VM-Series Firewall Hypervisor Support

Palo Alto Networks offers hypervisor version support on the VM-Series firewall for the following deployments.

Private Cloud Deployments

The following Private Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
In the compatibility matrices below, the PAN-OS Version Support column displays the range of versions and the
(
Minimum
)
version in parentheses. For example, the PAN-OS Version column could say
PAN-OS 8.1.x (8.1.3)
; this means the integration supports PAN-OS 8.1, beginning with PAN-OS 8.1.3.
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.

VM-Series for VMware vSphere Hypervisor (ESXi)

This ESXi version support list does not include NSX. For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX-T.
You can download base images from the Palo Alto Networks Support Portal.
SR-IOV Access Mode cannot be used in ESXi deployments
.
PAN-OS Version Support
(
Minimum
)
VMware ESXi Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
5.1 (
not supported on PAN-OS 9.0
), 5.5 and 6.0
PA-VM-ESX-8.1.0.ova
PA-VM-ESX-9.0.0.ova
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
6.5, 6.7
SR-IOV, DPDK
PA-VM-ESX-8.1.0.ova
PA-VM-ESX-9.0.0.ova
PA-VM-ESX-9.1.0.ova
PA-VM-ESX-10.0.0.ova
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
7.0
SR-IOV, DPDK
PA-VM-ESX-9.0.0.ova
PA-VM-ESX-9.1.0.ova
PA-VM-ESX-10.0.0.ova

VM-Series for VMware NSX-V

vSphere with VMware NSX is available on all VM-Series firewalls except the VM-50 and VM-700 firewalls.
The vSphere with VMware NSX and Panorama combinations listed here are approved by Palo Alto Networks. For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
Panorama 8.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support
(
Minimum
)
VMware NSX-V Version Support (
Minimum
)
I/O Enhancement Support
Base Image
  • PAN-OS 8.1.x (
    8.1.0
    ) with NSX Plugin 2.0.2 and later
  • PAN-OS 9.0.x (
    9.0.0
    ) with NSX Plugin 2.0.3 and later
NSX Manager 6.3.x or 6.4.0 with vSphere 6.0 or 6.5
LRO
PA-VM-NSX-8.1.0.zip
with
vmware_nsx-2.0.2
PA-VM-NSX-9.0.0.zip
with
vmware_nsx-2.0.3
NSX Manager 6.4.1 and later with vSphere 6.0, 6.5, or 6.7
PAN-OS 9.1.x (
9.1.0
) or 10.0.x (
10.0.0
) with NSX Plugin 3.2.0 or later
NSX Manager 6.4.1 and later with vSphere 6.5 or 6.7
LRO
PA-VM-NSX-9.1.0.zip
PA-VM-NSX-10.0.0.zip
—Both with
vmware_nsx-3.2.0

VM-Series for VMware NSX-T

You can download base images from the Palo Alto Networks Support Portal.
The VMware NSX-T and Panorama combinations listed here are approved by Palo Alto Networks. For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
PAN-OS Version Support (
Minimum
)
VMware NSX-T Version Support (
Minimum
)
Base Image
PAN-OS 9.0.x (
9.0.4
)
NSX-T Manager: 2.4.0 and later
PA-VM-NST-9.0.4.zip
with
vmware_nsx-3.0.0
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
Both with NSX Plugin 3.1.0 or later
NSX-T Manager 2.5.0 and later
NSX-T Manager 3.0.0 and later
PA-VM-NST-9.1.0.zip
or
PA-VM-NST-10.0.0.zip
—Both with
vmware_nsx-3.1.0

