Palo Alto Networks Compatibility Matrix
    : Panorama Plugins
    Focus
    Download PDF
    Focus
    1. Home
    2. Palo Alto Networks Compatibility Matrix
    3. Panorama
    4. Panorama Plugins
    Download PDF

    Palo Alto Networks Compatibility Matrix

    Panorama Plugins

    Table of Contents

    Panorama Plugins

    Learn about compatibility information for Panorama™ plugins.
    The following tables describe the features and functionality introduced with the Panorama™ extensible plugin architecture.
    For more information on Panorama plugin versions, refer to the VM-Series and Panorama Plugins Release Notes.

    Cisco ACI

    Learn about the Panorama™ plugin for Cisco ACI.
    The following table shows the features introduced in each version of the Panorama™ plugin for Cisco ACI. The plugin uses device groups on Panorama to push the configuration to the managed firewalls.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Supported Cisco ACI Version
    Panorama PAN-OS Version
    (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    Features
    3.0.0
    • 6.0.x
    10.2(
    10.2.4
    )
    Latest
    Introduces enhancements to increase reliability and robustness.
    • 5.2.x
    • 5.1.x
    10.2(
    10.2.0
    )
    2.0.3
    • 6.0.x
    10.1 (
    10.1.9
    )
    Latest
    Introduces a fix for a known issue.
    You can do a new deployment of Cisco ACI 2.0.3 on Panorama 9.0 or later. You can also upgrade from Cisco ACI 2.0.x to Cisco ACI 2.0.3. However, if you need to upgrade from Cisco ACI 1.0.0 or Cisco ACI 1.0.1, you will need to upgrade your Panorama to 10.0 or later, and then upgrade the ACI plugin to 2.0.3.
    • 5.2.x
    • 5.1.x
    • 5.0.x
    • 4.2.x
    • 4.1.x
    • 4.0.x
    • 3.2
    10.1 (
    10.1.0
    )
    10.0 (
    10.0.0
    )
    9.1 (
    9.1.0
    )
    9.0 (
    9.0.0
    )
    2.0.2
    • 5.1.x
    • 5.0.x
    • 4.2.x
    • 4.1.x
    • 4.0.x
    • 3.2
    10.1 (
    10.1.0
    )
    10.0 (
    10.0.0
    )
    9.1 (
    9.1.0
    )
    9.0 (
    9.0.0
    )
    Latest
    Introduces Cisco ACI 5.1 support and fixes for known issues.
    You can do a new deployment of Cisco ACI 2.0.2 on Panorama 9.0 or later. You can also upgrade from Cisco ACI 2.0.x to Cisco ACI 2.0.2. However, if you need to upgrade from Cisco ACI 1.0.0 or Cisco ACI 1.0.1, you will need to upgrade your Panorama to 10.0 or later, and then upgrade the ACI plugin to 2.0.2.
    2.0.1
    • 5.0.x
    • 4.2.x
    • 4.1.x
    • 4.0.x
    • 3.2
    10.1 (
    10.1.0
    )
    10.0 (
    10.0.0
    )
    9.1 (
    9.1.0
    )
    9.0 (
    9.0.0
    )
    Latest
    Introduces fixes for known issues.
    2.0.0
    • 5.0.x
    • 4.2.x
    • 4.1.x
    • 4.0.x
    • 3.2
    10.1 (
    10.1.0
    )
    10.0 (
    10.0.0
    )
    9.1 (
    9.1.0
    )
    9.0 (
    9.0.0
    )
    Latest
    Introduces the Panorama Plugin for Cisco ACI Dashboard and two new monitored attributes—L2 external endpoint groups and subnets under bridge domains.
    1.0.1
    • 5.0.x
    • 4.0.x
    • 3.2
    • 3.1
    • 2.3(1e)
    8.1 (
    8.1.6
    )
    9.1
    Introduces support for multiple IP addresses per endpoint and Cisco ACI 4.0 and later.
    1.0.0
    • 5.0.x
    • 3.2
    • 3.1
    • 2.3(1e)
    8.1 (
    8.1.6
    )
    9.1
    Enables support for Endpoint Monitoring from Panorama. Configure the Panorama plugin for Cisco ACI to monitor endpoints so that you can consistently enforce security policy that automatically adapts to changes within your ACI deployment.

