VM-Series Firewall Hypervisor Support
Table of Contents
Expand all | Collapse all
-
- Cloud Identity Engine Cipher Suites
-
- PAN-OS 11.1 GlobalProtect Cipher Suites
- PAN-OS 11.1 IPSec Cipher Suites
- PAN-OS 11.1 IKE and Web Certificate Cipher Suites
- PAN-OS 11.1 Decryption Cipher Suites
- PAN-OS 11.1 Administrative Session Cipher Suites
- PAN-OS 11.1 HA1 SSH Cipher Suites
- PAN-OS 11.1 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 11.1 Cipher Suites Supported in FIPS-CC Mode
-
- PAN-OS 11.0 GlobalProtect Cipher Suites
- PAN-OS 11.0 IPSec Cipher Suites
- PAN-OS 11.0 IKE and Web Certificate Cipher Suites
- PAN-OS 11.0 Decryption Cipher Suites
- PAN-OS 11.0 Administrative Session Cipher Suites
- PAN-OS 11.0 HA1 SSH Cipher Suites
- PAN-OS 11.0 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 11.0 Cipher Suites Supported in FIPS-CC Mode
-
- PAN-OS 10.2 GlobalProtect Cipher Suites
- PAN-OS 10.2 IPSec Cipher Suites
- PAN-OS 10.2 IKE and Web Certificate Cipher Suites
- PAN-OS 10.2 Decryption Cipher Suites
- PAN-OS 10.2 Administrative Session Cipher Suites
- PAN-OS 10.2 HA1 SSH Cipher Suites
- PAN-OS 10.2 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 10.2 Cipher Suites Supported in FIPS-CC Mode
-
- PAN-OS 10.1 GlobalProtect Cipher Suites
- PAN-OS 10.1 IPSec Cipher Suites
- PAN-OS 10.1 IKE and Web Certificate Cipher Suites
- PAN-OS 10.1 Decryption Cipher Suites
- PAN-OS 10.1 Administrative Session Cipher Suites
- PAN-OS 10.1 HA1 SSH Cipher Suites
- PAN-OS 10.1 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 10.1 Cipher Suites Supported in FIPS-CC Mode
-
- PAN-OS 9.1 GlobalProtect Cipher Suites
- PAN-OS 9.1 IPSec Cipher Suites
- PAN-OS 9.1 IKE and Web Certificate Cipher Suites
- PAN-OS 9.1 Decryption Cipher Suites
- PAN-OS 9.1 Administrative Session Cipher Suites
- PAN-OS 9.1 HA1 SSH Cipher Suites
- PAN-OS 9.1 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 9.1 Cipher Suites Supported in FIPS-CC Mode
-
- PAN-OS 8.1 GlobalProtect Cipher Suites
- PAN-OS 8.1 IPSec Cipher Suites
- PAN-OS 8.1 IKE and Web Certificate Cipher Suites
- PAN-OS 8.1 Decryption Cipher Suites
- PAN-OS 8.1 Administrative Session Cipher Suites
- PAN-OS 8.1 HA1 SSH Cipher Suites
- PAN-OS 8.1 PAN-OS-to-Panorama Connection Cipher Suites
- PAN-OS 8.1 Cipher Suites Supported in FIPS-CC Mode
VM-Series Firewall Hypervisor Support
Palo Alto Networks offers hypervisor version support
on the VM-Series firewall for both the following deployments:
Private Cloud Deployments
The following Private Clouds require a PAN-OS for VM-Series
base image from the Palo Alto Networks Support Portal:
In the compatibility matrices below, the PAN-OS Version Support column displays the range of
versions and the (
Minimum
) version in parentheses. For example, if the
PAN-OS Version column displays PAN-OS 9.1.x (
, it indicates
that the integration supports PAN-OS 9.1 versions beginning with PAN-OS 9.1.3.9.1.3
)Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
VM-Series for VMware vSphere Hypervisor (ESXi)
This ESXi version support list does not include NSX.
For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX (Formerly NSX-T).
You can download base images from the Palo Alto Networks Support Portal.
Access mode with SR-IOV on VMware ESXi is supported on PAN-OS 9.1.5 and later PAN-OS 9.1
versions and all later PAN-OS versions—both with VM-Series plugin 2.0.5 and
later.
