Deployment Modes of CN-Series Firewalls

Table of Contents

Quickstart- CN-Series Firewall Deployment

Deploy the CN-Series Firewall as a Kubernetes Service (Recommended mode of Deployment)

Deployment Modes of CN-Series Firewalls

Where Can I Use This?	What Do I Need?
CN-Series deployment	CN-Series 10.1.x or above Container Images Panorama running PAN-OS 10.1.x or above version Helm 3.6 or above version client for CN-Series deployment with Helm

After you review the CN-Series Core Building Blocks and the high-level overview of the workflow in Secure Kubernetes Workloads with CN-Series Firewall, you can start deploying the CN-Series firewalls to secure traffic between containers within the same cluster, as well as between containers and other workload types such as virtual machines and bare-metal servers.

If you are on the OpenShift environment, see and for securing 5G traffic, see Secure 5G With the CN-Series Firewall.

You need standard Kubernetes tools such as kubectl or Helm to deploy and manage your Kubernetes clusters, apps, and firewall services. Panorama is not designed to be an orchestrator for Kubernetes cluster deployment and management. Templates for cluster management are provided by Managed Kubernetes providers. Palo Alto Networks provides community-supported templates for deploying CN-Series with Helm and Terraform.

Deploy the CN-Series Firewall as a Kubernetes Service (Recommended mode of Deployment)

Deploy the CN-Series Firewall as a DaemonSet

Deploy the CN-Series Firewall as a Kubernetes CNF

Deploy the Kubernetes CNF L3 in Standalone Mode

Before moving from deploying CN-Series as a DaemonSet to CN-Series as a Service or vice versa, you must delete and reapply

plugin-serviceaccount.yaml

When you deploy CN-Series as a DaemonSet

pan-plugin-cluster-mode-secret

must not exist.

When you deploy CN-Series as a Kubernetes service

pan-plugin-cluster-mode-secret

must be present.