Planning Your Palo Alto MVE Deployment
This topic provides an overview of the provisioning process and describes deployment considerations for the Megaport Virtual Edge (MVE).
You will need a VM-Series license to use on the Megaport software-defined network (SDN). Megaport provides you with:
- A Virtual Machine to host the Next Generation Firewall (NGFW) image
- An IP Transit connection with Distributed Denial of Service (DDoS) to terminate the tunnel between MVE and CPE at branch via internet
- Access to the Megaport ecosystem
Palo Alto Networks uses virtual or physical appliances much like many other platforms. However, with Palo Alto Networks, you can configure the appliances for several different uses. For example, you can configure a Palo Alto Networks appliance for use:
Strictly as a next-generation firewall (NGFW) for remote offices with local configuration and local logging only.
As central management with central logging, or as central management without central logging.
VM-Series delivers NGFW services on a virtual machine. Hosting VM-Series on MVE not only optimizes edge-to-cloud network connectivity, but also enforces advanced security services and policies across the Megaport backbone segments.
The Palo Alto Networks SASE offering is for customers that are adopting the SASE architecture and need additional security for their network at the edge.
Embedding VM-Series into Megaport’s NaaS platform extends the following core Secure Access Service Edge (SASE) elements between the edge and cloud network fabric:
Next-generation firewall, including stateful corporate firewall policies, network address translation (NAT), intrusion protection services, Secure Sockets Layer (SSL) inspection, and threat intelligence.
Secure web gateway (SWG) services protect devices from malicious internet destinations using web content filtering and malware scanning.
Zero trust network access (ZTNA), which controls access to applications by verifying users and devices before every application session and confirms that they meet the organization’s policy to access that application.
Segmentation and whitelisting control applications communicating across different subnets, block lateral threat movement, and assist in achieving regulatory compliance.
Threat Prevention, DNS Security, and WildFire services apply application specific policies that prevent malware and stop previously unknown threats from infecting the cloud.
VM-Series also supports remote user integration with Palo Alto SASE solutions with Prisma Access. Prisma Access provides two remote user access connection methods:
- GlobalProtect – Extends Prisma Access’ visibility and control of all network traffic, applications, ports, and protocols to the user for secure access to internet or data center-based applications.
- Explicit proxy – Allows SWG access to internet-based SaaS applications using HTTP and HTTPS.
For more information on these features, see the VM-Series Tech Docs.
If you have already deployed a VM-Series firewall, you can connect it to an MVE so that your headquarters or branches can access cloud services over private interconnects.
For a list of global locations where you can connect to an MVE, see Megaport Virtual Edge Locations.
The instance size determines the MVE capabilities, such as how many concurrent connections it can support. The MVE instances are consolidated into these sizes:
|Package Size||vCPUs||DRAM||Storage||IP Transit Speed *|
|MVE 2/8||2||8 GB||60 GB||Adjustable from 20 Mbps to 10 Gbps|
|MVE 4/16||4||16 GB||60 GB||Adjustable from 20 Mbps to 10 Gbps|
|MVE 8/32||8||32 GB||60 GB||Adjustable from 20 Mbps to 10 Gbps|
|MVE 12/48||12||48 GB||60 GB||Adjustable from 20 Mbps to 10 Gbps|
* The IP Transit access is symmetric, redundant, diverse, and includes DDoS scrubbing protection. IP Transit access is adjustable through the Transit VXC connection that you attach to the MVE.
When choosing an MVE instance size, keep in mind these items:
Any increase on the network data stream load can degrade performance. For example, establishing secure tunnels with IPsec, adding traffic path steering, or using deep packet inspection (DPI) can impact the maximum throughput speed.
Future plans to scale the network.
What if I need more MVE capacity in the future?
You have a couple of options:
You can provision another MVE instance, add it to your SD-WAN overlay network, and split the workload between the two MVEs.
You can provision a larger MVE instance, add it to your SD-WAN overlay network, migrate connections from the old MVE to the new larger MVE, and then retire the old MVE.
If you need more cores (vCPUs), you can either:
- Order a new MVE with more cores and terminate the old one (this option will require you to reconfigure your firewall).
- Order a new MVE as a second firewall to offload the capacity from the first firewall.
You can adjust the IP Transit bandwidth at any time without having to tear down the virtual machine.
You bring your own VM-Series license for use with MVE. It is your responsibility to have the appropriate licenses for the endpoints created on the Megaport network.
To acquire a VM-Series License, we recommend that you start with Palo Alto Networks’ credit estimator tool.
- Ensure that the number of vCPUs you select suits your requirements.
- Choose Kernel-based Virtual Machine (KVM) as the Environment.
- For the best performance, we recommend that you match the number of vCPUs from your VM-Series license with the number of vCPUs on your MVE.
Megaport uses Q-in-Q to differentiate VXCs and MVEs on a host hardware system. The tenant MVE receives untagged traffic for the internet-facing link, and single-tagged 802.1Q traffic for VXCs toward other destinations on the Megaport network (such as CSP onramps or other MVEs).