PAN-OS Version Support Minimum ) | VMware ESXi Version Support | VMware Virtual Machine Hardware Version | I/O Enhancement Support | Base Image |
---|---|---|---|---|
PAN-OS 10.2.x ( 10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) | 6.7, 7.0, 8.0 | vmx-10 | SR-IOV, DPDK | PA-VM-ESX-10.2.0.ova PA-VM-ESX-11.0.0.ova |
PAN-OS 9.1.x ( 9.1.0 )PAN-OS 10.1.x ( 10.1.0 ) | 6.7, 7.0 | vmx-10 | SR-IOV, DPDK | PA-VM-ESX-9.1.0.ova PA-VM-ESX-10.1.0.ova |
PAN-OS 9.1.x ( 9.1.0 ) | 6.5, 6.7 | vmx-10 | SR-IOV, DPDK | PA-VM-ESX-9.1.0.ova |
VM-Series for VMware NSX-V
vSphere with VMware NSX is available on all VM-Series
firewalls except the VM-50 and VM-700 firewalls.
The vSphere with VMware NSX and Panorama combinations listed
here are approved by Palo Alto Networks. For versions of PAN-OS
certified by VMware, see the VMware Compatibility Guide.
Panorama 9.1 and later versions require the VMware NSX plugin.
For more plugin version information, see Panorama Plugins for VMware NSX.
You can download base images from the Palo Alto Networks Support Portal.
VMware having already announced EoS for NSX-V, Palo Alto Networks
will continue to support the VM-Series on NSX-V running PAN-OS 10.0.x,
and lesser, managed by Panorama 10.1.x or 10.2.x.
- No VM-Series for VMware NSX-V base images for PAN-OS 10.1.x or 10.2.x will be made available.
- You cannot upgrade the VM-Series firewall for NSX-V to 10.1.x or 10.2.x.
- Panorama 10.1.x and 10.2.x supports 9.1.x base images until EoL date.
See the Palo Alto Networks End-of-Life
Summary for more information about the PAN-OS EoL schedule.
Supported Panorama Versions | PAN-OS Version Support | Panorama Plugin for NSX | VMware NSX-V Manager | vSphere | VMware Virtual Machine Hardware Version | Minimum Base Image | I/O Enhancement Support |
---|---|---|---|---|---|---|---|
10.2.x | 9.1.0 to 9.1.6 | 5.0.0 and later | 6.4.1 to 6.4.7 |
| vmx-10 | PA-VM-NSX-9.1.0.zip | LRO |
| 9.1.7 to latest 9.1.x | 3.2.0 to latest 4.0.x | 6.4.8 and later |
| vmx-10 | PA-VM-NSX-9.1.9.zip | LRO |
| 9.1.0 to 9.1.6 | 3.2.0 to latest 4.0.x | 6.4.1 to 6.4.7 |
| vmx-10 | PA-VM-NSX-9.1.0.zip | LRO |
VM-Series for VMware NSX (Formerly NSX-T)
You can download base images from the Palo
Alto Networks Support Portal.
The VMware NSX-T and Panorama combinations listed here are approved
by Palo Alto Networks. For versions of PAN-OS certified by VMware,
see the VMware Compatibility Guide.
VMware NSX 4.0.x Service Deployments, for partner
Service Virtual Machines (SVM), may experience traffic redirect known issues.
