terraform-azurerm-scc-nva-pan-panorama

SCC bespoke Terraform module for the Palo Alto Panorama management VM. BBSWE LLD §8.1: single Panorama in UKS, no infrastructure redundancy, 2TB Premium logging disk.

Unlike doublefw + singlefw, Panorama isn't part of the vmseries-ngfw marketplace solution template — it's a separate Palo Alto offer (paloaltonetworks/panorama/byol). This module is derived from the existing BBSWE scc.nva.tf Panorama block + LLD §8.1 spec.

v0.1.0 scope

Single-VM deployment with optional public IP on the management NIC. No AvSet, no AZ (LLD: "No Infrastructure Redundancy Required").

Networking is existing-only — caller passes in the management subnet ID.

Marketplace agreement (caller-managed)

Accept once via:

az vm image terms accept --publisher paloaltonetworks --offer panorama --plan byol \
  --subscription <subscription-id>

Usage (BBSWE UKS example)

module "panorama_uks" {
  source  = "git::https://github.com/TysonTech-net/terraform-azurerm-scc-nva-pan-panorama.git?ref=v0.1.0"

  location              = "uksouth"
  resource_group_name   = "rg-hub-prod-firewall-uks-001"

  admin_username        = "panoadmin"
  admin_password_or_key = var.panorama_admin_password

  vm_name               = "vmfwpanouks001"  # LLD-pinned
  vm_size               = "Standard_D16s_v5"  # Modern equivalent of LLD-pinned F16s_v2

  image = {
    publisher = "paloaltonetworks"
    offer     = "panorama"
    sku       = "byol"
    version   = "12.1.5"  # 12.1.4 not published for Panorama
  }

  data_disk_size_gb              = 2048  # 2TB per LLD
  data_disk_storage_account_type = "Premium_LRS"  # P40

  public_ip_enabled = true
  public_ip_name    = "pip-vmfwpanouks001"

  existing_subnet_id = local.subnet_ids["uks"].management

  tags = var.tags
}

Resources created

• 1× Panorama VM (PaloAltoNetworks/swfw-modules/azurerm//modules/panorama) with single mgmt NIC
• 1× 2TB Premium SSD data disk (LUN 1) attached
• 1× Public IP attached to the mgmt NIC (when public_ip_enabled = true)

Outputs

• vm_name
• mgmt_ip_address (passthrough from underlying module)
• interfaces (NIC map passthrough)

Roadmap

v0.2.0

• subnet_new_or_existing branch (module creates subnet)
• network_security_group_new_or_existing branch (module creates NSG with admin source CIDR allow-list)
• public_ip_new_or_existing = "existing" (caller supplies pre-existing PIP ID)