terraform-aviatrix-mc-firenet

Description

Aviatrix Terraform module for firenet deployment in multiple clouds, to be used in conjunction with mc-transit module.

Compatibility

Module version	Terraform version	Controller version	Terraform provider version	mc-transit module version
v1.4.0	>=1.1.0	>= 7.0	~> 3.0.0	~> v2.4.0

Check release notes for more details. Check Compatibility list for older versions.

Usage Example

module "mc_transit" {
  source  = "terraform-aviatrix-modules/mc-transit/aviatrix"
  version = "v2.2.0"

  cloud                  = "AWS"
  cidr                   = "10.1.0.0/23"
  region                 = "eu-central-1"
  account                = "AWS"
  enable_transit_firenet = true
}

module "firenet_1" {
  source  = "terraform-aviatrix-modules/mc-firenet/aviatrix"
  version = "v1.2.0"

  transit_module = module.mc_transit
  firewall_image = "Palo Alto Networks VM-Series Next-Generation Firewall Bundle 1"
}

Variables

The following variables are required:

key	value
firewall_image	The firewall image to be used to deploy the NGFW's. Use "aviatrix" to deploy Aviatrix FQDN egress filtering GW's (AWS/Azure/GCP).
transit_module	Refer to the mc-transit module that built the transit. This module plugs directly into it's output to build firenet on top of it.

The following variables are optional:

= AWS, = Azure, = GCP, = OCI, = Alibaba

Key	Supported_CSP's	Default value	Description
associated		true	Associate firewalls with transit gateway.
attached		true	Attach firewall instances.
bootstrap_bucket_name_1			Name of bootstrap bucket to pull firewall config from. (If bootstrap_bucket_name_2 is not set, this will used for all NGFW instances)
bootstrap_bucket_name_2			Name of bootstrap bucket to pull firewall config from. (Only used if 2 or more FW instances are deployed, e.g. when ha_gw is true. Applies to "even" fw instances (2,4,6 etc))
bootstrap_storage_name_1			Storagename to get bootstrap files from (PANW only). (If bootstrap_storage_name_2 is not set, this will used for all NGFW instances)
bootstrap_storage_name_2			Storagename to get bootstrap files from (PANW only) (Only used when HA FW instance is deployed)
custom_fw_names		[]	If set, the NGFW instances will be deployed with the names provided in this list. First half of the list for instances in az1, second half for az2.
east_west_inspection_excluded_cidrs			Network List Excluded From East-West Inspection.
egress_cidr			CIDR For Egress VPC for GCP Firenet. Only required when deploying in GCP and enable_transit_firenet is true.
egress_enabled		false	Enable/disable internet egress via NGFW.
egress_static_cidrs		[]	List of egress static CIDRs. Egress is required to be enabled. Example: ["1.171.15.184/32", "1.171.15.185/32"].
file_share_folder_1			Name of the folder containing the bootstrap files (PANW only) (If file_share_folder_2 is not set, this will used for all NGFW instances)
file_share_folder_2			Name of the folder containing the bootstrap files (PANW only) (Only used when HA FW instance is deployed)
firewall_image_id			Firewall image ID. Applicable to AWS and Azure only. For AWS, please use AMI ID. For Azure, the format is “Publisher:Offer:Plan:Version”.
firewall_image_version			When not provided, latest available will be used.
fw_amount			The amount of NGFW instances to deploy. These will be deployed accross multiple AZ's. Amount must be even and only applies when transit is HA.
iam_role_1			IAM Role used to access bootstrap bucket. (If iam_role_2 is not set, this will used for all NGFW instances)
iam_role_2			IAM Role used to access bootstrap bucket. (Only used if 2 or more FW instances are deployed, e.g. when ha_gw is true. Applies to "even" fw instances (2,4,6 etc))
inspection_enabled		true	Enable/disable east/west + north/south inspection via NGFW.
instance_size		c5.xlarge Standard_D3_v2 n1-standard-4 VM.Standard2.4	Size of the NGFW instances
keep_alive_via_lan_interface_enabled		False	Enable Keep Alive via Firewall LAN Interface.
key_name			Applicable to AWS deployment only. AWS Key Pair name. If not provided a Key Pair will be generated.
mgmt_cidr			CIDR For Management VPC for GCP Firenet. Only required when deploying in GCP and enable_transit_firenet is true and deploying Palo Alto NGFW.
password		Aviatrix#1234	Default initial password for firewall instances
ssh_public_key			Initial SSH public key for firewall instances. You can either set a password or an SSH key, but not both.
storage_access_key_1			Storage_access_key to access bootstrap storage (PANW only) (If storage_access_key_2 is not set, this will used for all NGFW instances)
storage_access_key_2			Storage_access_key to access bootstrap storage (PANW only) (Only used when HA FW instance is deployed)
tags			Map of tags to assign to the firewall or FQDN egress gw's.
sic_key			Sic key. Applicable to Check Point Series deployment only.
user_data_1			Userdata to bootstrap FortiGate or Checkpoint Firewall.
user_data_2			Userdata to bootstrap FortiGate or Checkpoint Firewall. If not set, user_data_1 will be used.
username		fwadmin	Applicable to Azure or AzureGov deployment only. "admin" as a username is not accepted. (For Checkpoint it is always admin)

Outputs

This module will return the following objects:

key	description
aviatrix_firenet	The created Aviatrix firenet object with all of it's attributes.
aviatrix_firewall_instance	A list of the created firewall instances and their attributes.

Common Errors

When using a firewall_image string that does not exist, a data lookup will fail and throw the error below. Make sure you are using a valid firewall_image. These can differ between clouds. Check the Aviatrix controller UI to see available firewall images.

│ Error: Invalid index
│ 
│   on variables.tf line 172:
│   (source code not available)
│ 
│ The given key does not identify an element in this collection value: the collection has no elements.