VM-Series
Deployment
Guide
51
Set Up a VM-Series NSX Edition Firewall
VM-Series NSX Edition Firewall Overview
Integrated Policy Rules
The NSX Firewall and the VM-Series firewall work in concert to enforce security; each provides a set of traffic
management rules that are applied to the traffic on each ESXi host. The first set of rules is defined on the NSX
Firewall; these rules determine traffic from which guests in the cluster are steered to the VM-Series firewall. The
second set of rules (Palo Alto Networks next-generation firewall rules) is defined on Panorama and pushed to
the VM-Series firewalls. These are security enforcement rules for the traffic that is steered to the Palo Alto
Networks NGFW service. These rules determine how the VM-Series firewall must process—that is allow, deny,
inspect, and constrain—the application for enabling it safely on your network.
Rules defined on the NSX Firewall
—The rules for directing traffic from the guests on each ESXi host
are configured on the NSX Manager. The Service Composer on the NSX Manager allows you to define what
kind of security protection, such as firewall rules to be applied to the guests in the ESXi cluster. To define
the rules on the NSX Firewall, you must first aggregate the guests into security groups, and then create NSX
service composer policies to redirect the traffic from these security groups to the Palo Alto Networks
NGFW service and/or the NSX Firewall.
The following diagram illustrates how security groups can be composed of guests across different ESXi
hosts within a cluster.
For traffic that needs to be inspected and secured by the VM-Series firewall, the NSX service composer
policies redirect the traffic to the Palo Alto Networks NGFW service. This traffic is then steered to the
VM-Series firewall and is first processed by the VM-Series firewall before it goes to the virtual switch.