    Cisco TrustSec

    Learn about the Panorama™ plugin for Cisco TrustSec.
    The following table shows the features introduced in each version of Panorama™ plugin for Cisco TrustSec.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Minimum Panorama PAN-OS Version
    Qualified Cisco ISE Versions
    Features
    2.0.0
    10.2.0
    • ISE 3.1
    • ISE 2.7
    Introduces support for Panorama 10.2.x.
    Introduces support for security group tags (SGT). Use these tags as match criteria for placing IP addresses in dynamic address groups.
    1.0.3
    9.0.0
    • ISE 3.1
    • ISE 2.7
    Introduces a fix for one issue.
    1.0.2
    9.0.0
    • ISE 2.4
    • ISE2.6
    Introduces the PubSub monitoring mode, which parses notifications directly from the server. The plugin enables PubSub mode when v1.0.2 is running on Panorama 10.0.0 and later. If v1.0.2 is running on a Panorama version earlier than 10.0.0, the monitoring mode is Bulk Sync.
    1.0.1
    1.0.0
    Enables support for endpoint monitoring from Panorama. Configure the Panorama plugin for Cisco TrustSec to monitor endpoints so that you can consistently enforce security policy that automatically adapts to changes within your TrustSec environment.

    Panorama CloudConnector Plugin (Formerly, AIOps Plugin for Panorama)

    Learn about CloudConnector.
    The following table shows the features introduced in each version of the plugin for AIOps.
    Plugin Version
    Panorama PAN-OS Version
    (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    New Features or Changes
    2.0.1
    10.2 (
    10.2.3
    )
    Latest
    Introduces enhancements for Cloud NGFW for AWS integration with Panorama.
    2.0.0
    10.2 (
    10.2.3
    )
    Latest
    Enables you to use the Panorama AWS plugin 5.0.0 to author and push device group based policies to Cloud NGFW for AWS resources.
    1.1.0
    10.2 (
    10.2.3
    )
    Latest
    Enables the policy analyzer feature that helps you to check if a new security rule meets your intended purpose and that it does not duplicate, shadow, or conflict with your existing rules (pre-commit). You can also check for duplication and other anomalies across your current Security policy rulebase (post-commit).
    1.0.0
    10.2 (
    10.2.1
    )
    Latest
    Enables you to proactively enforce best practice checks by validating your commits and letting you know if a policy needs work before pushing it to your Panorama.

    Cloud Services

    Review minimum plugin versions depending on whether you use the plugin for both Cortex™ Data Lake and Prisma™ Access or for only Cortex Data Lake.
    You use the Cloud Services plugin to activate Panorama Managed Prisma Access and to retrieve logs from Panorama-managed firewalls using Cortex Data Lake. Review the following table to see the minimum Panorama and plugin versions for your deployment type.
    Deployment Type
    Panorama and Plugin requirements
    Panorama Managed Prisma Access
    Dependent on plugin version. Review the minimum required Panorama software versions required for the plugin you are running. To find the plugin version you are running, select
    Panorama
    Cloud Services
    Configuration
    Service Setup
     and find the plugin version in the
    Plugin Alert
     area.
    Cortex Data Lake log retrieval from Panorama-managed firewalls only
    Cortex Data Lake Software Compatibility has the minimum Panorama and plugin requirements.

    Enterprise Data Loss Prevention (DLP)

