: VM-Series Firewall Hypervisor Support
Focus
Focus

VM-Series Firewall Hypervisor Support

Table of Contents

VM-Series Firewall Hypervisor Support

Palo Alto Networks offers hypervisor version support on VM-Series firewalls for both of the following deployments:

Private Cloud Deployments

The following Private Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal:
In the compatibility matrix below, the PAN-OS Version Support column displays the range of versions and the (Minimum) version in parentheses. For example, if the PAN-OS Version Support column displays PAN-OS 11.1.x (11.1.3), it indicates that the integration supports PAN-OS 11.1 versions beginning with PAN-OS 11.1.3.
Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.

VM-Series for VMware vSphere Hypervisor (ESXi)

This ESXi version support list does not include NSX. For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX (Formerly NSX-T).
You can download base images from the Palo Alto Networks Support Portal.
Access mode with SR-IOV on VMware ESXi is supported on PAN-OS 9.1.5 and later PAN-OS 9.1 versions and all later PAN-OS versions but only with VM-Series plugin 2.0.5 and later plugin versions. However, you must enable VLAN access mode for ESXi where needed.
PAN-OS Version Support
(Minimum)
VMware ESXi Version Support
VMware Virtual Machine Hardware Version
I/O Enhancement Support
Base Image
PAN-OS 11.1.x (11.1.0)
PAN-OS 11.2.x (11.2.0)
6.7, 7.0
  • vmx-10
  • vmx-15
    vmx-15 requires PAN-OS 11.1.3 base image
SR-IOV, DPDK
PA-VM-ESX-11.1.0.ova
PA-VM-ESX-11.1.3.ova
PA-VM-ESX-11.2.0.ova
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
6.7, 7.0, 8.0
vmx-10
SR-IOV, DPDK
PA-VM-ESX-10.2.0.ova
PA-VM-ESX-11.0.0.ova
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
6.7, 7.0
vmx-10
SR-IOV, DPDK
PA-VM-ESX-9.1.0.ova
PA-VM-ESX-10.1.0.ova
PAN-OS 9.1.x (9.1.0)
6.5, 6.7
vmx-10
SR-IOV, DPDK
PA-VM-ESX-9.1.0.ova

VM-Series for VMware NSX-V

vSphere with VMware NSX is available on all VM-Series firewalls except the VM-50 and VM-700 firewalls.
Palo Alto Networks approves the vSphere with VMware NSX and Panorama combinations listed below with the following criteria. You can download base images from the Palo Alto Networks Support Portal.
For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
  • Panorama management servers running PAN-OS 9.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
  • VMware has announced EoS for NSX-V and Palo Alto Networks will continue to support the VM-Series on NSX-V running PAN-OS 9.1 when managed by Panorama management servers running PAN-OS 10.1 or PAN-OS 10.2 software.
    • Palo Alto Networks does not support VMware NSX-V on Panorama management servers running PAN-OS 11.0 or later versions.
    • There aren't any VM-Series for VMware NSX-V base images for PAN-OS 10.1 or later PAN-OS versions.
    • You cannot upgrade the VM-Series firewall for NSX-V to PAN-OS 10.1 or later PAN-OS versions.
    • The Panorama management server running PAN-OS 10.1 or PAN-OS 10.2 supports PAN-OS 9.1 base images until June 30, 2024.
See the Palo Alto Networks End-of-Life Summary for more information about the PAN-OS EoL schedule.
Supported Panorama Versions
PAN-OS Version Support
Panorama Plugin for NSX
VMware NSX-V Manager
vSphere
VMware Virtual Machine Hardware Version
Minimum Base Image
I/O Enhancement Support
10.2.x
9.1.0 to 9.1.6
5.0.0 and later
6.4.1 to 6.4.7
  • 6.5
  • 6.7
vmx-10
PA-VM-NSX-9.1.0.zip
LRO
  • 9.1.x
  • 10.1.x
9.1.7 to latest 9.1.x
3.2.0 to latest 4.0.x
6.4.8 and later
  • 6.5
  • 6.7
  • 7.0
vmx-10
PA-VM-NSX-9.1.9.zip
LRO
  • 9.1.x
  • 10.1.x
9.1.0 to 9.1.6
3.2.0 to latest 4.0.x
6.4.1 to 6.4.7
  • 6.5
  • 6.7
vmx-10
PA-VM-NSX-9.1.0.zip
LRO

