored_on":"2024-02-20T08:37:20+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Securely deploy Palo Alto Firewall on AWS. Gain insights into cloud network security and enterprise security expansion.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26627-insights_image-aws-technical-blog-1-insights.png","field_partners":"Amazon Web Services (AWS)","rxt_platforms":"Palo Alto Networks","product":"Amazon Web Services (AWS), Palo Alto Networks","publisheddate":"2019-10-22T07:37:20","rxt_solutions":"Security Operations","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Step-By-Step Guide: Deploying Palo Alto Firewall on AWS | Rackspace Technology","field_topics":"","field_slug":"deploy-the-palo-alto-firewall-on-amazon-web-services","footnotes":""},"categories":[178],"tags":[184,204],"class_list":["post-8222","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-amazon-web-services-aws","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/comments?post=8222"}],"version-history":[{"count":3,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8222\/revisions"}],"predecessor-version":[{"id":9984,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/blogs\/8222\/revisions\/9984"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media\/8224"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/media?parent=8222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/categories?post=8222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/de\/wp-json\/wp\/v2\/tags?post=8222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}