Palo Alto Networks Compatibility Matrix
    : VM-Series Firewall Hypervisor Support
    Focus
    Download PDF
    Focus
    1. Home
    2. Palo Alto Networks Compatibility Matrix
    3. VM-Series Firewalls
    4. VM-Series Firewall Hypervisor Support
    Download PDF

    Palo Alto Networks Compatibility Matrix

    VM-Series Firewall Hypervisor Support

    Table of Contents

    VM-Series Firewall Hypervisor Support

    Palo Alto Networks offers hypervisor version support on the VM-Series firewall for both the following deployments:

    Private Cloud Deployments

    The following Private Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal:
    In the compatibility matrices below, the PAN-OS Version Support column displays the range of versions and the (
    Minimum
    ) version in parentheses. For example, if the PAN-OS Version column displays
    PAN-OS 9.1.x (
    9.1.3
    )
    , it indicates that the integration supports PAN-OS 9.1 releases beginning with PAN-OS 9.1.3.
    Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.

    VM-Series for VMware vSphere Hypervisor (ESXi)

    This ESXi version support list does not include NSX. For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX-T.
    You can download base images from the Palo Alto Networks Support Portal.
    Access mode with SR-IOV on VMware ESXi is supported on PAN-OS 9.1.5 and later PAN-OS 9.1 versions and PAN-OS 10.1 and later PAN-OS versions—both with VM-Series plugin 2.0.5 and later
    . See Enable VLAN Access Mode for ESXi for more information.
    PAN-OS Version Support
    (
    Minimum
    )
    VMware ESXi Version Support
    VMware Virtual Machine Hardware Version
    I/O Enhancement Support
    Base Image
    PAN-OS 9.1.x (
    9.1.0
    )
    6.5, 6.7
    vmx-10
    SR-IOV, DPDK
    PA-VM-ESX-9.1.0.ova
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    6.7, 7.0
    vmx-10
    SR-IOV, DPDK
    PA-VM-ESX-9.1.0.ova
    PA-VM-ESX-10.1.0.ova
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    6.7, 7.0, 8.0
    vmx-10
    SR-IOV, DPDK
    PA-VM-ESX-10.2.0.ova
    PA-VM-ESX-11.0.0.ova

    VM-Series for VMware NSX-V

    vSphere with VMware NSX is available on all VM-Series firewalls except the VM-50 and VM-700 firewalls.
    The vSphere with VMware NSX and Panorama combinations listed here are approved by Palo Alto Networks. For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
    Panorama 9.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
    You can download base images from the Palo Alto Networks Support Portal.
    VMware having already announced EoS for NSX-V, Palo Alto Networks will continue to support the VM-Series on NSX-V running PAN-OS 10.0.x, and lesser, managed by Panorama 10.1.x or 10.2.x.
    • No VM-Series for VMware NSX-V base images for PAN-OS 10.1.x or 10.2.x will be made available
    • You cannot upgrade the VM-Series firewall for NSX-V to 10.1.x or 10.2.x
    • Panorama 10.1.x, 10.2.x supports 9.1.x base images until EOL date
    See the Palo Alto Networks End-of-Life Summary for more information about the PAN-OS EoL schedule.
    Supported Panorama Versions
    PAN-OS Version Support
    Panorama Plugin for NSX
    VMware NSX-V Manager
    vSphere
    VMware Virtual Machine Hardware Version
    Minimum Base Image
    I/O Enhancement Support
    • 9.1.x
    • 10.1.x
    9.1.0 to 9.1.6
    3.2.0 to latest 4.0.x
    6.4.1 to 6.4.7
    • 6.5
    • 6.7
    vmx-10
    PA-VM-NSX-9.1.0.zip
    LRO
    • 9.1.x
    • 10.1.x
    9.1.7 to latest 9.1.x
    3.2.0 to latest 4.0.x
    6.4.8 and later
    • 6.5
    • 6.7
    • 7.0
    vmx-10
    PA-VM-NSX-9.1.9.zip
    LRO
    10.2.x
    9.1.0 to 9.1.6
    5.0.0 and later
    6.4.1 to 6.4.7
    • 6.5
    • 6.7
    vmx-10
    PA-VM-NSX-9.1.0.zip
    LRO
    10.2.x
    9.1.7 to latest 9.1.x
    5.0.0 and later
    6.4.8 and later
    • 6.5
    • 6.7
    • 7.0
    vmx-10
    PA-VM-NSX-9.1.9.zip
    LRO