VM-Series for KVM

You can download base images from the Palo Alto Networks Support Portal.
Not all versions support DPDK on KVM:
  • DPDK-SR-IOV works for PAN-OS 9.0.4 and later.
  • DPDK-Virtio works with PAN-OS 9.1 and later PAN-OS releases.
PAN-OS Version Support (
Minimum
)
VM-Series for KVM Version Support (
Minimum
)
I/O Enhancement Support
PAN-OS for VM-Series KVM Base Images
PAN-OS 8.1.x (
8.1.0
)
8.1 Requirements and Prerequisites
  • Ubuntu:
    • 14.04 LTS
    • 16.04 LTS
  • CentOS/Red Hat Enterprise Linux 7.2
  • DPDK
  • SR-IOV
PA-VM-KVM-8.1.x.qcow2
PAN-OS 8.1.x (
8.1.3
)
PAN-OS 9.0.x (
9.0.0
)
9.0 or 9.1 Requirements and Prerequisites
CentOS/Red Hat Enterprise Linux 7.2
Virtio/SR-IOV with DPDK
If the Centos version is later than 7.2, Packet MMAP mode support only for Virtio.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-KVM-8.1.x.qcow2
PA-VM-KVM-9.0.x.qcow2
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
CentOS/Red Hat Enterprise Linux 7.6
Virtio/SR-IOV with DPDK
PA-VM-KVM-9.1.x.qcow2
PA-VM-KVM-10.0.x.qcow2
PAN-OS 8.1.x (
8.1.11
)
PAN-OS 9.0.x (
9.0.6
)
PAN-OS 9.1.x (
9.1.0
)
  • CentOS/Red Hat Enterprise Linux 7.7
  • CentOS/Red Hat Enterprise Linux 8.0
  • DPDK with SR-IOV:
    • PAN-OS 8.1.11 & later releases
    • PAN-OS 9.0.6 & later releases
    • PAN-OS 9.1 & later releases
  • DPDK with Virtio: PAN-OS 9.1 & later releases
PA-VM-KVM-8.1.11.qcow2
PA-VM-KVM-9.0.6.qcow2
PA-VM-KVM-9.1.0.qcow2
PAN-OS 8.1.x (
8.1.11
)
PAN-OS 9.0.x (
9.0.6
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
Ubuntu 18.04
  • DPDK with SR-IOV:
    • PAN-OS 8.1.11 & later releases
    • PAN-OS 9.0.6 & later releases
    • PAN-OS 9.1 & later releases
  • DPDK with Virtio: PAN-OS 9.1 & later releases
PA-VM-KVM-8.1.x.qcow2
PA-VM-KVM-9.0.x.qcow2
PA-VM-KVM-9.1.x.qcow2
PA-VM-KVM-10.0.x.qcow2

VM-Series for Nutanix

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VM-Series for Nutanix Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
Layer 2, Layer 3, and virtual wire deployments
AHV
Nutanix AOS Version 5.1.5, 5.15
Nutanix AHV Release 20160925.121
PA-VM-8.1.0.qcow2
PAN-OS 8.1.x (
8.1.2
)
Layer 3 deployments only
AHV
Nutanix AOS Version 5.5.4, 5.15
Nutanix AHV Release 20170830.156S
Packet MMAP support for Layer 3 deployment.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-8.1.0.qcow2
and upgrade to PAN-OS 8.1.2.
PAN-OS 8.1.x (
8.1.3
)
Layer 3 deployments, and Virtual wire deployments with Service Chaining.
AHV
  • Nutanix AOS Version 5.9
    Nutanix AHV Release 20170830.171
  • Nutanix AOS Version 5.10, 5.15
    Nutanix AHV Release 20170830.185
Packet MMAP support only.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-8.1.3.qcow2
PAN-OS 9.0.x (
9.0.0
)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
AHV
Nutanix AOS Version 5.10, 5.15
Nutanix AHV Release 20170830.185
Packet MMAP support only.
To disable DPDK in the
init-cfg.txt
file used for bootstrapping, set:
op-cmd-dpdk-pkt-io=off
To disable DPDK from the CLI, use:
set system setting dpdk-pkt-io off
PA-VM-9.0.0.qcow2
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
Layer 3 deployments, and virtual wire deployments with Service Chaining.
AHV
Nutanix AOS Version 5.10, 5.15
Nutanix AHV Release 20170830.185
DPDK supported
PA-VM-9.1.0.qcow2
PA-VM-10.0.0.qcow2

VM-Series for Hyper-V

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support
(
Minimum
)
VM-Series for Hyper-V
Version Support (
Minimum
)
Base Image
PAN-OS 8.1.x (
8.1.0
)
  • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
  • Windows Server 2016 with Hyper-V role or Hyper-V 2016
PA-VM-HPV-8.1.0.vhdx
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
  • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
  • Windows Server 2016 with Hyper-V role or Hyper-V 2016
  • Windows Server 2019 with Hyper-V role or Hyper-V 2019
PA-VM-HPV-9.0.0.vhdx
PA-VM-HPV-9.1.0.vhdx
PA-VM-HPV-10.0.0.vhdx

