{"id":19925678,"url":"https://github.com/paloaltonetworks/google-cloud-vmseries-ipv6-tutorial","last_synced_at":"2025-10-17T09:10:58.439Z","repository":{"id":250335668,"uuid":"834143583","full_name":"PaloAltoNetworks/google-cloud-vmseries-ipv6-tutorial","owner":"PaloAltoNetworks","description":"A tutorial detailing how to configure VM-Series with IPv6 (dual-stack) in Google Cloud. ","archived":false,"fork":false,"pushed_at":"2024-11-27T17:43:52.000Z","size":4609,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-01-12T00:29:13.559Z","etag":null,"topics":["dual-stack","gcp","google-cloud","ipv4","ipv6","pan-os","terraform","vm-series","vmseries"],"latest_commit_sha":null,"homepage":"","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/PaloAltoNetworks.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-07-26T14:08:02.000Z","updated_at":"2024-11-27T17:43:56.000Z","dependencies_parsed_at":"2024-07-26T17:04:18.020Z","dependency_job_id":"272333e3-adea-4f9e-b735-4f682b59341d","html_url":"https://github.com/PaloAltoNetworks/google-cloud-vmseries-ipv6-tutorial","commit_stats":null,"previous_names":["paloaltonetworks/google-cloud-vmseries-ipv6-tutorial"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaloAltoNetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaloAltoNetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaloAltoNetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/PaloAltoNetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/PaloAltoNetworks","download_url":"https://codeload.github.com/PaloAltoNetworks/google-cloud-vmseries-ipv6-tutorial/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":241352907,"owners_count":19948941,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dual-stack","gcp","google-cloud","ipv4","ipv6","pan-os","terraform","vm-series","vmseries"],"created_at":"2024-11-12T22:23:42.708Z","updated_at":"2025-10-17T09:10:58.364Z","avatar_url":"https://github.com/PaloAltoNetworks.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Secure IPv4 \u0026 IPv6 with VM-Series on Google Cloud\n\nThis tutorial shows how to deploy and configure Palo Alto Networks VM-Series to secure IPv4 and IPv6 traffic on Google Cloud. \n\nThis guide is intended for network administrators, solution architects, and security professionals who are very familiar with [Compute Engine](https://cloud.google.com/compute) and [Virtual Private Cloud (VPC) networking](https://cloud.google.com/vpc).\n\n\u003e[!WARNING]\n\u003eIPv6 support for VM-Series on Google Cloud is currently not supported.  This open-source tutorial represents a best-effort to demonstrate how VM-Series secures IPv6 traffic on Google Cloud.\n\n## Requirements\n\nThe following are required for this tutorial:\n\n1. A Google Cloud project. \n2. Access to Google Cloud Shell to deploy the resources.\n3. If using BYOL, an VM-Series authkey to license the firewall.\n\n## Architecture\n\nThe diagram shows the resources created with Terraform.  \n\n\u003cimg src=\"images/diagram.png\"\u003e\n\nThe VM-Series has 3 network interfaces, each belonging to a dual-stack subnet in separate VPC networks.  The VM-Series is deployed to an unmanaged instance group which is a backend service of an external pass-through load balancer.  The load balancer is configured with IPv4 and IPv6 frontend addresses to distribute internet inbound traffic to the VM-Series for inspection. \n\nTest workloads are deployed to test north/south traffic.  The `external-vm` will be used to test internet inbound traffic through the VM-Series to the `internal-vm` in the trust network. \n\n\u003e[!CAUTION]\n\u003eAt the time of this writing, IPv6 traffic cannot be routed to an internal load balancer as the next hop.\n\n\n## Prepare for Deployment\n\nOn your local machine or in Google Cloud Shell, perform the following.