1. Home
    2. Palo Alto Networks Compatibility Matrix
    3. Panorama
    4. Panorama Plugins

    Panorama Plugins

    Learn about compatibility information for Panorama™ plugins.
    The following tables describe the features and functionality introduced with the Panorama™ extensible plugin architecture.
    For more information on Panorama plugin versions, refer to the VM-Series and Panorama Plugins Release Notes.

    Cisco ACI

    Learn about the Panorama™ plugin for Cisco ACI.
    The following table shows the features introduced in each version of the Panorama™ plugin for Cisco ACI. The plugin uses device groups on Panorama to push the configuration to the managed firewalls.
    Plugin Version
    Supported Cisco ACI Version
    Panorama Version
    (
    Minimum
    )
    Maximum Panorama Version
    Features
    2.0.2
    • 3.2
    • 4.0.x
    • 4.1.x
    • 4.2.x
    • 5.0.x
    • 5.1.x
    9.0 (
    9.0.0
    )
    9.1 (
    9.1.0
    )
    10.0 (
    10.0.0
    )
    Latest
    Introduces Cisco ACI 5.1 support and fixes for known issues.
    You can do a new deployment of Cisco ACI 2.0.2 on Panorama 9.0 or later. You can also upgrade from Cisco ACI 2.0.x to Cisco ACI 2.0.2. However, if you need to upgrade from Cisco ACI 1.0.0 or Cisco ACI 1.0.1, you will need to upgrade your Panorama to 10.0 or later, and then upgrade the ACI plugin to 2.0.2.
    2.0.1
    • 3.2
    • 4.0.x
    • 4.1.x
    • 4.2.x
    • 5.0.x
    9.0 (
    9.0.0
    )
    9.1 (
    9.1.0
    )
    10.0 (
    10.0.0
    )
    Latest
    Introduces fixes for known issues.
    2.0.0
    • 3.2
    • 4.0.x
    • 4.1.x
    • 4.2.x
    • 5.0.x
    9.0 (
    9.0.0
    )
    9.1 (
    9.1.0
    )
    10.0 (
    10.0.0
    )
    Latest
    Introduces the Panorama Plugin for Cisco ACI Dashboard and two new monitored attributes—L2 external endpoint groups and subnets under bridge domains.
    1.0.1
    • 2.3(1e)
    • 3.1
    • 3.2
    • 4.0.x
    • 5.0.x
    8.1 (
    8.1.6
    )
    9.1.x
    Introduces support for multiple IP addresses per endpoint and Cisco ACI 4.0 and later.
    1.0.0
    • 2.3(1e)
    • 3.1
    • 3.2
    • 5.0.x
    8.1 (
    8.1.6
    )
    9.1.x
    Enables support for Endpoint Monitoring from Panorama. Configure the Panorama plugin for Cisco ACI to monitor endpoints so that you can consistently enforce security policy that automatically adapts to changes within your ACI deployment.

    Cisco TrustSec

    Learn about the Panorama™ plugin for Cisco TrustSec.
    The following table shows the features introduced in each version of Panorama™ plugin for Cisco TrustSec.
    Plugin Version
    Minimum Panorama Version
    Qualified Cisco ISE Versions
    Features
    1.0.2
    10.0
    • ISE 2.4
    • ISE2.6
    Introduces the PubSub monitoring mode, which parses notifications directly from the server. The plugin enables PubSub mode when v1.0.2 is running on Panorama 10.0.0 and later. If v1.0.2 is running on a Panorama version earlier than 10.0.0, the monitoring mode is Bulk Sync.
    1.0.1
    9.0
    1.0.0
    9.0
    Enables support for endpoint monitoring from Panorama. Configure the Panorama plugin for Cisco TrustSec to monitor endpoints so that you can consistently enforce security policy that automatically adapts to changes within your TrustSec environment.