    Learn about the Panorama™ plugin for Enterprise Data Loss Prevention (DLP).
    The following table shows the features introduced in each version of the Panorama™ plugin for Enterprise Data Loss Prevention (DLP).
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    PAN-OS Version
    (Minimum)
    Maximum PAN-OS Version
    Cloud Services Plugin (
    Minimum
    )
    Features
    4.0.1
    11.0.2
    Latest
    Cloud Services 4.0 Preferred
    Enterprise Data Loss Prevention (E-DLP) now supports creating a file type include or exclude list for data filtering profiles configured for file-based inspection. This allows you to select one of two modes:
    • Inclusion Mode
      —Allow only specified file types be scanned by Enterprise DLP.
    • Exclusion Mode
      —Allow all supported files to be scanned by Enterprise DLP by default but excluding the file types you specify.
      Exclusion Mode includes True File Type Support and does not rely on file extensions to determine file types.
    4.0.0
    11.0.0
    11.0.1
    Cloud Services 4.0 Preferred
    You must upgrade to Enterprise DLP 4.0 plugin to upgrade to PAN-OS 11.0. Additionally, you must download the Enterprise DLP 4.0 plugin before you attempt to install PAN-OS 11.0.
    3.0.5
    10.2.4-h3
    Latest 10.2 Release
    Cloud Services 3.1.0-h50
    (
    PAN-OS 10.2.2-h1 and later releases
    )
    Minor bug and performance fixes.
    3.0.4
    10.2.4
    10.2.4-h3
    Cloud Services 3.1.0-h50
    (
    PAN-OS 10.2.2-h1 and later releases
    )
    Enterprise DLP now supports new applications, expanded download support and large file inspection for many existing applications, and FedRAMP High compliance.
    3.0.3
    10.2.3-h4
    10.2.4
    Prisma Access 3.1.0-h50
    (
    PAN-OS 10.2.2-h1 and later releases
    )
    Enterprise DLP now supports upload inspection of files up to 100MB in size for the Box Web App and Web Browsing applications.
    3.0.2
    10.2.3
    Latest 10.2.3-h4
    Cloud Services 3.1.0-h50
    (
    PAN-OS 10.2.2-h1 and later releases
    )
    Enterprise DLP now supports inspection of file and non-file based HTTP/2 traffic.
    3.0.1
    10.2.1
    10.2.3
    Cloud Services 3.1.0-h50
    (
    PAN-OS 10.2.2-h1 and later releases
    )
    The Panorama plugin for Enterprise DLP supports creating a data filtering profile to scan non-file based traffic for sensitive data.
    3.0.0
    10.2.0
    10.2.1
    Not Supported
    Upgrade to the Enterprise DLP plugin to increase reliability. Enterprise DLP plugin 3.0 is required to upgrade to PAN-OS 10.2 and is supported only on PAN-OS 10.2 and later releases.
    1.0.8
    10.1.11
    Latest 10.1 Release
    Cloud Services 2.2
    Minor bug and performance fixes.
    1.0.7
    10.0.5
    Latest 10.1 Release
    Cloud Services 2.2
    Minor bug and performance fixes.
    1.0.6
    10.0.5
    Latest 10.1 Release
    Cloud Services 2.2
    Minor bug and performance fixes.
    1.0.5
    10.0.5
    Latest 10.1 Release
    Cloud Services 2.2
    Minor bug and performance fixes.
    1.0.4
    10.0.5
    Latest 10.1 Release
    Cloud Services 2.2
    Minor bug and performance fixes.
    1.0.3
    10.0.5
    Latest 10.1 Release
    Cloud Services 2.2
    The Panorama plugin for DLP supports the integration of Enterprise DLP with Prisma Access.
    1.0.2
    10.0.5
    Latest 10.1 Release
    Not Supported
    No new features were added for this release.
    1.0.1
    10.0.2
    Latest 10.1 Release
    Not Supported
    Enables support for Enterprise DLP from Panorama. Configure the Panorama plugin for Enterprise DLP to protect against unauthorized access, misuse, extraction, and sharing of sensitive information and effectively filter network traffic to block or generate an alert before sensitive information leaves the network.

    Panorama Interconnect

    The Panorama™ minimum supported version for the Panorama Interconnect plugin.
    The following table shows the features introduced in each version of the Panorama™ Interconnect plugin.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Minimum PAN-OS Version
    Maximum PAN-OS Version
    New Features or Changes
    2.0.0
    10.2.4 (
    PAN-OS 10.2 release
    )
    Latest 10.2 version (
    PAN-OS 10.2 release
    )
    You must upgrade to Panorama Interconnect 2.0.0 plugin to upgrade to PAN-OS 10.2.
    1.1.0
    10.0.0
    Latest 10.1 version
    Enables you to selectively push device groups, template stacks, and some common Panorama configurations from the Panorama Controller to the Panorama Nodes to avoid pushing extraneous configurations to Panorama Nodes to minimize configuration bloat and operational delays across your Panorama Interconnect deployment.
    1.0.2
    8.1.3
    Latest 10.1 version
    Minor bug and performance fixes.
    1.0.1
    8.1.3
    Latest 10.1 version
    Minor bug and performance fixes.
    1.0.0
    8.1.3
    Latest 10.1 version
    First plugin introduced to support a two-tier Panorama deployment for a horizontal scale-out architecture.