\n\n1. Enable the required APIs, generate an SSH key, and clone the repository. \n\n    ```\n    gcloud services enable compute.googleapis.com\n    git clone https://github.com/PaloAltoNetworks/google-cloud-vmseries-ipv6-tutorial\n    cd google-cloud-vmseries-ipv6-tutorial\n    ```\n\n2. Create an SSH key to assign to the GCE instances created.\n\n    ```\n    ssh-keygen -f ~/.ssh/vmseries-tutorial -t rsa\n    ```\n\n3. Create a `terraform.tfvars`.\n\n    ```\n    cp terraform.tfvars.example terraform.tfvars\n    ```\n\n4. Edit the `terraform.tfvars` file and set values for the following variables:\n\n\n    | Key                     | Value                                                                                | Default                        |\n    | ----------------------- | ------------------------------------------------------------------------------------ | ------------------------------ |\n    | `project_id`            | The Project ID within Google Cloud.                                                  | `null`                         |\n    | `public_key_path`       | The local path of the public key you previously created                              | `~/.ssh/vmseries-tutorial.pub` |\n    | `mgmt_allow_ips`        | A list of IPv4 addresses that can have access to the VM-Series management interface. | `[\"0.0.0.0/0\"]`                |\n    | `create_test_vms`       | Set to `false` if you do not want to create the test VMs.                            | `true`                         |\n    | `vmseries_image_name`   | Set to the VM-Series image you want to deploy.                                       | `vmseries-flex-bundle1-1102`   |\n\n1. Save your `terraform.tfvars` file.\n\n\n## Deployment\nWhen no further changes are necessary, deploy the resources:\n\n1. Initialize and apply the Terraform plan.  \n\n    ```\n    terraform init\n    terraform apply\n    ```\n\n2. Enter `yes` to start the deployment.\n   \n3. After the resources are created, Terraform displays the following message:\n\n    ```\n    Apply complete!\n\n    Outputs:\n\n    EXTLB_IPv4      = \"1.2.3.4/32\"\n    EXTLB_IPv6      = \"2600:1900:4000:eba6:8000::/32\"\n    SSH_INTERNAL_VM = \"gcloud compute ssh paloalto@internal-vm  --zone=us-central1-a\"\n    SSH_EXTERNAL_VM = \"gcloud compute ssh paloalto@external-vm  --zone=us-central1-a\"\n    VMSERIES_CLI    = \"ssh admin@1.1.1.1 -i ~/.ssh/vmseries-tutorial\"\n    VMSERIES_GUI    = \"https://1.1.1.1\"\n    ```\n\n### Accessing the VM-Series firewall\n\nTo access the VM-Series user interface, a password must be set for the `admin` user.\n\n\u003e [!NOTE]\n\u003e It may take an additional 10 minutes for the VM-Series to be accessible.\n\n1. Use the `VMSERIES_CLI` output to access the VM-Series CLI.\n\n    ```\n    ssh admin@1.1.1.1 -i ~/.ssh/vmseries-tutorial\n    ```\n    \n\n2. On the VM-Series, set a password for the `admin` username. \n\n    ```\n    configure\n    set mgt-config users admin password\n    ```\n\n3. Commit the changes.\n    \n    ```\n    commit\n    ```\n\n5. Enter `exit` twice to terminate the session.\n\n6. In a browser, use the `VMSERIES_GUI` output to access the VM-Series. \n\n\n\n## Outbound IPv4/IPv6 Traffic Configuration\n\nIn this step, retrieve the required network parameters and apply them to the VM-Series configuration.\n\n\u003e [!TIP]\n\u003e DHCPv6 is available in PAN-OS 11.0 and eliminates the need to configure static IPv6 addresses.\n\n### Configure Interfaces\n\nEnable DHCPv4 and DHCPv6 on the VM-Series network interfaces to handle IPv4/IPv6 traffic. \n\n1. On the VM-Series, go to **Network → Zones**. Click **Add**.\n\n2. Create two zones: `untrust` \u0026 `trust`.