CN-Series Deployment—Supported Environments
Focus
Focus
CN-Series

CN-Series Deployment—Supported Environments

Table of Contents

CN-Series Deployment—Supported Environments

Learn about the compatibility and version requirements for the CN-Series firewall.
Where Can I Use This?What Do I Need?
  • CN-Series deployment
  • CN-Series 10.1.x or above Container Images
  • Panorama running PAN-OS 10.1.x or above version
  • Helm 3.6 or above version client for CN-Series deployment with Helm Chart
This chapter provides information on compatibility and version requirements for the CN-Series firewall.

PAN-OS 10.1

PAN-OS 10.1 supported deployment environments.
You can deploy the CN-Series firewall in the following environments:
ProductVersion
Container runtime
Docker
CRI-O
Containerd
Kubernetes version
1.17 through 1.27
Cloud provider managed Kubernetes
  • AWS EKS (1.17 through 1.27 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
  • EKS on AWS Outpost (1.17 through 1.25)
    CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
  • Azure AKS (1.17 through 1.27)
    In Azure AKS, the PAN-OS 10.1.10h1 is the minimum required version to support kubernetes 1.25 and above.
  • AliCloud ACK (1.26)
  • GCP GKE (1.17 through 1.27)
    Includes GKE Dataplane V2.
Customer managed Kubernetes
On the public cloud or on-premise data center.
Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
VMware TKG+ version 1.1.2
  • Infrastructure Platform—vSphere 7.0
  • Kubernetes Host VM OS—Photon OS
Kubernetes Host VM
Operating System:
  • Ubuntu 16.04
  • Ubuntu 18.04
  • Ubuntu 22.04
  • RHEL/Centos 7.3 and later
  • CoreOS 21XX, 22XX
  • Container-Optimized OS
Linux Kernel Version:
Linux Kernel Netfilter: Iptables
CNI Plugins
CNI Spec 0.3 and later:
  • AWS-VPC
  • Azure
  • Calico
  • Flannel
  • Weave
  • For AliCloud, Terway
  • For Openshift, OpenshiftSDN
  • The following are supported on the CN-Series firewall as a DaemonSet.
    • Multus
    • Bridge
    • SR-IOV
    • Macvlan
OpenShift
CN-Series as a DaemonSet:
4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, and 4.13
CN-Series as a K8s Service:
(PAN-OS 10.1.2 and later)
4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15.
The PAN-OS 10.1.10h1 is the minimum required version to support 4.12 and above.

PAN-OS 10.2

PAN-OS 10.2 supported deployment environments.
You can deploy the CN-Series firewall in the following environments:
ProductVersion
Container runtime
Docker
CRI-O
Containerd
Kubernetes version
1.17 through 1.28
Cloud provider managed Kubernetes
  • AWS EKS (1.17 through 1.28 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
  • AWS EKS (1.17 through 1.28 for CN-Series as a CNF mode of deployment.)
  • EKS on AWS Outpost (1.17 through 1.28)
    CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
  • Azure AKS (1.17 through 1.28)
    In Azure AKS, the PAN-OS 10.2.4h3 is the minimum required version to support kubernetes 1.25 and above.
  • GCP GKE (1.17 through 1.28)
    In GCP GKE, the PAN-OS 10.2.4h3 is the minimum required version to support kubernetes 1.25 and above.
    Includes GKE Dataplane V2.
  • Google Anthos 1.12.3
  • OCI OKE (1.23)
Customer managed Kubernetes
On the public cloud or on-premise data center.
Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
VMware TKG+ version 1.1.2
  • Infrastructure Platform—vSphere 7.0
  • Kubernetes Host VM OS—Photon OS
Kubernetes Host VM
Operating System:
  • Ubuntu 16.04
  • Ubuntu 18.04
  • Ubuntu 22.04
  • RHEL/Centos 7.3 and later
  • CoreOS 21XX, 22XX
  • Container-Optimized OS
Linux Kernel Version:
Linux Kernel Netfilter: Iptables
CNI Plugins
CNI Spec 0.3 and later:
  • AWS-VPC
  • Azure
  • Calico
  • Flannel
  • Weave
  • For Openshift, OpenshiftSDN, OVN Kubernetes
  • The following are supported on the CN-Series firewall as a DaemonSet.
    • Multus
    • Bridge
    • SR-IOV
    • Macvlan
OpenShift
  • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15.
    OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
  • OpenShift on AWS
    The PAN-OS 10.2.4h3 is the minimum required version to support 4.12 and above.