    IPS Signature Converter

    Learn about the Panorama IPS Signature Converter plugin.
    The following table shows the features introduced in each version of the Panorama™ IPS Signature Converter plugin.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Minimum PAN-OS Version
    Features
    2.0.2
    10.2
    Supports SMTP and FTP protocols.
    2.0.1
    10.2
    Supports HTTP sticky buffers.
    Now converts Snort rules that have commas separating content patterns and their associated suboption.
    2.0.0
    10.2
    Uses Python 3 for compatibility with PAN-OS 10.2.
    1.0.6
    10.0
    Supports SMTP and FTP protocols.
    1.0.5
    10.0
    Supports HTTP sticky buffers.
    Now converts Snort rules that have commas separating content patterns and their associated suboption.
    1.0.4
    10.0
    No significant changes in functionality.
    1.0.3
    10.0
    Converts rules into SSL custom signatures if their port is
    443
    .
    Converts server-to-client HTTP rules without content modifiers into custom signatures with the
    http-rsp-status-line
     and
    http-rsp-headers
     contexts.
    Converts Suricata TLS rules into TLS custom signatures and supports additional TLS and file data sticky buffers.
    1.0.2
    10.0
    Converts rules that use the
    smb
     protocol or port
    445
    .
    Supports HTTP sticky buffer keywords in Suricata rules.
    Converts HTTP rules into HTTP custom signatures if either the port in the rule is
    HTTP-_PORTS
     or the protocol is
    http
    .
    1.0.1
    10.0
    Identifies whether newly converted signatures are already included as part of your Palo Alto Networks Threat Prevention subscription.
    1.0.0
    10.0
    Enables support for third-party IPS signature conversion from Panorama. Use the Panorama IPS Signature Converter plugin to gain immediate protection against newly discovered threats by converting third-party IPS rules into Palo Alto Networks custom threat signatures and distributing them to your Panorama-managed firewalls.

    Kubernetes

    Learn about the Panorama Kubernetes plugin.
    The following table displays the features introduced in each version of the Panorama™ Kubernetes plugin.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Minimum Panorama PAN-OS Version
    Maximum Panorama PAN-OS Version
    Features
    4.0.0
    11.0
    Latest
    Introduces new features like CN-Series Hyperscale Security Fabric, (HSF), Tag Length Enhancement, Shared DAG Support, and Nested DAG Support.
    3.0.1
    10.2
    Latest
    Introduces support for shared dynamic address groups.
    3.0.0
    10.2
    Latest
    Introduces Retrieving IPv6 Addresses for Multus CNI Setup, Tag Pruning, Service Account Validation, and advanced Dashboard features.
    2.0.2
    10.1
    10.1.x
    K8s plugin 2.0.2 creates a new template on Panorama called
    K8S-Network-Setup-V1-125
    . This template creates 250 vwire interfaces and 125 vwires.
    2.0.1
    10.1
    10.1.x
    Introduces fixes for known issues.
    2.0.0
    10.1
    10.1.x
    Introduces Core-Based Licensing, Multiple Interface Support, and Custom Certificate Chaining.
    1.0.5
    10.0
    10.1.x
    Introduces fixes for known issues.
    1.0.4
    10.0
    10.1.x
    Introduces fixes for known issues.
    1.0.3
    10.0
    10.1.x
    Introduces fixes for known issues.
    1.0.2
    10.0
    10.1.x
    Introduces fixes for known issues.
    1.0.1
    10.0
    10.1.x
    Introduces the ability to disable the creation of service objects on Panorama, and support for offline licensing of CN-Series firewalls with Panorama.
    1.0.0
    10.0
    10.1.x
    Manages licenses for the CN-Series firewall and enables you to monitor clusters and leverage Kubernetes labels that you use to organize Kubernetes objects. The plugin communicates with the API server and retrieves metadata, which gives you visibility into applications running within a cluster.

    Clustering Plugin

    The following table shows the features introduced in Panorama Clustering plugin.
    Plugin Version
    Panorama PAN-OS Version
    (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    Features
    1.0.0
    11.0
    Latest
    Provides the visibility to the Hyper Scale Security Fabric (HSF) clusters in CN-Series.

    Nutanix

    Learn about the Panorama™ plugin for Nutanix.
    The following table shows the features introduced in each version of the Panorama™ plugin for Nutanix.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Panorama PAN-OS Version
    (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    Features
    2.0.1
    10.2 (
    10.2.0
    )
    Latest
    Introduces fixes for known issues.
    2.0.0
    10.2 (
    10.2.0
    )
    Latest
    Introduces enhancements to increase reliability and robustness.
    1.0.0
    9.0 (
    9.0.4
    )
    Latest
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for Nutanix to monitor VM workloads so that you can consistently enforce security policy that automatically adapts to changes within your Nutanix environment.