    Cloud Services

    Review minimum plugin versions depending on whether you use the plugin for both Cortex™ Data Lake and Prisma™ Access or for only Cortex Data Lake.
    If you have had your dataplane upgraded to either 9.1.7 or 10.0.3, you must upgrade your plugin to the minimum supported 2.0 version (either 2.0 Preferred or 2.0 Innovation)
    before June 16, 2021
    . The supported Cloud Services plugin version depends on the dataplane that your deployment is running.
    Dataplane Version
    Required Minimum Cloud Services Plugin Version
    10.0.7
    2-2-Preferred
    9.1.7
    2.0-Preferred (2.1 Preferred is supported)
    10.0.3
    2.0-Innovation (2.1 Innovation is supported)
    To check your Cloud Services and dataplane versions, select
    Panorama
    Cloud Services
    Configuration
    Service Setup
    . The Cloud Services version displays in the
    Plugin Alert
     area and the dataplane version displays in the
    DataPlane PAN-OS version
     area.
    For a list of the Panorama software versions that are supported with Prisma Access, see Minimum Required Panorama Software Versions.
    Prisma Access uses Cortex® Data Lake for its logging. If you are using the Cloud Services plugin for only Cortex Data Lake without Prisma Access, see Cortex Data Lake Software Compatibility for the minimum Panorama and plugin requirements.

    Enterprise Data Loss Prevention (DLP)

    Learn about the Panorama™ plugin for Enterprise Data Loss Prevention (DLP).
    The following table shows the features introduced in each version of the Panorama™ plugin for Enterprise Data Loss Prevention (DLP).
    Plugin Version
    Panorama Version
    (
    Minimum
    )
    Maximum Panorama Version
    Features
    1.0.4
    10.0 (
    10.0.5
    )
    Latest
    Minor bug and performance fixes.
    1.0.3
    10.0 (
    10.0.5
    )
    Latest
    The Panorama plugin for DLP supports the integration of Enterprise DLP with Prisma Access.
    1.0.2
    10.0 (
    10.0.3
    )
    Latest
    No new features were added for this release.
    1.0.1
    10.0 (
    10.0.2
    )
    Latest
    Enables support for Enterprise DLP from Panorama. Configure the Panorama plugin for Enterprise DLP to protect against unauthorized access, misuse, extraction, and sharing of sensitive information and effectively filter network traffic to block or generate an alert before sensitive information leaves the network.

    Panorama Interconnect

    The Panorama™ minimum supported version for the Panorama Interconnect plugin.
    The following table shows the features introduced in each version of the Panorama™ Interconnect plugin.
    Plugin Version
    Panorama Version
    (
    Minimum
    )
    New Features or Changes
    1.1.0
    10.0 (
    10.0.0
    )
    Enables you to selectively push device groups, template stacks, and some common Panorama configurations from the Panorama Controller to the Panorama Nodes to avoid pushing extraneous configurations to Panorama Nodes to minimize configuration bloat and operational delays across your Panorama Interconnect deployment.
    1.0.2
    8.1 (
    8.1.3
    )
    Minor bug and performance fixes.
    1.0.1
    8.1 (
    8.1.3
    )
    Minor bug and performance fixes.
    1.0.0
    8.1 (
    8.1.3
    )
    First plugin introduced to support a two-tier Panorama deployment for a horizontal scale-out architecture.

    IPS Signature Converter

    Learn about the Panorama IPS Signature Converter plugin.
    The following table shows the features introduced in each version of the Panorama™ IPS Signature Converter plugin.
    Plugin Version
    Minimum Panorama Version
    Features
    1.0.0
    10.0
    Enables support for third-party IPS signature conversion from Panorama. Use the Panorama IPS Signature Converter plugin to gain immediate protection against newly discovered threats by converting third-party IPS rules into Palo Alto Networks custom threat signatures and distributing them to your Panorama-managed firewalls.

    Kubernetes

    Learn about the Panorama Kubernetes plugin.
    The following table displays the features introduced in each version of the Panorama™ Kubernetes plugin.
    Plugin Version
    Minimum Panorama Version
    Maximum Panorama Version
    Features
    2.0.0
    10.1
    Latest
    Introduces Core-Based Licensing, Multiple Interface Support, and Custom Certificate Chaining.
    1.0.2
    10.0
    Latest
    Introduces fixes for known issues.
    1.0.1
    10.0
    Latest
    Introduces the ability to disable the creation of service objects on Panorama, and support for offline licensing of CN-Series firewalls with Panorama.
    1.0.0
    10.0
    Latest
    Manages licenses for the CN-Series firewall and enables you to monitor clusters and leverage Kubernetes labels that you use to organize Kubernetes objects. The plugin communicates with the API server and retrieves metadata, which gives you visibility into applications running within a cluster.