VM-Series for VMware NSX (Formerly NSX-T)

Palo Alto Networks approves the VMware NSX-T and Panorama combinations listed below. You can download base images from the Palo Alto Networks Support Portal.
For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
VMware NSX 4.0.x Service Deployments for partner Service Virtual Machines (SVM) sometimes experience a known traffic redirect issue. Contact VMware NSX Technical Support for details.
Panorama Version Support
Panorama Plugin for NSX
VMware NSX-T Version Support
VMware Virtual Machine Hardware Version
PAN-OS Version Support (Minimum)
Latest Base Image
11.0.x
5.0.1 and later
3.2.x, 4.1.x
vmx-10
PAN-OS 10.1.x (10.1.9-h1)
PAN-OS 10.2.x (10.2.4)
PA-VM-NST-10.2.4-vmwaresigned.zip
10.2.x
5.0.0 and later
NSX 4.1.x with PAN-OS 10.2 requires NSX plugin 5.0.1 or later.
3.2.x, 4.0.x, 4.1.x
vmx-10
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.4)
PA-VM-NST-10.2.4-vmwaresigned.zip
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
10.1.x
3.2.0 to 4.0.x
2.5.x, 3.0.x, 3.1.x, 3.2.x
vmx-10
PAN-OS 10.1.x (10.1.0)
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
PA-VM-NST-9.1.9-vmwaresigned.zip
4.0.x
4.0.x
vmx-10
PAN-OS 10.1.x (10.1.9-h1)
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
9.1.x
3.2.0 to 4.0.x
2.5.x, 3.0.x, 3.1.x
vmx-10
PAN-OS 9.1.x (9.1.0)
PA-VM-NST-9.1.9.zip

VM-Series for KVM

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (Minimum)
VM-Series for KVM Version Support (Minimum)
I/O Enhancement SupportPAN-OS for VM-Series KVM Base Images
PAN-OS 11.1.x (11.1.0)
Ubuntu 20.04
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-11.1.0.qcow2 for ARM
PA-VM-KVM-11.1.x.qcow2 for x86
PAN-OS 10.2.x (10.2.5)
PAN-OS 10.1.x (10.1.11)
RHEL 9.2
DPDK with Virtio
PA-VM-KVM-10.2.5-h1.qcow2
PA-VM-KVM-10.1.11-h1.qcow2
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
Ubuntu 22.04
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
CentOS/Red Hat Enterprise Linux 9.1.x (9.1.x)
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
CentOS/Red Hat Enterprise Linux:
  • 7.x.x (7.6.x)
  • 8.x.x (8.0.x)
  • 9.0.x (9.0.x)
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-10.1.x.qcow2
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
PAN-OS 10.1.x (10.1.0)
Ubuntu 20.04
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-10.1.x.qcow2
PAN-OS 10.1.x (10.1.0)
SUSE Enterprise Server 15 with QEMU 3.1.1
  • MacVTap
  • Virtio
PA-VM-KVM-10.1.x.qcow2
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
Ubuntu 18.04
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-9.1.x.qcow2
PA-VM-KVM-10.1.x.qcow2
PAN-OS 9.1.x (9.1.0)
CentOS/Red Hat Enterprise Linux:
  • 7.x.x (7.6.x)
  • 8.x.x (8.0.x)
  • DPDK with SR-IOV
  • DPDK with Virtio
PA-VM-KVM-9.1.x.qcow2

VM-Series for Nutanix

You can download base images from the Palo Alto Networks Support Portal.
The VM-Series firewall for Nutanix uses the VM-Series firewall for KVM base image (qcow2).
PAN-OS Version Support (Minimum)
VM-Series for Nutanix Version Support (Minimum)
I/O Enhancement Support
VM-Series for KVM Base Image
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
Nutanix AOS Version 5.20
Nutanix AHV Release 20201105.2030
DPDK supported
PA-VM-KVM-10.1.x.qcow2
PA-VM-KVM-10.2.x.qcow2
PAN-OS 10.1.x (10.1.0)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
Nutanix AOS 6.5 version 6.0.5 in VPC mode
L3 mode only
PA-VM-KVM-10.1.x.qcow2
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
Nutanix AOS Version 5.10, 5.15
Nutanix AHV Release 20170830.185
DPDK supported
PA-VM-KVM-9.1.0.qcow2
PA-VM-KVM-10.1.x.qcow2