    OpenConfig (Firewall Only)

    The PAN-OS minimum supported version for the PAN-OS OpenConfig plugin.
    The following table shows the features introduced in each version of the OpenConfig plugin.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    PAN-OS Version
    (
    Minimum
    )
    New Features or Changes
    1.2.0
    10.1
    Enables support for protobuf and unbundling.
    1.1.0
    10.1
    Enables support for these standard OpenConfig models:
    • openconfig-ha
    • openconfig-zones
    • openconfig-network-instances
    • openconfig-routing-policy
    • openconfig-ospfv2
    1.0.0
    10.1
    Enables support for the OpenConfig plugin on PAN-OS firewalls so that you can use standard OpenConfig models to automate configuration and stream telemetry.

    Panorama Software Firewall License Plugin

    Learn about the Panorama™ Software Firewall License plugin.
    The following table shows the features introduced in each version of the Panorama™ Software Firewall License plugin.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Panorama PAN-OS Version
    (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    Minimum VM-Series Plugin Version
    Features
    1.1.1
    10.0 (
    10.0.4
    )
    Latest
    2.0.4
    Introduces fixes for known issues.
    1.1.0
    10.0 (
    10.0.4
    )
    Latest
    2.0.4
    Introduces fixes for known issues.
    1.0.0
    10.0 (
    10.0.4
    )
    Latest
    2.0.4
    The Panorama Software Firewall License plugin allows you to automatically license a VM-Series firewall when it connects to Panorama.

    Public Cloud—AWS, Azure, and GCP

    Learn about the different public cloud plugins supported on Panorama™.
    The following table shows the features introduced in each version of the Panorama™ plugin for Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). The plugins use device groups and templates on Panorama to push the configuration to the managed firewalls.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Public Cloud Platform
    AWS Plugin Version
    Panorama PAN-OS Version (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    VM-Series Plugin Version (
    Minimum
    )
    Features
    AWS
    5.1.1
    10.2 (
    10.2.3
    )
    Latest
    3.0.0
    Introduces enhancements for Cloud NGFW for AWS integration with Panorama.
    5.0.1
    10.2 (
    10.2.3
    )
    Latest
    3.0.0
    Introduces enhancements for Cloud NGFW for AWS integration with Panorama.
    5.0.0
    10.2 (
    10.2.3
    )
    Latest
    3.0.0
    4.1.0
    10.2
    Latest
    3.0.0
    Introduces support for nested dynamic address groups and tag pruning.
    4.0.0
    10.2
    Latest
    3.0.0
    Introduces enhancements to increase reliability and robustness.
    3.0.3
    10.0 (
    10.0.5
    )
    10.1.x
    2.0.6
    Introduces shared dynamic address groups support and bug fixes.
    3.0.2
    10.0 (
    10.0.5
    )
    10.1.x
    2.0.6
    Introduces proxy support and bug fixes.
    3.0.1
    10.0 (
    10.0.5
    )
    10.1.x
    2.0.6
    Introduces enhancements and bug fixes.
    3.0.0
    10.0 (
    10.0.5
    )
    10.1.x
    2.0.6
    Introduces Panorama Orchestration and new monitoring parameters.
    2.0.2
    10.1 (
    10.1.0
    )
    10.1.x
    2.0.2
    Introduces fixes for known issues.
    10.0 (
    10.0.0
    )
    10.1.x
    2.0.0
    9.1 (
    9.1.2
    )
    10.1.x
    1.0.8
    9.0 (
    9.0.6
    )
    10.1.x
    1.0.4
    2.0.1
    9.1 (
    9.1.2
    )
    10.1.x
    1.0.4
