>
    Strata Copilot
    CN-Series Prerequisites and Supported Environments
    Focus
    Download PDF
    Focus
    1. Home
    2. CN-Series
    3. Activation and Onboarding of CN-Series
    4. CN-Series Prerequisites and Supported Environments
    Download PDF
    CN-Series

    CN-Series Prerequisites and Supported Environments

    Table of Contents

    CN-Series Prerequisites and Supported Environments

    Learn about the compatibility and version requirements for the CN-Series firewall.
    Where Can I Use This?What Do I Need?
    • CN-Series deployment
    • CN-Series 10.1.x or above Container Images
    • Panorama running PAN-OS 10.1.x or above version
    • Helm 3.6 or above version client for CN-Series deployment with Helm Chart
    This chapter provides information on compatibility and version requirements for the CN-Series firewall.

    PAN-OS 10.1

    PAN-OS 10.1 supported deployment environments.
    You can deploy the CN-Series firewall in the following environments:
    ProductVersion
    Container runtime
    Docker
    CRI-O
    Containerd
    Kubernetes version
    1.17 through 1.33
    Cloud provider managed Kubernetes
    • AWS EKS (1.17 through 1.33 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
    • EKS on AWS Outpost (1.17 through 1.33)
      CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
    • Azure AKS (1.17 through 1.33)
      In Azure AKS, the PAN-OS 10.1.10h1 is the minimum required version to support kubernetes 1.25 and above.
    • AliCloud ACK (1.26)
    • GCP GKE (1.17 through 1.33)
      Includes GKE Dataplane V2.
    Customer managed Kubernetes
    On the public cloud or on-premise data center.
    Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
    VMware TKG+ version 1.1.2
    • Infrastructure Platform—vSphere 7.0
    • Kubernetes Host VM OS—Photon OS
    Kubernetes Host VM
    Operating System:
    • Ubuntu 16.04
    • Ubuntu 18.04
    • Ubuntu 22.04
    • RHEL/Centos 7.3 and later
    • CoreOS 21XX, 22XX
    • Container-Optimized OS
    Linux Kernel Version:
    Linux Kernel Netfilter: Iptables
    CNI Plugins
    CNI Spec 0.3 and later:
    • AWS-VPC
    • Azure
    • Calico
    • Flannel
    • Weave
    • For AliCloud, Terway
    • For Openshift, OpenshiftSDN
    • The following are supported on the CN-Series firewall as a DaemonSet.
      • Multus
      • Bridge
      • SR-IOV
      • Macvlan
    OpenShift
    CN-Series as a DaemonSet:
    4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, and 4.13
    CN-Series as a K8s Service:
    (PAN-OS 10.1.2 and later)
    4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15.
    The PAN-OS 10.1.10h1 is the minimum required version to support 4.12 and above.
    Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

    PAN-OS 10.2

    PAN-OS 10.2 supported deployment environments.
    You can deploy the CN-Series firewall in the following environments:
    ProductVersion
    Container runtime
    Docker
    CRI-O
    Containerd
    Kubernetes version
    1.17 through 1.33
    Cloud provider managed Kubernetes
    • AWS EKS (1.17 through 1.33 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
    • AWS EKS (1.17 through 1.33 for CN-Series as a CNF mode of deployment.)
    • EKS on AWS Outpost (1.17 through 1.33)
      CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
    • Azure AKS (1.17 through 1.33)
      In Azure AKS, the PAN-OS 10.2.4h3 is the minimum required version to support kubernetes 1.25 and above.
    • GCP GKE (1.17 through 1.33)
      In GCP GKE, the PAN-OS 10.2.4h3 is the minimum required version to support kubernetes 1.25 and above.
      Includes GKE Dataplane V2.
    • Google Anthos 1.12.3
    • OCI OKE (1.23)
    Customer managed Kubernetes
    On the public cloud or on-premise data center.
    Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in the table.
    VMware TKG+ version 1.1.2
    • Infrastructure Platform—vSphere 7.0
    • Kubernetes Host VM OS—Photon OS
    Kubernetes Host VM
    Operating System:
    • Ubuntu 16.04
    • Ubuntu 18.04
    • Ubuntu 22.04
    • RHEL/Centos 7.3 and later
    • CoreOS 21XX, 22XX
    • Container-Optimized OS
    Linux Kernel Version:
    Linux Kernel Netfilter: Iptables
    CNI Plugins
    CNI Spec 0.3 and later:
    • AWS-VPC
    • Azure
    • Calico
    • Flannel
    • Weave
    • For Openshift, OpenshiftSDN, OVN Kubernetes
    • The following are supported on the CN-Series firewall as a DaemonSet.
      • Multus
      • Bridge
      • SR-IOV
      • Macvlan
    OpenShift
    • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, and 4.16.
      OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
    • OpenShift on AWS
      The PAN-OS 10.2.4h3 is the minimum required version to support 4.12 and above.
    Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

