VM-Series Firewall Hypervisor Support

Review Palo Alto Networks support for hypervisors on VM-Series firewalls.
Palo Alto Networks offers hypervisor version support on VM-Series firewalls for the following deployments.

Private Cloud Deployments

The following Private Clouds require a PAN-OS
®
for VM-Series base image from the Palo Alto Networks Support Portal.
In the compatibility matrices below, the PAN-OS version support column displays the range of versions and the (
Minimum
) version in parentheses. For example, where the PAN-OS Version column says
PAN-OS 8.1.x (
8.1.3
)
, it means the integration supports PAN-OS 8.1 releases beginning with PAN-OS 8.1.3.
Further I/O Enhancement support is detailed in SR-IOV and DPDK Drivers on VM-Series Firewalls.

VM-Series for VMware vSphere Hypervisor (ESXi)

This ESXi version support list does not include NSX. For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX-T.
You can download base images from the Palo Alto Networks Support Portal.
You cannot use SR-IOV Access Mode in ESXi deployments.
PAN-OS Version Support
(
Minimum
)
VMware ESXi Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
5.1 (
not supported on PAN-OS 9.0
), 5.5 and 6.0
PA-VM-ESX-8.1.0.ova
PA-VM-ESX-9.9.0.ova
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
6.5
SR-IOV, DPDK
PA-VM-ESX-8.1.0.ova
PA-VM-ESX-9.0.0.ova
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
6.7
SR-IOV, DPDK
PA-VM-ESX-8.1.0.ova
PA-VM-ESX-9.0.0.ova
PA-VM-ESX-9.1.0.ova

VM-Series for VMware NSX-V

vSphere with VMware NSX is available on all VM-Series firewalls except the VM-50 and VM-700 firewalls.
The vSphere with VMware NSX and Panorama combinations listed in this table are approved by Palo Alto Networks. For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
Panorama appliances running PAN-OS 8.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support
(
Minimum
)
VMware NSX-V Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
) with NSX Plugin 2.0.2 or later.
vSphere: 6.0 and 6.5
NSX Manager:
6.3.x and 6.4.0
LRO
PA-VM-NSX-8.1.0.zip
with
vmware_nsx-2.0.2
vSphere:
6.0, 6.5, and 6.7
NSX Manager:
6.4.1 and later
PAN-OS 9.0.x (
9.0.0
) with NSX Plugin 2.0.3 or later
vSphere:6.0 and 6.5
NSX Manager:
6.3.x and 6.4.0
LRO
PA-VM-NSX-9.0.0.zip
with
vmware_nsx-2.0.3
vSphere:
6.0, 6.5, and 6.7
NSX Manager:
6.4.1 and later
PAN-OS 9.1.x (
9.1.0
) with NSX Plugin 3.1.0 or later
vSphere:
6.5 and 6.7
NSX Manager:
6.4.1 and later
LRO
PA-VM-NSX-9.1.0.zip
with
vmware_nsx-3.1.0

VM-Series for VMware NSX-T

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VMware NSX-T Version Support (
Minimum
)
Base Image
PAN-OS 9.0.x (
9.0.4
)
NSX-T Manager: 2.4.0 and later
PA-VM-NST-9.0.4.zip
with
vmware_nsx-3.0.0
PAN-OS 9.1.x (
9.1.0
)
NSX-T Manager: 2.5.0 and later
PA-VM-NST-9.1.0.zip
with
vmware_nsx-3.1.0