PAN-OS 11.0

PAN-OS 11.0 supported environments.
You can deploy the CN-Series firewall in the following environments:
ProductVersion
Container runtime
Docker
CRI-O
Containerd
Kubernetes version
1.17 through 1.28
Cloud provider managed Kubernetes
  • AWS EKS (1.17 through 1.28 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
  • AWS EKS (1.17 through 1.28 for CN-Series as a CNF mode of deployment.)
  • EKS on AWS Outpost (1.17 through 1.28)
    CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
  • Azure AKS (1.17 through 1.28)
    In Azure AKS, the PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
  • GCP GKE (1.17 through 1.28)
    Includes GKE Dataplane V2.
  • OCI OKE (1.23)
Customer managed Kubernetes
On the public cloud or on-premise data center.
Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
VMware TKG+ version 1.1.2
  • Infrastructure Platform—vSphere 7.0
  • Kubernetes Host VM OS—Photon OS
Kubernetes Host VM
Operating System:
  • Ubuntu 16.04
  • Ubuntu 18.04
  • Ubuntu 22.04
  • RHEL/Centos 7.3 and later
  • CoreOS 21XX, 22XX
  • Container-Optimized OS
Linux Kernel Version:
Linux Kernel Netfilter: Iptables
CNI Plugins
CNI Spec 0.3 and later:
  • AWS-VPC
  • Azure
  • Calico
  • Flannel
  • Weave
  • For Openshift, OpenshiftSDN, OVN Kubernetes
  • The following are supported on the CN-Series firewall as a DaemonSet.
    • Multus
    • Bridge
    • SR-IOV
    • Macvlan
OpenShift
  • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15
    OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
    The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
  • OpenShift on AWS

PAN-OS 11.1

PAN-OS 11.1 supported environments.
You can deploy the CN-Series firewall in the following environments:
ProductVersion
Container runtime
Docker
CRI-O
Containerd
Kubernetes version
1.17 through 1.28
Cloud provider managed Kubernetes
  • AWS EKS (1.17 through 1.28 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
  • AWS EKS (1.17 through 1.28 for CN-Series as a CNF mode of deployment.)
  • EKS on AWS Outpost (1.17 through 1.28)
    CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
  • Azure AKS (1.17 through 1.28)
    In Azure AKS, the PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
  • GCP GKE (1.17 through 1.28)
    Includes GKE Dataplane V2.
  • OCI OKE (1.23)
Customer managed Kubernetes
On the public cloud or on-premise data center.
Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
VMware TKG+ version 1.1.2
  • Infrastructure Platform—vSphere 7.0
  • Kubernetes Host VM OS—Photon OS
Kubernetes Host VM
Operating System:
  • Ubuntu 16.04
  • Ubuntu 18.04
  • Ubuntu 22.04
  • RHEL/Centos 7.3 and later
  • CoreOS 21XX, 22XX
  • Container-Optimized OS
Linux Kernel Version:
Linux Kernel Netfilter: Iptables
CNI Plugins
CNI Spec 0.3 and later:
  • AWS-VPC
  • Azure
  • Calico
  • Flannel
  • Weave
  • For Openshift, OpenshiftSDN, OVN Kubernetes
  • The following are supported on the CN-Series firewall as a DaemonSet.
    • Multus
    • Bridge
    • SR-IOV
    • Macvlan
OpenShift
  • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15
    OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
    The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
  • OpenShift on AWS

PAN-OS 11.2

You can deploy the CN-Series firewall in the following environments:
ProductVersion
Container runtime
Docker
CRI-O
Containerd
Kubernetes version
1.17 through 1.28
Cloud provider managed Kubernetes
  • AWS EKS (1.17 through 1.28 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. )
  • AWS EKS (1.17 through 1.28 for CN-Series as a CNF mode of deployment.)
  • EKS on AWS Outpost (1.17 through 1.28)
    CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus.
  • Azure AKS (1.17 through 1.28)
    In Azure AKS, the PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above.
  • GCP GKE (1.17 through 1.28)
    Includes GKE Dataplane V2.
  • OCI OKE (1.23)
Customer managed Kubernetes
On the public cloud or on-premise data center.
Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table.
VMware TKG+ version 1.1.2
  • Infrastructure Platform—vSphere 7.0
  • Kubernetes Host VM OS—Photon OS
Kubernetes Host VM
Operating System:
  • Ubuntu 16.04
  • Ubuntu 18.04
  • Ubuntu 22.04
  • RHEL/Centos 7.3 and later
  • CoreOS 21XX, 22XX
  • Container-Optimized OS
Linux Kernel Version:
Linux Kernel Netfilter: Iptables
CNI Plugins
CNI Spec 0.3 and later:
  • AWS-VPC
  • Azure
  • Calico
  • Flannel
  • Weave
  • For Openshift, OpenshiftSDN, OVN Kubernetes
  • The following are supported on the CN-Series firewall as a DaemonSet.
    • Multus
    • Bridge
    • SR-IOV
    • Macvlan
OpenShift
  • Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, and 4.15.
    OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only.
    The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above.
  • OpenShift on AWS