VM-Series for Hyper-V

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support
(Minimum)
VM-Series for Hyper-V
Version Support (Minimum)
I/O Enhancement Support
Base Image
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
  • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
  • Windows Server 2016 with Hyper-V role or Hyper-V 2016
  • Windows Server 2019 with Hyper-V role or Hyper-V 2019
  • DPDK with SR-IOV supported
  • Packet MMAP with Virtio supported
  • Packet MMAP with SR-IOV
supported
PA-VM-HPV-10.1.0.vhdx
PA-VM-HPV-10.2.0.vhdx
PA-VM-HPV-11.0.0.vhdx
PAN-OS 9.1.x (9.1.0)
  • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
  • Windows Server 2016 with Hyper-V role or Hyper-V 2016
  • Windows Server 2019 with Hyper-V role or Hyper-V 2019
  • Packet MMAP supported
  • DPDK not supported
PA-VM-HPV-9.1.0.vhdx

VM-Series for OpenStack

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (Minimum)
VM-Series for OpenStack Version Support (Minimum)
I/O Enhancement Support
Base Image
PAN-OS 10.1.x (10.1.3)
Redhat OpenStack Train 16
  • DPDK with Virtio
  • DPDK with SR-IOV
  • Packet MMAP with Virtio
  • Packet MMAP with SR-IOV
PA-VM-KVM-10.1.3.qcow2
PAN-OS 9.1.x (9.1.5)
PAN-OS 10.1.x (10.1.0)
Redhat OpenStack Queens 13
  • DPDK with Virtio
  • DPDK with SR-IOV
  • Packet MMAP with Virtio
  • Packet MMAP with SR-IOV
PA-VM-KVM-9.1.5.qcow2
PA-VM-KVM-10.1.0.qcow2

Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI

Review the Cisco ACI plugins information for supported PAN-OS, Panorama, and Cisco ACI plugin versions.
You can download base images from the Palo Alto Networks Support Portal.

Public Cloud Deployments

Palo Alto Networks supports the following public cloud deployments:

Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, and Oracle

Public Cloud Deployment
PAN-OS Version Support (Minimum)
I/O Enhancement Support
VM-Series on AWS
List of supported AWS Regions.
Support for AWS Outposts on PAN-OS 9.1 and later.
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
PAN-OS 11.1.x (11.1.0)
In PAN-OS 11.1.x (11.1.0) and later, ARM support is available on AWS Graviton 3 and AWS Graviton 2 instances.
VM-Series on Azure
List of supported Azure Regions.
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
Azure Stack Edge:
PAN-OS 10.1.x (10.1.5)
DPDK is supported in PAN-OS 9.1 and later PAN-OS releases.
VM-Series on Google CloudList of supported Google Cloud Regions
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
DPDK is supported and enabled by default.
VM-Series on Oracle Cloud Infrastructure
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
  • DPDK is supported and enabled by default.
  • SR-IOV and MMAP mode is supported with jumbo and non-jumbo frames on PAN-OS 9.1.x and PAN-OS 10.1.x and later with VM-Series plugin 2.1.0 and later.
Oracle Gov Cloud:
PAN-OS 9.1.x (9.1.3)
PAN-OS 10.1.x (10.1.2)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
VM-Series on IBM Cloud
PAN-OS 10.1.x (10.1.0)
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.

Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air

The following Public Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
Public Cloud Deployment
PAN-OS Version Support (Minimum)
I/O Enhancement Support
Base Image
VM-Series on Alibaba Cloud
PAN-OS 9.1.x (9.1.0)
DPDK and Packet MMAP are supported. DPDK is enabled by default.
PA-VM-KVM-9.1.0.qcow2
Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.

VM-Series Firewall for VMware Cloud on AWS

You can deploy the VM-Series firewall on VMware Cloud on AWS. Set Up a VM-Series Firewall on an ESXi Server to deploy the VM-Series firewall. Review also the supported VMware ESXi versions for the VM-Series for VMware vSphere Hypervisor (ESXi).
VMware Cloud on AWS does not support the VM-Series firewall on VMware NSX-V or NSX-T.
PAN-OS Version SupportI/0 Enhancement SupportDocumentation
PAN-OS 9.1.x (9.1.0)
DPDK and SR-IOV