    PAN-OS 11.0

    PAN-OS 11.0 supported environments.
    You can deploy the CN-Series firewall in the following environments:
    ProductVersion
    Container runtime
    Docker
    CRI-O
    Containerd
    Kubernetes version
    1.17 through 1.33
    Cloud provider managed Kubernetes
    • AWS EKS (1.17 through 1.33 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
    • AWS EKS (1.17 through 1.33 for CN-Series as a CNF mode of deployment.)
    • EKS on AWS Outpost (1.17 through 1.33)
      CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
    • Azure AKS (1.17 through 1.33)
      In Azure AKS, PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
    • GCP GKE (1.17 through 1.33)
      Includes GKE Dataplane V2.
    • OCI OKE (1.23)
    Customer managed Kubernetes
    On the public cloud or on-premise data center.
    Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
    VMware TKG+ version 1.1.2
    • Infrastructure Platform—vSphere 7.0
    • Kubernetes Host VM OS—Photon OS
    Kubernetes Host VM
    Operating System:
    • Ubuntu 16.04
    • Ubuntu 18.04
    • Ubuntu 22.04
    • RHEL/Centos 7.3 and later
    • CoreOS 21XX, 22XX
    • Container-Optimized OS
    Linux Kernel Version:
    Linux Kernel Netfilter: Iptables
    CNI Plugins
    CNI Spec 0.3 and later:
    • AWS-VPC
    • Azure
    • Calico
    • Flannel
    • Weave
    • For Openshift, OpenshiftSDN, OVN Kubernetes
    • The following are supported on the CN-Series firewall as a DaemonSet.
      • Multus
      • Bridge
      • SR-IOV
      • Macvlan
    OpenShift
    • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, and 4.16
      OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
      The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
    • OpenShift on AWS
    Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

    PAN-OS 11.1

    PAN-OS 11.1 supported environments.
    You can deploy the CN-Series firewall in the following environments:
    ProductVersion
    Container runtime
    Docker
    CRI-O
    Containerd
    Kubernetes version
    1.17 through 1.33
    Cloud provider managed Kubernetes
    • AWS EKS (1.17 through 1.33 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
    • AWS EKS (1.17 through 1.33 for CN-Series as a CNF mode of deployment.)
    • EKS on AWS Outpost (1.17 through 1.33)
      CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
    • Azure AKS (1.17 through 1.33)
      In Azure AKS, PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
    • GCP GKE (1.17 through 1.33)
      Includes GKE Dataplane V2.
    • OCI OKE (1.23)
    Customer managed Kubernetes
    On the public cloud or on-premise data center.
    Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
    VMware TKG+ version 1.1.2
    • Infrastructure Platform—vSphere 7.0
    • Kubernetes Host VM OS—Photon OS
    Kubernetes Host VM
    Operating System:
    • Ubuntu 16.04
    • Ubuntu 18.04
    • Ubuntu 22.04
    • RHEL/Centos 7.3 and later
    • CoreOS 21XX, 22XX
    • Container-Optimized OS
    Linux Kernel Version:
    Linux Kernel Netfilter: Iptables
    CNI Plugins
    CNI Spec 0.3 and later:
    • AWS-VPC
    • Azure
    • Calico
    • Flannel
    • Weave
    • For Openshift, OpenshiftSDN, OVN Kubernetes
    • The following are supported on the CN-Series firewall as a DaemonSet.
      • Multus
      • Bridge
      • SR-IOV
      • Macvlan
    OpenShift
    • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, and 4.16.
      OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
      The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
    • OpenShift on AWS
    Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

    PAN-OS 11.2 and above

    You can deploy the CN-Series firewall in the following environments:
    ProductVersion
    Container runtime
    Docker
    CRI-O
    Containerd
    Kubernetes version
    1.17 through 1.33
    Cloud provider managed Kubernetes
    • AWS EKS (1.17 through 1.33 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
    • AWS EKS (1.17 through 1.33 for CN-Series as a CNF mode of deployment.)
    • EKS on AWS Outpost (1.17 through 1.33)
      CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
    • Azure AKS (1.17 through 1.33)
      In Azure AKS, PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
    • GCP GKE (1.17 through 1.33)
      Includes GKE Dataplane V2.
    • OCI OKE (1.23)
    Customer managed Kubernetes
    On the public cloud or on-premise data center.
    Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
    VMware TKG+ version 1.1.2.
    • Infrastructure Platform—vSphere 7.0
    • Kubernetes Host VM OS—Photon OS
    Kubernetes Host VM
    Operating System:
    • Ubuntu 16.04
    • Ubuntu 18.04
    • Ubuntu 22.04
    • RHEL/Centos 7.3 and later
    • CoreOS 21XX, 22XX
    • Container-Optimized OS
    Linux Kernel Version:
    Linux Kernel Netfilter: IP tables
    CNI Plugins
    CNI Spec 0.3 and later:
    • AWS-VPC
    • Azure
    • Calico
    • Flannel
    • Weave
    • For Openshift, OpenshiftSDN, OVN Kubernetes
    • The following are supported on the CN-Series firewall as a DaemonSet.
      • Multus
      • Bridge
      • SR-IOV
      • Macvlan
    OpenShift
    • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, and 4.16.
      OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
      The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
    • OpenShift on AWS
    Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

    © 2026 Palo Alto Networks, Inc. All rights reserved.