    Nutanix

    Learn about the Panorama™ plugin for Nutanix.
    The following table shows the features introduced in each version of the Panorama™ plugin for Nutanix.
    Plugin Version
    Panorama Version
    (
    Minimum
    )
    Maximum Panorama Version
    Features
    1.0.0
    9.0 (
    9.0.4
    )
    Latest
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for Nutanix to monitor VM workloads so that you can consistently enforce security policy that automatically adapts to changes within your Nutanix environment.

    OpenConfig (Firewall Only)

    The PAN-OS minimum supported version for the PAN-OS OpenConfig plugin.
    The following table shows the features introduced in each version of the OpenConfig plugin.
    Plugin Version
    PAN-OS Version
    (
    Minimum
    )
    New Features or Changes
    1.0.0
    10.1
    Enables support for the OpenConfig plugin on PAN-OS firewalls so that you can use standard OpenConfig models to automate configuration and stream telemetry.

    Panorama Software Firewall License Plugin

    Learn about the Panorama™ Software Firewall License plugin.
    The following table shows the features introduced in each version of the Panorama™ Software Firewall License plugin.
    Plugin Version
    Panorama Version
    (
    Minimum
    )
    Maximum Panorama Version
    Minimum VM-Series Plugin Version
    Features
    1.0.0
    10.0 (
    10.0.4
    )
    Latest
    2.0.4
    The Panorama Software Firewall License plugin allows you to automatically license a VM-Series firewall when it connects to Panorama.

    Public Cloud—AWS, Azure, and GCP

    Learn about the different public cloud plugins supported on Panorama™.
    The following table shows the features introduced in each version of the Panorama™ plugin for Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). The plugins use device groups and templates on Panorama to push the configuration to the managed firewalls.
    Public Cloud Platform
    AWS Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    VM-Series Plugin Version (
    Minimum
    )
    Features
    AWS
    3.0.1
    10.0 (
    10.0.5
    )
    Latest
    2.0.6
    Introduces enhancements and bug fixes.
    3.0.0
    10.0 (
    10.0.5
    )
    Latest
    2.0.6
    Introduces Panorama Orchestration and new monitoring parameters.
    2.0.2
    9.0 (
    9.0.6
    )
    Latest
    1.0.4
    Introduces fixes for known issues.
    9.1 (
    9.1.2
    )
    Latest
    1.0.8
    10.0 (
    10.0.0
    )
    Latest
    2.0.0
    10.1 (
    10.1.0
    )
    Latest
    2.0.2
    2.0.1
    9.0 (
    9.0.6
    )
    Latest
    1.0.4
    Introduces a fix for a known issue.
    9.1 (
    9.1.2
    )
    Latest
    2.0.0
    9.0 (
    9.0.6
    )
    Latest
    1.0.4
    9.1 (
    9.1.2
    )
    Latest
    1.0.8
    1.0.1
    8.1 (
    8.1.3
    )
    9.0 (
    9.0.0
    )
    9.0.x
    N/A
    Introduces fixes for known issues.
    1.0.0
    8.1 (
    8.1.3
    )
    9.0 (
    9.0.0
    )
    9.0.x
    N/A
    Enables support for VM Monitoring to monitor the virtual machine inventory within your AWS VPCs so that you can consistently enforce Security policy that automatically adapts to changes within your AWS deployment.
    Public Cloud Platform
    Azure Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    VM-Series Plugin Version
    (
    Minimum
    )
    Features
    Azure
    3.1.0
    10.0 (
    10.0.1
    )
    Latest
    2.0.1
    Introduces fixes for a known issue.
    10.1 (
    10.1.0
    )
    Latest
    2.1.0
    3.0.1
    10.0 (
    10.0.1
    )
    Latest
    2.0.1
    Introduces fixes for known issues.
    10.1 (
    10.1.0
    )
    Latest
    2.1.0
    3.0.0
    10.0 (
    10.0.1
    )
    Latest
    2.0.1
    Introduces Panorama Orchestration.
    10.1 (
    10.1.0
    )
    Latest
    2.1.0
    2.0.3
    9.0 (
    9.0.6
    )
    Latest
    1.0.4
    Introduces a fix for a known issue.
    9.1 (
    9.1.2
    )
    Latest
    1.0.8
    10.0 (
    10.0.0
    )
    Latest
    2.0.0
    10.1 (
    10.1.0
    )
    Latest
    2.1.0
    2.0.2
    8.1 (
    8.1.11
    )
    9.0 (
    9.0.5
    )
    Latest
    1.0.4
    Introduces fixes for known issues.
    2.0.1
    8.1 (
    8.1.11
    )
    9.0 (
    9.0.5
    )
    Latest
    1.0.4
    Introduces fixes for known issues.
    2.0.0
    8.1 (
    8.1.8
    )
    Latest
    N/A
    Enables support for:
    9.0 (
    9.0.3
    )
    Latest
    1.0.4
    Enables support for:
    1.0.0
    8.1 (
    8.1.3
    )
    9.0 (
    9.0.0
    )
    9.0.x
    N/A
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for Azure to monitor the virtual machine inventory within your Azure subscription.
    Public Cloud Platform
    GCP Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    VM-Series Plugin Version
    Features
    GCP
    2.0.0
    (Upgrade from 1.0.0 to 2.0.0 is not supported.)
    9.0 (
    9.0.4
    )
    Latest
    1.0.4
    Enables you to monitor and secure VMs or GKE clusters deployed in GCP.
    • Deploy auto scaling for VM instance groups or GKE clusters using auto scaling templates for both firewall and application deployments.
    • VM Monitoring for GCP assets.