VM-Series for KVM

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VM-Series for KVM Version Support (
Minimum
)
I/O Enhancement Support
PAN-OS for VM-Series KVM Base Images
PAN-OS 8.1.x(
8.1.0
)
8.1 Requirements and Prerequisites
  • Ubuntu:
    • 14.04 LTS
    • 16.04 LTS
  • CentOS/Red Hat Enterprise Linux 7.2
  • DPDK
  • SR-IOV
PA-VM-KVM-8.1.0.qcow2
PAN-OS 8.1.x(
8.1.3
)
PAN-OS 9.0.x(
9.0.0
)
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
PAN-OS 9.1.x(
9.1.0
)
9.0 or 9.1 Requirements and Prerequisites
CentOS 7.5
Packet MMAP mode support only.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-KVM-8.1.3.qcow2
PA-VM-KVM-9.0.0.qcow2
PA-VM-KVM-9.0.3.xfr.qcow2
PA-VM-KVM-9.1.0.qcow2
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
CentOS 7.6
Virtio/SR-IOV with DPDK
PA-VM-KVM-9.0.3.xfr.qcow2
PAN-OS 9.1.x (
9.1.0
)
PA-VM-KVM-9.1.0.qcow2
PAN-OS 8.1.x (
8.1.3
)
RHEL 7.6
8.1.3 - only Packet MMAP/SR-IOV
8.1.10 - only SR-IOV-DPDK
PA-VM-KVM-8.1.3.qcow2
PA-VM-KVM-8.1.10.qcow2
PAN-OS 9.0.x (
9.0.1
)
9.0.1 - only Packet MMAP and SR-IOV
PA-VM-KVM-9.0.1.qcow2
9.0.4 - only SR-IOV-DPDK
PA-VM-KVM-9.0.4.qcow2
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
9.0.3.xfr - Virtio/SR-IOV with DPDK
PA-VM-KVM-9.0.3.xfr.qcow2
PAN-OS 9.1.x (
9.1.0
)
9.1.x - Virtio/SR-IOV with DPDK
PA-VM-KVM-9.1.0.qcow2
PAN-OS 8.1.x (
8.1.11
)
PAN-OS 9.0.x (
9.0.1
)
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
PAN-OS 9.1.x (
9.1.0
)
  • CentOS/RHEL 7.7
  • CentOS/RHEL 8.0
  • DPDK with SR-IOV:
    • 8.1.11 & later
    • 9.0.6 & later
    • 9.0.5.xfr & later
    • 9.1 & later
  • DPDK with Virtio: 9.1 & later
PA-VM-KVM-8.1.11.qcow2
PA-VM-KVM-9.0.6.qcow2
PA-VM-KVM-9.0.3.xfr.qcow2
PA-VM-KVM-9.1.0.qcow2
PAN-OS 8.1.x (
8.1.11
)
PAN-OS 9.0.x (
9.0.6
)
PAN-OS 9.1.x (
9.1.0
)
Ubuntu 18.04
  • DPDK with SR-IOV:
    • 8.1.11 & later
    • 9.0.6 & later
    • 9.1 & later
  • DPDK with Virtio: 9.1 & later
PA-VM-KVM-8.1.11.qcow2
PA-VM-KVM-9.0.6.qcow2
PA-VM-KVM-9.1.0.qcow2

VM-Series for Nutanix

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VM-Series for Nutanix Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
Layer 2, Layer 3, and virtual wire deployments
AHV
Nutanix AOS Version 5.1.5
Nutanix AHV Release 20160925.121
PA-VM-8.1.0.qcow2
PAN-OS 8.1.x (
8.1.2
)
Layer 3 deployments only
AHV
Nutanix AOS Version 5.5.4 and later
Nutanix AHV Release 20170830.156S
Packet MMAP support for Layer 3 deployment.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-8.1.0.qcow2
and upgrade to PAN-OS 8.1.2.
PAN-OS 8.1.x (
8.1.3
)
Layer 3 deployments, and Virtual wire deployments with Service Chaining.
AHV
  • Nutanix AOS Version 5.9
    Nutanix AHV Release 20170830.171
  • Nutanix AOS Version 5.10
    Nutanix AHV Release 20170830.185
Packet MMAP support only.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-8.1.3.qcow2
PAN-OS 9.0.x (
9.0.0
)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
AHV
Nutanix AOS Version 5.10
Nutanix AHV Release 20170830.185
Packet MMAP support only.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-9.0.0.qcow2
PAN-OS 9.1.x (
9.1.0
)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
AHV
Nutanix AOS Version 5.10
Nutanix AHV Release 20170830.185
DPDK supported
PA-VM-9.1.0.qcow2