Please contact VMware NSX Technical Support for details
Panorama Version Support | Panorama Plugin for NSX | VMware NSX-T Version Support | VMware Virtual Machine Hardware Version | PAN-OS Version Support
( Minimum ) | Latest Base Image |
---|---|---|---|---|---|
11.0.x | 5.0.1 and later | 3.2.x, 4.1.x | vmx-10 | PAN-OS 10.1.x ( 10.1.9-h1 )PAN-OS 10.2.x ( 10.2.4 ) | PA-VM-NST-10.2.4-vmwaresigned.zip |
10.2.x | 5.0.0 and later NSX 4.1.x with PAN-OS 10.2 requires NSX plugin 5.0.1 or
later. | 3.2.x, 4.0.x, 4.1.x | vmx-10 | PAN-OS 10.1.x ( 10.1.0 )PAN-OS 10.2.x ( 10.2.4 ) | PA-VM-NST-10.2.4-vmwaresigned.zip PA-VM-NST-10.1.9-h1-vmwaresigned.zip |
10.1.x | 3.2.0 to 4.0.x | 2.5.x, 3.0.x, 3.1.x, 3.2.x | vmx-10 | PAN-OS 10.1.x ( 10.1.0 ) | PA-VM-NST-10.1.9-h1-vmwaresigned.zip PA-VM-NST-9.1.9-vmwaresigned.zip |
4.0.x | 4.0.x | vmx-10 | PAN-OS 10.1.x ( 10.1.9-h1 ) | PA-VM-NST-10.1.9-h1-vmwaresigned.zip | |
9.1.x | 3.2.0 to 4.0.x | 2.5.x, 3.0.x, 3.1.x | vmx-10 | PAN-OS 9.1.x ( 9.1.0 ) | PA-VM-NST-9.1.9.zip |
VM-Series for KVM
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support ( Minimum ) | VM-Series for KVM Version
Support ( Minimum ) | I/O Enhancement Support | PAN-OS for VM-Series KVM Base Images |
---|---|---|---|
PAN-OS 11.1.x ( 11.1.0 ) | Ubuntu 20.04 |
| PA-VM-KVM-11.1.0.qcow2 for ARM PA-VM-KVM-11.1.x.qcow2 for x86 |
PAN-OS 10.2.x ( 10.2.5 )PAN-OS 10.1.x ( 10.1.11 ) | RHEL 9.2 | DPDK with Virtio | PA-VM-KVM-10.2.5-h1.qcow2 PA-VM-KVM-10.1.11-h1.qcow2 |
PAN-OS 10.2.x ( 10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) | Ubuntu 22.04 |
| PA-VM-KVM-10.2.x.qcow2 PA-VM-KVM-11.0.0.qcow2 |
PAN-OS 10.2.x ( 10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) | CentOS/Red Hat Enterprise Linux 9.1.x
( 9.1.x ) |
| PA-VM-KVM-10.2.x.qcow2 PA-VM-KVM-11.0.0.qcow2 |
PAN-OS 10.1.x ( 10.1.0 )PAN-OS 10.2.x ( 10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) | CentOS/Red Hat Enterprise Linux:
|
| PA-VM-KVM-10.1.x.qcow2 PA-VM-KVM-10.2.x.qcow2 PA-VM-KVM-11.0.0.qcow2 |
PAN-OS 10.1.x ( 10.1.0 ) | Ubuntu 20.04 |
| PA-VM-KVM-10.1.x.qcow2 |
PAN-OS 10.1.x ( 10.1.0 ) | SUSE Enterprise Server 15 with QEMU 3.1.1 |
| PA-VM-KVM-10.1.x.qcow2 |
PAN-OS 9.1.x ( 9.1.0 )PAN-OS 10.1.x ( 10.1.0 ) | Ubuntu 18.04 |
| PA-VM-KVM-9.1.x.qcow2 PA-VM-KVM-10.1.x.qcow2 |
PAN-OS 9.1.x ( 9.1.0 ) | CentOS/Red Hat Enterprise Linux:
|
| PA-VM-KVM-9.1.x.qcow2 |
VM-Series for Nutanix
You can download base images from the Palo
Alto Networks Support Portal.
The VM-Series firewall for Nutanix uses the VM-Series firewall
for KVM base image (qcow2).
PAN-OS Version Support ( Minimum ) | VM-Series for Nutanix
Version Support ( Minimum ) | I/O Enhancement Support | VM-Series for KVM Base
Image |
---|---|---|---|
PAN-OS 10.1.x ( 10.1.0 )PAN-OS
10.2.x ( 10.2.0 )Layer 3 deployments, and virtual
wire deployments with Service Chaining. | Nutanix AOS Version 5.20 Nutanix AHV
Release 20201105.2030 | DPDK supported | PA-VM-KVM-10.1.x.qcow2 PA-VM-KVM-10.2.x.qcow2 |
PAN-OS 10.1.x ( 10.1.0 )Layer
3 deployments, and virtual wire deployments with Service Chaining. | Nutanix AOS 6.5 version 6.0.5 in VPC mode | L3 mode only | PA-VM-KVM-10.1.x.qcow2 |
PAN-OS 9.1.x ( 9.1.0 )PAN-OS 10.1.x ( 10.1.0 )Layer 3 deployments, and virtual wire deployments with
Service Chaining. | Nutanix AOS Version 5.10, 5.15 Nutanix AHV Release 20170830.185 | DPDK supported | PA-VM-KVM-9.1.0.qcow2 PA-VM-KVM-10.1.x.qcow2 |
VM-Series for Hyper-V
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support Minimum ) | VM-Series for Hyper-V Version
Support ( Minimum ) | I/O Enhancement Support | Base Image |
---|---|---|---|
PAN-OS 10.1.x ( 10.1.0 )PAN-OS 10.2.x ( 10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) |
|
| PA-VM-HPV-10.1.0.vhdx PA-VM-HPV-10.2.0.vhdx PA-VM-HPV-11.0.0.vhdx |
PAN-OS 9.1.x ( 9.1.0 ) |
|
| PA-VM-HPV-9.1.0.vhdx |
VM-Series for OpenStack
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support
( Minimum ) | VM-Series for OpenStack Version
Support ( Minimum ) | I/O Enhancement Support | Base Image |
---|---|---|---|
PAN-OS 10.1.x ( 10.1.3 ) | Redhat OpenStack Train 16 |
| PA-VM-KVM-10.1.3.qcow2 |
PAN-OS 9.1.x ( 9.1.5 )PAN-OS
10.1.x ( 10.1.0 ) | Redhat OpenStack Queens 13 |
| PA-VM-KVM-9.1.5.qcow2 PA-VM-KVM-10.1.0.qcow2 |
Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI
See Cisco ACI for supported
PAN-OS, Panorama, and Cisco ACI plugin versions.