    SD-WAN

    Learn about the Panorama™ plugin for SD-WAN.
    The following table shows the features introduced in each version of the Panorama™ plugin for SD-WAN.
    Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    Features
    2.1.0
    10.0 (
    10.0.4
    )
    Latest
    SD-WAN supports Aggregated Ethernet (AE) interfaces with or without subinterfaces for link redundancy. AE interfaces allow you to tag for different ISP services to achieve end-to-end traffic segmentation. SD-WAN also supports Layer 3 subinterfaces for end-to-end traffic segmentation.
    2.0.3
    10.0 (
    10.0.3
    )
    Latest
    Minor bug and performance fixes.
    2.0.2
    10.0 (
    10.0.3
    )
    Latest
    Includes support so you can control whether Auto VPN configuration enables or disables the
    Remove Private AS
     setting for all BGP peer groups on a branch or hub.
    2.0.1
    10.0 (
    10.0.3
    )
    Latest
    Includes support for full mesh VPN cluster with DDNS service, auto-VPN configuration with branch behind NAT, and Direct Internet Access (DIA) AnyPath.
    2.0.0
    10.0 (
    10.0.2
    )
    Latest
    Maintain high-quality application experience by leveraging Forward Error Correction (FEC) and packet duplication and by accurately measuring SaaS and Cloud applications when you have an SD-WAN firewall with Direct Internet Access (DIA) links.
    1.0.6
    9.1 (
    9.1.4
    )
    Latest
    Minor bug and performance fixes.
    1.0.5
    9.1 (
    9.1.4
    )
    Latest
    Minor bug and performance fixes.
    1.0.4
    9.1 (
    9.1.4
    )
    Latest
    In an SD-WAN VPN cluster that has more than one hub, you must assign a priority to each hub, which determines the primary hub and hub failover order. Panorama maps the priority to a BGP local preference and pushes the local preference to the branches in the cluster.
    1.0.3
    9.1 (
    9.1.3
    )
    10.0.0
    When the SD-WAN hub is behind a NAT device, the plugin supports an upstream NAT IP address or FQDN for Auto VPN configuration to use as a tunnel endpoint.
    1.0.2
    9.1 (
    9.1.2-h1
    )
    9.1.3
    Improves ease of use, such as an automatic Security policy rule to allow BGP between branches and hubs, ability to refresh the IKE preshared key for VPN cluster members, specifying VPN tunnel IP address ranges, and more.
    1.0.1
    9.1 (
    9.1.1
    )
    9.1.2
    Improves monitoring experience and search filtering, and adds an option to display HA peers consecutively.
    1.0.0
    9.1 (
    9.1.0
    )
    9.1.2
    Enables support for SD-WAN from Panorama. Configure the Panorama plugin for SD-WAN to provide intelligent and dynamic path selection on top of the industry-leading security that PAN-OS software already delivers. Provide the optimal end user experience by leveraging multiple ISP links to ensure application performance and scale capacity.