VM-Series for Hyper-V

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support
(
Minimum
)
VM-Series for Hyper-V
Version Support (
Minimum
)
Base Image
PAN-OS 8.1.x (
8.1.0
)
  • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
  • Windows Server 2016 with Hyper-V role or Hyper-V 2016
PA-VM-HPV-8.1.0.vhdx
PAN-OS 9.0.x (
9.0.0
)
PA-VM-HPV-9.0.0.vhdx

VM-Series for OpenStack

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VM-Series for OpenStack Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
KVM: Ubuntu 14.04
OpenStack: Mirantis 8.0 with Contrail 3.2
PA-VM-KVM-8.1.0.qcow2
PAN-OS 8.1.x (
8.1.0
)
OpenStack Newton 10
Virtio only
PA-VM-KVM-8.1.0.qcow2
PAN-OS 9.0.x (
9.0.0
)
PA-VM-KVM-9.0.0.qcow2
PAN-OS 9.0.x (
9.0.3
)
Redhat OpenStack Queens 13
Packet MMAP and SR-IOV only
PA-VM-KVM-9.0.3.qcow2
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
Redhat OpenStack Queens 13
Virtio/SR-IOV with DPDK
PA-VM-KVM-9.0.3.xfr.qcow2

Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
Cisco ACI Version Support (
Minimum
)
Base Image
Unmanaged Mode only:
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
ACI 2.3(1e), 3.1, and 3.2
Panorama Plugin for Cisco ACI
cisco-1.0.0
Unmanaged Mode only:
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
ACI 2.3(1e), 3.1, 3.2, and 4.0 and later
Panorama Plugin for Cisco ACI
cisco-1.0.1
Unmanaged Mode only:
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
ACI 3.1, 3.2, and 4.0 and later
Panorama Plugin for Cisco ACI
cisco-2.0.0

Public Cloud Deployments

Public Cloud Deployments Available from a Marketplace—AWS, Azure, and GCP

Public Cloud Deployment
PAN-OS Version Support (
Minimum
)
I/O Enhancement Support
VM-Series on AWS
PAN-OS 8.1.x (
8.1.0
)
DPDK is supported in addition to SR-IOV, but is disabled by default.
PAN-OS 9.0.x (
9.0.0
)
DPDK is supported on all instances except C5 and M5 instances. C5 and M5 instances support SR-IOV only.
PAN-OS 9.0.x.xfr (
9.0.3.xfr
)
PAN-OS 9.0.3.xfr supports both DPDK and SR-IOV for all instance types, but DPDK is disabled by default.
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 9.0.3.xfr supports both DPDK and SR-IOV for all instance types, but DPDK is disabled by default.
VM-Series on Azure
List of supported Azure Regions.
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
  • DPDK is not supported on PAN-OS 8.1.x or 9.0.x.
  • DPDK is supported in PAN-OS 9.1.x.
VM-Series on Google Cloud
List of supported Google Cloud Regions
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
DPDK is supported and enabled by default.
Further I/O Enhancement support is detailed in SR-IOV and DPDK Drivers on VM-Series Firewalls.
To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.

Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air

The following Public Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
Public Cloud Deployment
PAN-OS Version Support (
Minimum
)
I/O Enhancement Support
Base Image
VM-Series on Alibaba Cloud
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
DPDK and Packet MMAP are supported. DPDK is enabled by default.
PA-VM-KVM-8.1.3.qcow2
PA-VM-KVM-9.0.0.qcow2
PA-VM-KVM-9.1.0.qcow2
VM-Series on Oracle Cloud Infrastructure
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
Packet MMAP support only. DPDK is enabled by default and must be disabled.
PA-VM-KVM-8.1.0.qcow2
PA-VM-KVM-9.0.0.qcow2
PA-VM-KVM-9.1.0.qcow2
VM-Series on vCloud Air
PAN-OS 8.1.x (
8.1.0
)
PA-VM-ESX-8.1.0.ova
Further I/O Enhancement support is detailed in SR-IOV and DPDK Drivers on VM-Series Firewalls.

Recommended For You