    VM-Series for VMware NSX-T

    You can download base images from the Palo Alto Networks Support Portal.
    The VMware NSX-T and Panorama combinations listed here are approved by Palo Alto Networks. For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
    VMware NSX 4.0.x Service Deployments, for partner Service Virtual Machines (SVM), may experience traffic redirect known issues. Please contact VMware NSX Technical Support for details
    Panorama Version Support
    Panorama Plugin for NSX
    VMware NSX-T Version Support
    VMware Virtual Machine Hardware Version
    PAN-OS Version Support (
    Minimum
    )
    Latest Base Image
    11.0.x
    5.0.1 and later
    3.2.x, 4.1.x
    vmx-10
    PAN-OS 10.1.x (
    10.1.9-h1
    )
    PAN-OS 10.2.x (
    10.2.4
    )
    PA-VM-NST-10.2.4-vmwaresigned.zip
    10.2.x
    5.0.0 and later
    3.2.x, 4.0.x, 4.1.x
    vmx-10
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.4
    )
    PA-VM-NST-10.2.4-vmwaresigned.zip
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    10.1.x
    3.2.0 to 4.0.x
    2.5.x, 3.0.x, 3.1.x, 3.2.x
    vmx-10
    PAN-OS 10.1.x (
    10.1.0
    )
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    PA-VM-NST-9.1.9-vmwaresigned.zip
    4.0.x
    4.0.x
    vmx-10
    PAN-OS 10.1.x (
    10.1.9-h1
    )
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    9.1.x
    3.2.0 to 4.0.x
    2.5.x, 3.0.x, 3.1.x
    vmx-10
    PAN-OS 9.1.x (
    9.1.0
    )
    PA-VM-NST-9.1.9.zip

    VM-Series for KVM

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support (
    Minimum
    )
    VM-Series for KVM Version Support (
    Minimum
    )
    I/O Enhancement Support
    PAN-OS for VM-Series KVM Base Images
    PAN-OS 9.1.x (
    9.1.0
    )
    CentOS/Red Hat Enterprise Linux:
    • 7.x.x (
      7.6.x
      )
    • 8.x.x (
      8.0.x
      )
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-9.1.x.qcow2
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    CentOS/Red Hat Enterprise Linux:
    • 7.x.x (
      7.6.x
      )
    • 8.x.x (
      8.0.x
      )
    • 9.0.x (
      9.0.x
      )
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.1.x.qcow2
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    CentOS/Red Hat Enterprise Linux 9.1.x (
    9.1.x
    )
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    Ubuntu 18.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-9.1.x.qcow2
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 10.1.x (
    10.1.0
    )
    Ubuntu 20.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    Ubuntu 22.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 10.1.x (
    10.1.0
    )
    SUSE Enterprise Server 15 with QEMU 3.1.1
    • MacVTap
    • Virtio
    PA-VM-KVM-10.1.x.qcow2

    VM-Series for Nutanix

    You can download base images from the Palo Alto Networks Support Portal.
    The VM-Series firewall for Nutanix uses the VM-Series firewall for KVM base image (qcow2).
    PAN-OS Version Support (
    Minimum
    )
    VM-Series for Nutanix Version Support (
    Minimum
    )
    I/O Enhancement Support
    VM-Series for KVM Base Image
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS Version 5.10, 5.15
    Nutanix AHV Release 20170830.185
    DPDK supported
    PA-VM-KVM-9.1.0.qcow2
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS Version 5.20
    Nutanix AHV Release 20201105.2030
    DPDK supported
    PA-VM-KVM-10.1.x.qcow2
    PA-VM-KVM-10.2.x.qcow2
    PAN-OS 10.1.x (
    10.1.0
    )
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS 6.5 version 6.0.5 in VPC mode
    L3 mode only
    PA-VM-KVM-10.1.x.qcow2