You can download base images from the Palo Alto Networks Support Portal.
Public Cloud Deployments
Palo Alto Networks supports the following public cloud
deployments:
Public Cloud Deployments Available from a Marketplace—AWS,
Azure, GCP, and Oracle
Public Cloud Deployment | PAN-OS Version Support
( Minimum ) | I/O Enhancement Support |
---|---|---|
PAN-OS 9.1.x ( 9.1.0 )PAN-OS
10.1.x ( 10.1.0 )PAN-OS 10.2.x ( 10.2.0 )PAN-OS
11.0.x ( 11.0.0 )PAN-OS 11.1.x ( 11.1.0 ) | In PAN-OS 11.1.x (11.1.0) and later, ARM support is available
on AWS Graviton 2 instances. | |
VM-Series on Azure List of
supported Azure Regions. | PAN-OS 9.1.x ( 9.1.0 )PAN-OS
10.1.x ( 10.1.0 )10.2.0 )PAN-OS
11.0.x ( 11.0.0 )Azure Stack Edge: PAN-OS
10.1.x ( 10.1.5 ) | DPDK is supported in PAN-OS 9.1 and later
PAN-OS releases. |
VM-Series on Google Cloud List
of supported Google Cloud Regions | PAN-OS 9.1.x ( 9.1.0 )PAN-OS
10.1.x ( 10.1.0 )10.2.0 )PAN-OS
11.0.x ( 11.0.0 ) | DPDK is supported and enabled by default. |
VM-Series on Oracle Cloud Infrastructure | PAN-OS 9.1.x ( 9.1.0 )PAN-OS
10.1.x ( 10.1.0 )10.2.0 )PAN-OS
11.0.x ( 11.0.0 ) |
|
Oracle Gov Cloud :PAN-OS 9.1.x
( 9.1.3 )PAN-OS 10.1.x ( 10.1.2 )10.2.0 )PAN-OS 11.0.x ( 11.0.0 ) | ||
VM-Series on IBM Cloud | PAN-OS 10.1.x ( 10.1.0 ) | — |
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To
view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.
Public Cloud Deployments Requiring a Base Image—Alibaba,
Oracle, vCloud Air
The following Public Clouds require a PAN-OS for VM-Series
base image from the Palo Alto Networks Support Portal.
Public Cloud Deployment | PAN-OS Version Support
( Minimum ) | I/O Enhancement Support | Base Image |
---|---|---|---|
VM-Series on Alibaba Cloud | PAN-OS 9.1.x ( 9.1.0 ) | DPDK and Packet MMAP are supported. DPDK is
enabled by default. | PA-VM-KVM-9.1.0.qcow2 |
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
VM-Series Firewall for VMware Cloud on AWS
You can deploy the VM-Series firewall on VMware Cloud
on AWS. Refer to the Set Up a VM-Series Firewall on
an ESXi Server for information on deploying the VM-Series
firewall. Refer to VM-Series for VMware vSphere Hypervisor (ESXi) for supported
VMware ESXi versions.
The VM-Series firewall on VMware NSX-V and NSX-T is not
supported on VMware Cloud on AWS.
PAN-OS Version Support | I/0 Enhancement Support | Documentation |
---|---|---|
PAN-OS 9.1.x ( 9.1.0 ) | DPDK and SR-IOV |