Compatibility Matrix
VM-Series Firewall Hypervisor Support
Table of Contents
VM-Series Firewall Hypervisor Support
Palo Alto Networks offers hypervisor version support on VM-Series firewalls for both of the
following deployments:
Private Cloud Deployments
The following Private Clouds require a PAN-OS for VM-Series
base image from the Palo Alto Networks Support Portal:
- VM-Series for VMware vSphere Hypervisor (ESXi)
- VM-Series for VMware NSX-V
- VM-Series for VMware NSX (Formerly NSX-T)
- VM-Series for KVM
- VM-Series for Nutanix
- VM-Series for Hyper-V
- VM-Series for OpenStack
- Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI
In the compatibility matrix below, the PAN-OS Version Support column displays the range of
versions and the (Minimum) version in parentheses. For example, if the
PAN-OS Version Support column displays PAN-OS 11.1.x (11.1.3), it
indicates that the integration supports PAN-OS 11.1 versions beginning with PAN-OS
11.1.3.
Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.
VM-Series for VMware vSphere Hypervisor (ESXi)
This ESXi version support list does not include NSX.
For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX (Formerly NSX-T).
You can download base images from the Palo Alto Networks Support Portal.
Access mode with SR-IOV on VMware ESXi is supported on PAN-OS 9.1.5 and later
PAN-OS 9.1 versions and all later PAN-OS versions but only with VM-Series
plugin 2.0.5 and later plugin versions. However, you must enable VLAN access mode for ESXi
where needed.
PAN-OS Version Support (Minimum) | VMware ESXi Version Support | VMware Virtual Machine Hardware Version | I/O Enhancement Support | Base Image |
|---|---|---|---|---|
|
PAN-OS 11.1.x (11.1.0)
PAN-OS 11.2.x (11.2.0)
|
6.7, 7.0
|
| SR-IOV, DPDK |
PA-VM-ESX-11.1.0.ova
PA-VM-ESX-11.1.3.ova
PA-VM-ESX-11.2.0.ova
|
|
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
|
6.7, 7.0, 8.0
|
vmx-10
| SR-IOV, DPDK |
PA-VM-ESX-10.2.0.ova
PA-VM-ESX-11.0.0.ova
|
|
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
|
6.7, 7.0
|
vmx-10
| SR-IOV, DPDK |
PA-VM-ESX-9.1.0.ova
PA-VM-ESX-10.1.0.ova
|
PAN-OS 9.1.x (9.1.0) | 6.5, 6.7 | vmx-10 | SR-IOV, DPDK | PA-VM-ESX-9.1.0.ova |
VM-Series for VMware NSX-V
vSphere with VMware NSX is available on all VM-Series
firewalls except the VM-50 and VM-700 firewalls.
Palo Alto Networks approves the vSphere with VMware NSX and Panorama combinations listed below
with the following criteria. You can download base images from the Palo Alto Networks Support Portal.
For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
- Panorama management servers running PAN-OS 9.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
- VMware has announced EoS for NSX-V and Palo Alto Networks will continue to support the VM-Series on NSX-V running PAN-OS 9.1 when managed by Panorama management servers running PAN-OS 10.1 or PAN-OS 10.2 software.
- Palo Alto Networks does not support VMware NSX-V on Panorama management servers running PAN-OS 11.0 or later versions.
- There aren't any VM-Series for VMware NSX-V base images for PAN-OS 10.1 or later PAN-OS versions.
- You cannot upgrade the VM-Series firewall for NSX-V to PAN-OS 10.1 or later PAN-OS versions.
- The Panorama management server running PAN-OS 10.1 or PAN-OS 10.2 supports PAN-OS 9.1 base images until June 30, 2024.
See the Palo Alto Networks End-of-Life
Summary for more information about the PAN-OS EoL schedule.