    Introduces a fix for a known issue.
    9.0 (
    9.0.6
    )
    10.1.x
    2.0.0
    9.1 (
    9.1.2
    )
    10.1.x
    1.0.8
    9.0 (
    9.0.6
    )
    10.1.x
    1.0.4
    1.0.1
    9.0 (
    9.0.0
    )
    8.1 (
    8.1.3
    )
    9.0.x
    N/A
    Introduces fixes for known issues.
    1.0.0
    9.0 (
    9.0.0
    )
    8.1 (
    8.1.3
    )
    9.0.x
    N/A
    Enables support for VM Monitoring to monitor the virtual machine inventory within your AWS VPCs so that you can consistently enforce Security policy that automatically adapts to changes within your AWS deployment.
    Public Cloud Platform
    Azure Plugin Version
    Panorama PAN-OS Version (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    VM-Series Plugin Version
    (
    Minimum
    )
    Features
    Azure
    5.1.0
    10.2.4
    Latest
    4.0.0
    Introduces tag pruning feature to increase the scalability and the number of tags collected by the Azure plugin
    5.0.0
    10.2.4
    Latest
    4.0.0
    Introduces support for Panorama integration with Cloud NGFW for Azure.
    4.2.0
    10.2.3
    Latest
    3.0.1
    Introduces support for Azure Workspace-based Application Insights.
    4.1.0
    10.2
    Latest
    3.0.1
    Increased the number of front-end applications per VM-Series for Azure deployment.
    4.0.0
    10.2
    Latest
    3.0.1
    Introduces enhancements to increase reliability and robustness.
    3.2.0
    10.0 (
    10.0.1
    )
    10.1.x
    2.0.1
    Introduces proxy support and fix for a known issue.
    10.1 (
    10.1.0
    )
    10.1.x
    2.1.0
    3.1.0
    10.0 (
    10.0.1
    )
    10.1.x
    2.0.1
    Introduces fixes for a known issue.
    10.1 (
    10.1.0
    )
    10.1.x
    2.1.0
    3.0.1
    10.0 (
    10.0.1
    )
    10.1.x
    2.0.1
    Introduces fixes for known issues.
    10.1 (
    10.1.0
    )
    10.1.x
    2.1.0
    3.0.0
    10.0 (
    10.0.1
    )
    10.1.x
    2.0.1
    Introduces Panorama Orchestration.
    10.1 (
    10.1.0
    )
    10.1.x
    2.1.0
    2.0.3
    9.0 (
    9.0.6
    )
    10.1.x
    1.0.4
    Introduces a fix for a known issue.
    9.1 (
    9.1.2
    )
    10.1.x
    1.0.8
    10.0 (
    10.0.0
    )
    10.1.x
    2.0.0
    10.1 (
    10.1.0
    )
    10.1.x
    2.1.0
    2.0.2
    8.1 (
    8.1.11
    )
    9.0 (
    9.0.5
    )
    10.1.x
    1.0.4
    Introduces fixes for known issues.
    2.0.1
    8.1 (
    8.1.11
    )
    9.0 (
    9.0.5
    )
    10.1.x
    1.0.4
    Introduces fixes for known issues.
    2.0.0
    8.1 (
    8.1.8
    )
    10.1.x
    N/A
    Enables support for:
    9.0 (
    9.0.3
    )
    10.1.x
    1.0.4
    Enables support for:
    1.0.0
    8.1 (
    8.1.3
    )
    9.0 (
    9.0.0
    )
    9.0.x
    N/A
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for Azure to monitor the virtual machine inventory within your Azure subscription.
    Public Cloud Platform
    GCP Plugin Version
    Panorama PAN-OS Version (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    VM-Series Plugin Version
    Features
    GCP
    3.0.0
    10.2
    Latest
    3.0.0
    Introduces enhancements to increase reliability and robustness.
    2.0.0
    (Upgrade from 1.0.0 to 2.0.0 is not supported.)
    9.0 (
    9.0.4
    )
    Latest
    1.0.4
    Enables you to monitor and secure VMs or GKE clusters deployed in GCP.
    • Deploy auto scaling for VM instance groups or GKE clusters using auto scaling templates for both firewall and application deployments.
    • VM Monitoring for GCP assets.