\n\n    \u003cimg src=\"images/image1.png\" width=70% \u003e\n\n3. Go to **Network → Interfaces → Ethernet**. \n\n4. Configure `ethernet1/1` (`untrust`) as follows:\n\n    \u003cimg src=\"images/image2.png\" width=70% \u003e\n\n    \u003e In IPv4 tab, **check** `Automatically create default route`. \u003c/br\u003e\n    \u003e In IPv6 tab, **check** `Accept Router Advertised Route` and **uncheck** `Enable Prefix Delegation`.\n\n5. Configure `ethernet1/2` (`trust`) as follows:\n\n    \u003cimg src=\"images/image3.png\" width=70% \u003e\n\n    \u003e In IPv4 tab, **uncheck** `Automatically create default route`. \u003c/br\u003e\n    \u003e In IPv6 tab, **uncheck** `Accept Router Advertised Route` and **uncheck** `Enable Prefix Delegation`.\n\n6. **Commit the changes.**\n\n\n### Retrieve IPv6 Parameters\n\nRetrieve the default gateways for the untrust \u0026 trust subnets and the ULA for the trust VPC. \n\n1. On `ethernet1/1`, click **Dynamic-DHCPv6 Client**.\n\n2. Record the **Server** and **IPv6 Address (Non-Temporary)** addresses.\n\n    \u003cimg src=\"images/image4.png\" width=40% \u003e\n\n    \u003e **Server** address is the IPv6 default gateway for the untrust network.\u003cbr\u003e\n    \u003e **IPv6 Address** is the external IPv6 address assigned to the untrust interface.\n\n3. On `ethernet1/2`, click **Dynamic-DHCPv6 Client**.\n\n4. Record the **Server** address.\n\n    \u003cimg src=\"images/image5.png\" width=40% \u003e\n\n    \u003e **Server** address is the IPv6 default gateway of the trust network.\n\n5. In to Google Cloud, go to **VPC Networks →** `trust-vpc`.\n\n6. Record the **VPC network ULA internal IPv6 range**.\n\n    \u003cimg src=\"images/image6.png\" width=20% \u003e\n\n    \u003e The ULA covers all of the possible IPv6 prefixes within the trust VPC.\n\n### Configure Virtual Router\n\nOn the VM-Series, create an IPv4 \u0026 IPv6 routes to correctly return traffic to the trust VPC.\n\n1. Go to **Network → Virtual Routers**.  Select the `default` virtual router. \n\n2. Click **Static Routes → IPv4**.  Click **+ Add**. \n\n3. Configure the IPv4 return route as follows:\n\n    \u003cimg src=\"images/image7.png\" width=40% \u003e\n\n4. Click **Static Routes → IPv6**.  Click **+ Add**. \n\n5. Configure the IPv6 return route as follows:\n\n    \u003cimg src=\"images/image8.png\" width=40% \u003e\n\n    |                    | IPv4 Route                          | IPv6 Route                   |\n    |--------------------|-------------------------------------|------------------------------|\n    | **Name**           | `ipv4-trust`                        | `ipv6-trust`                 |\n    | **Destination**    | `IPv4 CIDR of trust network`        | `ULA range of trust VPC`     |\n    | **Next Hop**       | `IP Address`                        | `IPv6 Address`               |\n    | **Next Hop Value** | `eth1/2 IPv4 gateway IP`            | `eth1/2 IPv6 Server Address` |\n\n6.  Click **OK**.\n\n\n\n### Configure IPv4/IPv6 NAT Policies for Outbound Traffic\n\nCreate a NAT rule to translate trust VPC traffic to the external IPv4/v6 addresses attached to the untrust interface. \n\n1. Go to **Policies → NAT**.  Click **Add**.\n\n2. Create a NAT policy to translate outbound IPv4 traffic.\n\n    \u003cimg src=\"images/image9.png\" width=70% \u003e\n\n3. Create a NPTv6 NAT policy to translate outbound IPv6 traffic.  \n\n    \u003cimg src=\"images/image10.png\" width=70% \u003e\n\n    \u003eSet the **IPv6 Address (Non-Temporary)** IP on `eth1/1` as the translated address (use a `/96` prefix).\n\n### Create Security Policy\n\nFor the purposes of this tutorial, create a security policy to allow `ping`, `ping6`, \u0026 `web-browsing`. \n\n\u003e[!CAUTION]\n\u003eThis tutorial does not provide guidance on security policy implementation. \n\n\n1. Go to **Policies → Security**. Click **Add**.\n\n2. Configure the security policy to allow `ping`, `ping6`, \u0026 `web-browsing`.\n\n    \u003cimg src=\"images/image11.png\" width=70% \u003e\n\n4. **Commit the changes**.