    VMware NSX

    Review the features introduced in each version of the VM-Series firewall VMware NSX plugin.
    The following table shows the features introduced in each version of the VM-Series firewall VMware NSX plugin. For additional information about each plugin, see the release notes on the Customer Support Portal.
    Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    Managed VM-Series PAN-OS Version (
    Minimum
    )
    New Features or Changes
    4.0.0
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: Latest 10.0.x
    • NSX-T N/S: Latest
    • NSX-T E/W: Latest
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces Security-Centric Deployment Workflow (East-West) for the VM-Series on VMware NSX-T.
    3.2.3
    • NSX-V: 10.0.0 (
      10.0.4
      )
    • NSX-T N/S: 10.0.0 (
      10.0.4
      )
    • NSX-T E/W: 10.0.0 (
      10.0.4
      )
    • NSX-V: Latest 10.0.x
    • NSX-T N/S: Latest
    • NSX-T E/W: Latest
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    3.2.1
    • NSX-V: 9.0 (
      9.0.8
      )
    • NSX-T N/S: 9.0 (
      9.0.8
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    • NSX-V: Latest 10.0.x
    • NSX-T N/S: Latest
    • NSX-T E/W: Latest
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces fixes for known issues.
    3.2.0
    • NSX-V: 9.0 (
      9.0.8
      )
    • NSX-T N/S: 9.0 (
      9.0.8
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    • NSX-V: Latest 10.0.x
    • NSX-T N/S: Latest
    • NSX-T E/W: Latest
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces Security Policy Extension Between NSX-V and NSX-T and Device Certificate Support on the VM-Series for NSX.
    The following VM-Series firewall for NSX OVFs require that you enable device certificates.
    • 10.0.1 or later
    • 9.1.5 or later
    • 9.0.11 or later
    • 8.1.17 or later
    3.1.0
    9.1 (
    9.1.0
    )
    Latest
    • NSX-V: 8.1 (
      8.1.0
      )
    • NSX-T N/S: 9.0 (
      9.0.4
      )
    • NSX-T E/W: 9.1 (
      9.1.0
      )
    Introduces the VM-Series firewall on VMware NSX-T for East-West traffic protection.
    2.0.6
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.5
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces Proxy Bypass Support and Curl Call Timeout features.
    2.0.4
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces the Automated Full Dynamic Address Group Sync feature.
    2.0.3
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.2
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues.
    2.0.1
    8.1 (
    8.1.0
    )
    9.0.x
    8.1 (
    8.1.0
    )
    Introduces fixes for known issues. Minimum required plugin version for Panorama 8.1.

    VMware vCenter

    Learn about the Panorama™ plugin for VMware vCenter.
    The following table shows the features introduced in each version of the Panorama™ plugin for VMware vCenter.
    Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    Features
    1.0.0
    9.0 (
    9.0.2
    )
    Latest
    Enables support for VM Monitoring from Panorama. Configure the Panorama plugin for VMware vCenter to monitor VM workloads so that you can consistently enforce security policy that automatically adapts to changes within your vCenter environment.

    Zero Touch Provisioning (ZTP)

    Learn about the Panorama™ plugin for Zero Touch Provisioning (ZTP).
    The following table shows the features introduced in each version of the Panorama™ plugin for Zero Touch Provisioning (ZTP).
    Plugin Version
    Panorama Version (
    Minimum
    )
    Maximum Panorama Version
    Features
    1.0.2
    10.0 (
    10.0.3
    )
    Latest
    Minor bug and performance fixes.
    1.0.1
    10.0 (
    10.0.3
    )
    Latest
    Minor bug and performance fixes.
    1.0.0
    9.1 (
    9.1.4
    )
    Latest
    Enables support for ZTP from Panorama. Configure the Panorama plugin for ZTP to simplify and streamline initial firewall deployment by automating the new managed firewall on-boarding without the need for network administrators to manually provision the firewall.

    Recommended For You

    Recommended Videos

    Recommended videos not found.

    © 2021 Palo Alto Networks, Inc. All rights reserved.

    Techdocs Logo