    VM-Series for Hyper-V

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support
    (
    Minimum
    )
    VM-Series for Hyper-V
    Version Support (
    Minimum
    )
    I/O Enhancement Support
    Base Image
    PAN-OS 9.1.x (
    9.1.0
    )
    • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
    • Windows Server 2016 with Hyper-V role or Hyper-V 2016
    • Windows Server 2019 with Hyper-V role or Hyper-V 2019
    • Packet MMAP supported
    • DPDK not supported
    PA-VM-HPV-9.1.0.vhdx
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
    • Windows Server 2016 with Hyper-V role or Hyper-V 2016
    • Windows Server 2019 with Hyper-V role or Hyper-V 2019
    • DPDK with SR-IOV supported
    • Packet MMAP with Virtio supported
    • Packet MMAP with SR-IOV
    supported
    PA-VM-HPV-10.1.0.vhdx
    PA-VM-HPV-10.2.0.vhdx
    PA-VM-HPV-11.0.0.vhdx

    VM-Series for OpenStack

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support (
    Minimum
    )
    VM-Series for OpenStack Version Support (
    Minimum
    )
    I/O Enhancement Support
    Base Image
    PAN-OS 9.1.x (
    9.1.5
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    Redhat OpenStack Queens 13
    • DPDK with Virtio
    • DPDK with SR-IOV
    • Packet MMAP with Virtio
    • Packet MMAP with SR-IOV
    PA-VM-KVM-9.1.5.qcow2
    PA-VM-KVM-10.1.0.qcow2
    PAN-OS 10.1.x (
    10.1.3
    )
    Redhat OpenStack Train 16
    • DPDK with Virtio
    • DPDK with SR-IOV
    • Packet MMAP with Virtio
    • Packet MMAP with SR-IOV
    PA-VM-KVM-10.1.3.qcow2

    Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI

    See Cisco ACI for supported PAN-OS, Panorama, and Cisco ACI plugin versions.
    You can download base images from the Palo Alto Networks Support Portal.

    Public Cloud Deployments

    Palo Alto Networks supports the following public cloud deployments:

    Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, and Oracle

    Public Cloud Deployment
    PAN-OS Version Support (
    Minimum
    )
    I/O Enhancement Support
    VM-Series on AWS
    List of supported AWS Regions.
    Support for AWS Outposts on PAN-OS 9.1 and later.
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    VM-Series on Azure
    List of supported Azure Regions.
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    Azure Stack Edge:
    PAN-OS 10.1.x (
    10.1.5
    )
    DPDK is supported in PAN-OS 9.1 and later PAN-OS releases.
    VM-Series on Google Cloud
    List of supported Google Cloud Regions
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    DPDK is supported and enabled by default.
    VM-Series on Oracle Cloud Infrastructure
    PAN-OS 9.1.x (
    9.1.0
    )
    PAN-OS 10.1.x (
    10.1.0
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    • DPDK is supported and enabled by default.
    • SR-IOV and MMAP mode is supported with jumbo and non-jumbo frames on PAN-OS 9.1.x and PAN-OS 10.1.x and later with VM-Series plugin 2.1.0 and later.
    Oracle Gov Cloud
    :
    PAN-OS 9.1.x (
    9.1.3
    )
    PAN-OS 10.1.x (
    10.1.2
    )
    PAN-OS 10.2.x (
    10.2.0
    )
    PAN-OS 11.0.x (
    11.0.0
    )
    VM-Series on IBM Cloud
    PAN-OS 10.1.x (
    10.1.0
    )
    —
    Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
    To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.

    Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air

    The following Public Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
    Public Cloud Deployment
    PAN-OS Version Support (
    Minimum
    )
    I/O Enhancement Support
    Base Image
    VM-Series on Alibaba Cloud
    PAN-OS 9.1.x (
    9.1.0
    )
    DPDK and Packet MMAP are supported. DPDK is enabled by default.
    PA-VM-KVM-9.1.0.qcow2
    Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.

    VM-Series Firewall for VMware Cloud on AWS

    You can deploy the VM-Series firewall on VMware Cloud on AWS. Refer to the Set Up a VM-Series Firewall on an ESXi Server for information on deploying the VM-Series firewall. Refer to VM-Series for VMware vSphere Hypervisor (ESXi) for supported VMware ESXi versions.
    The VM-Series firewall on VMware NSX-V and NSX-T is not supported on VMware Cloud on AWS.
    PAN-OS Version Support
    I/0 Enhancement Support
    Documentation
    PAN-OS 9.1.x (
    9.1.0
    )
    DPDK and SR-IOV

    Recommended For You

    © 2023 Palo Alto Networks, Inc. All rights reserved.