\n\n5. In Cloud Shell, create default routes in the `trust-vpc` to steer IPv4/IPv6 traffic to the VM-Series trust interface for inspection. \n    \n    ```\n    gcloud compute routes create ipv4-default \\\n        --network=trust-vpc \\\n        --destination-range=0.0.0.0/0 \\\n        --next-hop-instance=vmseries \\\n        --next-hop-instance-zone=us-central1-a\n\n    gcloud beta compute routes create ipv6-default \\\n        --network=trust-vpc \\\n        --destination-range=::0/0 \\\n        --next-hop-instance=vmseries \\\n        --next-hop-instance-zone=us-central1-a\n    ```\n\n\n\n\n\n### Test Outbound Internet Traffic\n\nAccess the `internal-vm` in the trust network and generate outbound IPv4/IPv6 internet traffic.\n\n1. In Cloud Shell, SSH to the `internal-vm`.\n\n    ```\n    gcloud compute ssh paloalto@internal-vm --zone=us-central1-a\n    ```\n\n2. Ping an external IPv4 address to test outbound IPv4 traffic. \n\n    ```\n    ping 8.8.8.8 \n    ```\n\n3. Ping an external IPv6 address to test outbound IPv6 traffic. \n\n    ```\n    ping6 2600::\n    ```\n\n4. On the VM-Series, go to **Monitor → Traffic**.  Enter the filter below to search for the outbound traffic. \n\n    ```\n    ( app eq 'ping6' ) or ( app eq 'ping' )\n    ```\n\n    \u003cimg src=\"images/image15.png\" width=70%\u003e\n\n    \u003eYou should see that IPv4 \u0026 IPv6 traffic from the `internal-vm` is translated correctly by the VM-Series.\n\n\n\n## Inbound IPv4/IPv6 Traffic Configuration\nIn this section, you will configure the VM-Series to translate inbound internet traffic, which is distributed by an external pass-through load balancer, to reach the a web application running on the `internal-vm` in the trust VPC.\n\n\u003e[!NOTE]\n\u003eThe Terraform plan creates an external load balancer and health check for you.\n\n\n### Configure Health Checks\nSetup a loopback interface to receive the load balancer's IPv4/IPv6 health checks. Then, create a NAT policy to translate IPv4 health checks to the IPv4 loopback address and create a security policy to allow the health checks.\n\n#### Configure loopback interface\n\n1. In Google Cloud, go to **Network Services → Load Balancers**. \n\n2. Click the `vmseries-extlb` load balancer. Record the IPv6 address assigned to the forwarding rule.\n\n    \u003cimg src=\"images/image17.png\" width=70% \u003e\n\n3. On the VM-Series, go to **Network → Zones**. Click **Add**.\n\n4. Create a zone called `lb-checks`.\n\n    \u003cimg src=\"images/image18.png\" width=40% \u003e\n\n5. Go to **Network → Network Profiles → Interface Mgmt**. click **Add**.\n\n6. Enable `HTTP` and add the [Health Check Ranges](https://cloud.google.com/load-balancing/docs/health-checks#fw-netlb) (`35.191.0.0/16`, `209.85.152.0/22`, `209.85.204.0/22`, `2600:1901:8001::/48`) as permitted addresses.\n    \n    \u003cimg src=\"images/image19.png\" width=40% \u003e\n\n7. Go to **Network → Interfaces → Loopback**. Click **Add**.\n\n8. In the **Config Tab**, set tunnel to `1`, **Virtual Router** to `default`, \u0026 **Zone** to `lb-checks`.\n    \n    \u003cimg src=\"images/image20.png\" width=40% \u003e\n\n9. In the **IPv4 Tab**, set `100.64.0.1/32` as the address.\n    \n    \u003cimg src=\"images/image21.png\" width=40% \u003e\n\n10. In the **IPv6 Tab**, set load balancer's IPv6 forwarding rule address.\n    \n    \u003cimg src=\"images/image22.png\" width=40% \u003e\n\n11. In the **Advanced Tab**, set the **Management Profile** to `lb-checks`\n\n    \u003cimg src=\"images/image23.png\" width=40% \u003e\n\n\n#### Create NAT for IPv4 Health Checks\n\n1. Go to **Policies → NAT**. Click **Add**.\n\n2. Configure the policy to translate the IPv4 health check ranges to the IPv4 loopback address.\n\n    \u003cimg src=\"images/image24.png\" width=50% \u003e\n\n#### Create Security Policy for IPv4/IPv6 Health Checks\n\n1. Go to **Policies → Security**. Click **Add**.