VM-Series for OpenStack

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
VM-Series for OpenStack Version Support (
Minimum
)
I/O Enhancement Support
Base Image
PAN-OS 8.1.x (
8.1.0
)
KVM: Ubuntu 14.04
OpenStack: Mirantis 8.0 with Contrail 3.2
PA-VM-KVM-8.1.0.qcow2
PAN-OS 8.1.x (
8.1.0
)
OpenStack Newton 10
Virtio only
PA-VM-KVM-8.1.0.qcow2
PAN-OS 9.0.x (
9.0.0
)
PA-VM-KVM-9.0.0.qcow2
PAN-OS 9.0.x (
9.0.3
)
Redhat OpenStack Queens 13
Packet MMAP and SR-IOV only
PA-VM-KVM-9.0.3.qcow2
PAN-OS 9.1.x (
9.1.5
)
PAN-OS 10.0.x (
10.0.2
)
Redhat OpenStack Queens 13
  • DPDK with Virtio
  • DPDK with SR-IOV
  • Packet MMAP with Virtio
  • Packet MMAP with SR-IOV
PA-VM-KVM-9.1.5.qcow2
PA-VM-KVM-10.0.2.qcow2

Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
Cisco ACI Version Support (
Minimum
)
Base Image
Unmanaged Mode only:
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
  • 2.3(1e)
  • 3.1
  • 3.2
  • 5.0 and later
Panorama Plugin for Cisco ACI
cisco-1.0.0
Unmanaged Mode only:
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
  • 2.3(1e)
  • 3.1
  • 3.2
  • 4.0 and later
  • 5.0 and later
Panorama Plugin for Cisco ACI
cisco-1.0.1
Unmanaged Mode only:
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
  • 3.2
  • 4.0 and later
  • 5.0 and later
Panorama Plugin for Cisco ACI
cisco-2.0.0

Public Cloud Deployments

Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, and Oracle

Public Cloud Deployment
PAN-OS Version Support (
Minimum
)
I/O Enhancement Support
VM-Series on AWS
List of supported AWS Regions.
Support for AWS Outposts on PAN-OS 9.1 and later.
PAN-OS 8.1.x (
8.1.0
)
DPDK is supported in addition to SR-IOV, but is disabled by default.
PAN-OS 9.0.x (
9.0.0
)
DPDK is supported on all instances except C5 and M5 instances. C5 and M5 instances support SR-IOV only.
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
VM-Series on Azure
List of supported Azure Regions.
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
  • DPDK is not supported on PAN-OS 8.1.x or 9.0.x.
  • DPDK is supported in PAN-OS 9.1 and later PAN-OS releases.
VM-Series on Google Cloud
List of supported Google Cloud Regions
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
DPDK is supported and enabled by default.
VM-Series on Oracle Cloud Infrastructure
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
Oracle Government Cloud requires PAN-OS 9.1.3 or a later PAN-OS release with VM-Series plugin 1.0.12 or a later version.
DPDK is supported and enabled by default.
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.

Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air

The following Public Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
Public Cloud Deployment
PAN-OS Version Support (
Minimum
)
I/O Enhancement Support
Base Image
VM-Series on Alibaba Cloud
PAN-OS 8.1.x (
8.1.0
)
PAN-OS 9.0.x (
9.0.0
)
PAN-OS 9.1.x (
9.1.0
)
DPDK and Packet MMAP are supported. DPDK is enabled by default.
PA-VM-KVM-8.1.3.qcow2
PA-VM-KVM-9.0.0.qcow2
PA-VM-KVM-9.1.0.qcow2
VM-Series on vCloud Air
PAN-OS 8.1.x (
8.1.0
)
PA-VM-ESX-8.1.0.ova
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.

VM-Series Firewall for Azure VMware Solution (Powered by NSX-T)

You can download base images from the Palo Alto Networks Support Portal.
PAN-OS Version Support (
Minimum
)
Base Image
PAN-OS 9.1.x (
9.1.0
)
PAN-OS 10.0.x (
10.0.0
)
Both with NSX Plugin 3.2.0 or later
PA-VM-NST-9.1.0.zip
PA-VM-NST-10.0.0.zip
—Both with
vmware_nsx-3.2.0 or later

Recommended For You