    SD-WAN

    Learn about the Panorama™ plugin for SD-WAN.
    The following table shows the features introduced in each version of the Panorama™ plugin for SD-WAN.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    PAN-OS Version (
    Minimum
    )
    Maximum PAN-OS Version
    Features
    3.1.2
    11.0.2 (
    11.0.2
    )
    Latest
    Bug and performance fixes.
    3.1.1
    11.0.2 (
    11.0.2
    )
    Latest
    SD-WAN IPv6 Basic Connectivity
    3.0.1-h6
    11.0.1 (
    11.0.1
    )
    Latest
    Bug and performance fixes.
    3.1.0-h6
    11.0.0 (
    11.0.1
    )
    Latest
    Enables Advanced Routing Engine support.
    3.0.6
    10.2.6 (
    10.2.6
    )
    Latest
    Bug fixes.
    3.0.5
    10.2.5 (
    10.2.5
    )
    Latest
    Bug and performance fixes.
    3.0.4
    10.2.4 (
    10.2.4
    )
    Latest
    Bug and performance fixes.
    3.0.3
    10.2.1 (
    10.2.1
    )
    Latest
    Bug and performance fixes.
    3.0.2
    10.2.1 (
    10.2.1
    )
    Latest
    Bug and performance fixes.
    3.0.1
    10.2.1 (
    10.2.1
    )
    Latest
    Copy ToS Header Support.
    3.0.0
    10.2 (
    10.2.0
    )
    Latest
    Upgrade to the SD-WAN plugin to increase reliability. SD-WAN plugin 3.0 is required to upgrade to PAN-OS 10.2 and is supported only on PAN-OS 10.2 and later releases.
    2.2.4
    10.1.10 (
    10.1.10
    )
    Latest
    Bug and performance fixes.
    2.2.3
    10.1.9 (
    10.1.9
    )
    Latest
    Bug and performance fixes.
    2.2.2
    10.1.5-h1 (
    10.1.5-h1
    )
    Latest
    Bug and performance fixes.
    2.2.1
    10.1.5-h1 (
    10.1.5-h1
    )
    Latest
    Copy ToS Header support.
    2.2.0
    10.1.4 (
    10.1.4
    )
    Latest
    Prisma Access Hub support.
    2.1.1
    10.0 (
    10.0.4
    )
    Latest
    Minor bug and performance fixes.
    2.1.0
    10.0 (
    10.0.4
    )
    Latest
    SD-WAN supports Aggregated Ethernet (AE) interfaces with or without subinterfaces for link redundancy. AE interfaces allow you to tag for different ISP services to achieve end-to-end traffic segmentation. SD-WAN also supports Layer 3 subinterfaces for end-to-end traffic segmentation.
    2.0.3
    10.0 (
    10.0.3
    )
    Latest
    Minor bug and performance fixes.
    2.0.2
    10.0 (
    10.0.3
    )
    Latest
    Includes support so you can control whether Auto VPN configuration enables or disables the
    Remove Private AS
     setting for all BGP peer groups on a branch or hub.
    2.0.1
    10.0 (
    10.0.3
    )
    Latest
    Includes support for full mesh VPN cluster with DDNS service, auto-VPN configuration with branch behind NAT, and Direct Internet Access (DIA) AnyPath.
    2.0.0
    10.0 (
    10.0.2
    )
    Latest
    Maintain high-quality application experience by leveraging Forward Error Correction (FEC) and packet duplication and by accurately measuring SaaS and Cloud applications when you have an SD-WAN firewall with Direct Internet Access (DIA) links.
    1.0.6
    9.1 (
    9.1.4
    )
    Latest
    Minor bug and performance fixes.
    1.0.5
    9.1 (
    9.1.4
    )
    Latest
    Minor bug and performance fixes.
    1.0.4
    9.1 (
    9.1.4
    )
    Latest
    In an SD-WAN VPN cluster that has more than one hub, you must assign a priority to each hub, which determines the primary hub and hub failover order. Panorama maps the priority to a BGP local preference and pushes the local preference to the branches in the cluster.
    1.0.3
    9.1 (
    9.1.3
    )
    10.0.0
    When the SD-WAN hub is behind a NAT device, the plugin supports an upstream NAT IP address or FQDN for Auto VPN configuration to use as a tunnel endpoint.
    1.0.2
    9.1 (
    9.1.2-h1
    )
    9.1.3
    Improves ease of use, such as an automatic Security policy rule to allow BGP between branches and hubs, ability to refresh the IKE preshared key for VPN cluster members, specifying VPN tunnel IP address ranges, and more.
    1.0.1
    9.1 (
    9.1.1
    )
    9.1.2
    Improves monitoring experience and search filtering, and adds an option to display HA peers consecutively.
    1.0.0
    9.1 (
    9.1.0
    )
    9.1.2
    Enables support for SD-WAN from Panorama. Configure the Panorama plugin for SD-WAN to provide intelligent and dynamic path selection on top of the industry-leading security that PAN-OS software already delivers. Provide the optimal end user experience by leveraging multiple ISP links to ensure application performance and scale capacity.