\n\n2. Configure the policy to allow IPv4 \u0026 IPv6 health check ranges to the `lb-checks` zone.\n   \n    \u003cimg src=\"images/image25.png\" width=80% \u003e\n\n\u003e [!Important]\n\u003e Move the policy to the top of the rule set before committing the changes.\n\n3. **Commit the changes.**\n\n4. In Google Cloud, verify the health checks are up on the `vmseries-extlb`. \n    \n    \u003cimg src=\"images/image26.png\" width=70% \u003e\n\n\n### Configure NAT Policy for IPv4 Forwarding Rule\n\nCreate a NAT policy to translate traffic destined to the IPv4 forwarding rule to a web app on the `internal-vm` in the trust VPC.\n\n1. In Google Cloud, record IPv4 \u0026 IPv6 addresses of the `internal-vm`.\n    \n    \u003cimg src=\"images/image27.png\" width=70% \u003e\n\n2. On the VM-Series, go to **Policies → NAT**. Click **Add**.  \n\n3. Configure the policy to translate the IPv4 forwarding rule to the `internal-vm` IPv4 address.\n\n    \u003cimg src=\"images/image28.png\" width=70% \u003e\n\n    | NAT Policy             |                       |                                               |\n    |------------------------|-----------------------|-----------------------------------------------|\n    | **Original Packet**    | Source Zone           | `untrust`                                     |\n    |                        | Destination Zone      | `untrust`                                     |\n    |                        | Destination Interface | `ethernet1/1`                                 |\n    |                        | Destination Address   | `34.29.169.107` (IPv4 fowarding rule address) |\n    | **Source Translation** | Translation Type      | `Dynamic IP and Port`                         |\n    |                        | Address Type          | `Interface Address`                           |\n    |                        | Interface             | `ethernet1/2`                                 |\n    | **DST Translation**    | Translation Type      | `Dynamic IP`                                  |\n    |                        | Translated Address    | `10.0.3.10` (IPv4 of `internal-vm`)           |\n\n\n\u003e [!IMPORTANT]  \n\u003e When load balancing internet inbound traffic through multiple firewalls, source translation is necessary to ensure a synchronous response from the backend application.\n\n\n\n### Configure NPTv6 Policy for IPv6 Forwarding Rule\nCreate an NPTv6 policy to translate traffic destined to the IPv6 forwarding rule to the web app on `internal-vm`. \n\n\u003e [!NOTE] \n\u003e NPTv6 performs stateless translation, moving traffic from one IPv6 prefix to another by eliminating the IPv6 header checksum.\n\u003e Therefore, a checksum-neutral address must be calculated and used as the original packet's destination in the NPTv6 policy.\n\n#### Generate Checksum Neutral Address on VM-Series \n\n1. In Cloud Shell, SSH to the VM-Series using its management IP. \n\n    ```\n    ssh admin@1.1.1.1\n    ```\n\n2. Use the `test nptv6` command to generate the checksum for traffic between the IPv6 address of the `internal-vm` and the IPv6 forwarding rule address on the load balancer.\n\n    ```\n    test nptv6 cks-neutral source-ip fd20:eb0:af94:0:0:0:0:0 dest-network 2600:1900:4000:5db5:8000:1:0:0/96\n    ```\n    \n    \u003e Replace `fd20:eb0:af94:0:0:0:0:0` with the IPv6 address of your internal-vm and replace `2600:1900:4000:5db5:8000:1:0:0/96` with the IPv6 address assigned to your load balancer's forwarding rule. \n \n\n3. Record the generated checksum neutral address.\n    \n    **(Output)**\n    \u003cpre\u003e\n    The checksum neutral address of fd20:eb0:af94:: is \u003cb\u003e2600:1900:4000:5db5:8000:1:5eae:0\u003c/b\u003e in 2600:1900:4000:5db5:8000:1:0:0/96 subnet\n    \u003c/pre\u003e\n\n\n#### Create NPTv6 Policy\n\n1. On the VM-Series, go to **Policies → NAT**. Click **Add**.  \n\n2. Set **NAT Type** to `nptv6`.\n\n2. Configure the policy to translate the checksum IP to the `internal-vm` IPv6 address.\n\n    \u003cimg src=\"images/image29.png\" width=70% \u003e\n\n    | NPTv6 Policy           |                       |                                                                |\n    |------------------------|-----------------------|----------------------------------------------------------------|\n    | **Original Packet**    | Source Zone           | `untrust`                                                      |\n    |                        | Destination Zone      | `untrust`                                                      |\n    |                        | Destination Interface | `ethernet1/1`                                                  |\n    |                        | Destination Address   | `2600:1900:4000:5db5:8000:1:5eae:0` (checksum neutral address) |\n    | **DST Translation**    | Translation Type      | `Dynamic IP`                                                   |\n    |                        | Translated Address    | `fd20:eb0:af94:0:0:0:0:0/96` (IPv6 of `internal-vm`)           |\n\n\n\n\n\n### Test Inbound Internet Traffic\n\nAccess the `external-vm` to test internet inbound traffic through the IPv4/IPv6 external load balancer to the web application on `internal-vm`. \n\n1. In Cloud Shell, SSH to the external VM.\n\n    ```\n    gcloud compute ssh paloalto@external-vm  --zone=us-central1-a\n    ```\n\n2. Attempt to reach the web application using the load balancer's IPv4 address.\n\n    ```\n    curl http://34.29.169.107:80/?[1-3]\n    ```\n\n3. Attempt to reach the web application using the **checksum neutral** IPv6 address.\n\n    ```\n    curl -6 'http://[2600:1900:4000:5db5:8000:1:5eae:0]:80/?[1-3]'\n    ```\n\n4. On the VM-Series, go to **Monitor → Traffic**.  Enter the filter below to search for the inbound traffic. \n\n    ```\n    ( zone.src eq 'untrust' ) and ( zone.dst eq 'trust' ) and ( app eq 'web-browsing' )\n    ```\n    \n    \u003cimg src=\"images/image30.png\" width=80%\u003e\n\n    \u003e You should see that both IPv4 and IPv6 traffic is inspected and translated correctly by the VM-Series firewall.\n\n\n## Clean up\n\n1. To delete the created resources, run the commands below.\n\n    ```\n    gcloud compute routes delete ipv4-default -q\n    gcloud compute routes delete ipv6-default -q\n    terraform destroy\n    ```\n\n2. At the prompt to perform the actions, enter `yes`. \n   \n   After all the resources are deleted, Terraform displays the following message:\n\n    ```\n    Destroy complete!\n    ```\n\n## Additional information\n\n* Learn about the[ VM-Series on Google Cloud](https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/set-up-the-vm-series-firewall-on-google-cloud-platform/about-the-vm-series-firewall-on-google-cloud-platform).\n* Getting started with [Palo Alto Networks PAN-OS](https://docs.paloaltonetworks.com/pan-os). \n* Read about [securing Google Cloud Networks with the VM-Series](https://cloud.google.com/architecture/partners/palo-alto-networks-ngfw).\n* Learn about [VM-Series licensing on all platforms](https://docs.paloaltonetworks.com/vm-series/10-2/vm-series-deployment/license-the-vm-series-firewall/vm-series-firewall-licensing.html#id8fea514c-0d85-457f-b53c-d6d6193df07c).\n* Use the [VM-Series Terraform modules for Google Cloud](https://registry.terraform.io/modules/PaloAltoNetworks/vmseries-modules/google/latest). \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaloaltonetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpaloaltonetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpaloaltonetworks%2Fgoogle-cloud-vmseries-ipv6-tutorial/lists"}