    VMware NSX

    Review the features introduced in each version of the VM-Series firewall VMware NSX plugin.
    The following table shows the features introduced in each version of the VM-Series firewall VMware NSX plugin. For additional information about each plugin, see the release notes on the Customer Support Portal.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Panorama Version (
    Minimum
    )
    Panorama Version (
    Maximum
    )
    Managed VM-Series PAN-OS Version (
    Minimum
    )
    New Features or Changes
    5.0.1
    • NSX-V: 10.2.0 (
      10.2.2
      )
    • NSX-T N/S: 10.2.0 (
      10.2.2
      )
    • NSX-T E/W: 10.2.0 (
      10.2.2
      )
    • NSX-V: Latest 10.2.x (
      10.2.x
      )
    • NSX-T N/S: Latest 10.2.x (
      10.2.x
      )
    • NSX-T E/W: Latest 10.2.x (
      10.2.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces support for PAN-OS and Panorama 10.2.x.
    5.0.0
    • NSX-V: 10.2.0 (
      10.2.2
      )
    • NSX-T N/S: 10.2.0 (
      10.2.2
      )
    • NSX-T E/W: 10.2.0 (
      10.2.2
      )
    • NSX-V: Latest 10.2.x (
      10.2.x
      )
    • NSX-T N/S: Latest 10.2.x (
      10.2.x
      )
    • NSX-T E/W: Latest 10.2.x (
      10.2.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces support for PAN-OS and Panorama 10.2.x.
    4.0.3
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    4.0.2
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    4.0.1
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    4.0.0
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces Security-Centric Deployment Workflow (East-West) for the VM-Series on VMware NSX-T.
    3.2.4
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    3.2.3
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    3.2.1
    • NSX-V: 9.0 (
      9.0.8
      )
    • NSX-T N/S: 9.0 (
      9.0.8
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: 10.1.x (
      10.1.x
      )
    • NSX-T E/W: 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    3.2.0
    • NSX-V: 9.0 (
      9.0.8
      )
    • NSX-T N/S: 9.0 (
      9.0.8
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    • NSX-V: 10.1.x (
      10.1.x
      )
    • NSX-T N/S: Latest 10.1.x (
      10.1.x
      )
    • NSX-T E/W: Latest 10.1.x (
      10.1.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces Security Policy Extension Between NSX-V and NSX-T and Device Certificate Support on the VM-Series for NSX.
    The following VM-Series firewall for NSX OVFs require that you enable device certificates.
    • 10.0.1 or later
    • 9.1.5 or later
    • 9.0.11 or later
    • 8.1.17 or later
    3.1.0
    9.1 (
    9.1.0
    )
    • NSX-V: Latest 10.0.x
    • NSX-T N/S: Latest (
      10.2.x
      )
    • NSX-T E/W: Latest (
      10.2.x
      )
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces the VM-Series firewall on VMware NSX-T for East-West traffic protection.
    2.0.6
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.5
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces Proxy Bypass Support and Curl Call Timeout features.
    2.0.4
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces the Automated Full Dynamic Address Group Sync feature.
    2.0.3
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.2
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.1
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues. Minimum required plugin version for Panorama 8.1.

    VMware vCenter

    Learn about the Panorama™ plugin for VMware vCenter.
    The following table shows the features introduced in each version of the Panorama™ plugin for VMware vCenter.
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    Panorama PAN-OS Version (
    Minimum
    )
    Maximum Panorama PAN-OS Version
    Features
    2.1.0
    10.2 (
    10.2.0
    )
    Latest
    Introduces fixes for known issues.
    2.0.0
    10.2 (
    10.2.0
    )
    Latest
    Introduces enhancements to increase reliability and robustness.
    1.0.0
    9.0 (
    9.0.2
    )
    Latest
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for VMware vCenter to monitor VM workloads so that you can consistently enforce security policy that automatically adapts to changes within your vCenter environment.

    Zero Touch Provisioning (ZTP)

    Learn about the Panorama™ plugin for Zero Touch Provisioning (ZTP).
    The following table shows the features introduced in each version of the Panorama™ plugin for Zero Touch Provisioning (ZTP).
    End-of-life (EoL) software versions are included in this table. Review the Software End-of-Life Summary website to check whether we are still supporting your software version.
    Plugin Version
    PAN-OS Version Minimum
    Maximum PAN-OS Version
    Features
    2.0.3
    10.2.4 (
    PAN-OS 10.2 release
    )
    11.0.1 (
    PAN-OS 11.0 release
    )
    Latest
    Minor bug and performance fixes.
    2.0.2
    10.2.0
    Latest
    Minor bug and performance fixes.
    2.0.1
    10.2.0
    Latest
    Minor bug and performance fixes.
    2.0.0
    10.2.0
    Latest
    Upgrade to the ZTP plugin to increase reliability. ZTP plugin 2.0 is required to upgrade to PAN-OS 10.2 and is supported only on PAN-OS 10.2 and later releases.
    1.0.2
    10.0.3
    Latest
    Minor bug and performance fixes.
    1.0.1
    10.0.3
    Latest
    Minor bug and performance fixes.
    1.0.0
    9.1.4
    Latest
    Enables support for ZTP from Panorama. Configure the Panorama plugin for ZTP to simplify and streamline initial firewall deployment by automating the new managed firewall on-boarding without the need for network administrators to manually provision the firewall.

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.