Supported Panorama Versions | PAN-OS Version Support | Panorama Plugin for NSX | VMware NSX-V Manager | vSphere | VMware Virtual Machine Hardware Version | Minimum Base Image | I/O Enhancement Support |
|---|---|---|---|---|---|---|---|
|
10.2.x
|
9.1.0 to 9.1.6
|
5.0.0 and later
|
6.4.1 to 6.4.7
|
|
vmx-10
|
PA-VM-NSX-9.1.0.zip
|
LRO
|
|
9.1.7 to latest 9.1.x
|
3.2.0 to latest 4.0.x
|
6.4.8 and later
|
|
vmx-10
|
PA-VM-NSX-9.1.9.zip
|
LRO
|
| 9.1.0 to 9.1.6 | 3.2.0 to latest 4.0.x | 6.4.1 to 6.4.7 |
| vmx-10 | PA-VM-NSX-9.1.0.zip | LRO |
VM-Series for VMware NSX (Formerly NSX-T)
Palo Alto Networks approves the VMware NSX-T and Panorama combinations listed below. You can
download base images from the Palo Alto Networks Support Portal.
For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
VMware NSX 4.0.x Service Deployments for partner Service
Virtual Machines (SVM) sometimes experience a known traffic redirect issue.
Contact VMware NSX Technical Support for details.
|
Panorama Version Support
| Panorama Plugin for NSX |
VMware NSX-T Version Support
|
VMware Virtual Machine Hardware Version
|
PAN-OS Version Support
(Minimum)
|
Latest Base Image
|
|---|---|---|---|---|---|
|
11.0.x
|
5.0.1 and later
|
3.2.x, 4.1.x
|
vmx-10
|
PAN-OS 10.1.x (10.1.9-h1)
PAN-OS 10.2.x (10.2.4)
|
PA-VM-NST-10.2.4-vmwaresigned.zip
|
|
10.2.x
|
5.0.0 and later
NSX 4.1.x with PAN-OS 10.2 requires NSX plugin 5.0.1 or
later. |
3.2.x, 4.0.x, 4.1.x
|
vmx-10
|
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.4)
|
PA-VM-NST-10.2.4-vmwaresigned.zip
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
|
|
10.1.x
|
3.2.0 to 4.0.x
|
2.5.x, 3.0.x, 3.1.x, 3.2.x
|
vmx-10
|
PAN-OS 10.1.x (10.1.0)
|
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
PA-VM-NST-9.1.9-vmwaresigned.zip
|
|
4.0.x
|
4.0.x
|
vmx-10
|
PAN-OS 10.1.x (10.1.9-h1)
|
PA-VM-NST-10.1.9-h1-vmwaresigned.zip
| |
|
9.1.x
|
3.2.0 to 4.0.x
|
2.5.x, 3.0.x, 3.1.x
|
vmx-10
|
PAN-OS 9.1.x (9.1.0)
|
PA-VM-NST-9.1.9.zip
|
VM-Series for KVM
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support (Minimum) | VM-Series for KVM Version
Support (Minimum) | I/O Enhancement Support | PAN-OS for VM-Series KVM Base Images |
|---|---|---|---|
|
PAN-OS 11.0.4 (11.0.4)
PAN-OS 10.2.x (10.2.5)
PAN-OS 10.1.x (10.1.11)
|
RHEL 9.2
|
|
PA-VM-KVM-11.0.4.qcow2
PA-VM-KVM-10.2.5-h1.qcow2
PA-VM-KVM-10.1.11-h1.qcow2
|
|
PAN-OS 11.1.x (11.1.0)
| Ubuntu 20.04 |
|
PA-VM-KVM-11.1.0.qcow2 for ARM
PA-VM-KVM-11.1.x.qcow2 for x86
|
|
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
| Ubuntu 22.04 |
|
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
|
|
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
| CentOS/Red Hat Enterprise Linux 9.1.x (9.1.x) |
|
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
|
|
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
|
CentOS/Red Hat Enterprise Linux:
|
|
PA-VM-KVM-10.1.x.qcow2
PA-VM-KVM-10.2.x.qcow2
PA-VM-KVM-11.0.0.qcow2
|
|
PAN-OS 10.1.x (10.1.0)
| Ubuntu 20.04 |
|
PA-VM-KVM-10.1.x.qcow2
|
|
PAN-OS 10.1.x (10.1.0)
| SUSE Enterprise Server 15 with QEMU 3.1.1 |
|
PA-VM-KVM-10.1.x.qcow2
|
|
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
|
Ubuntu 18.04
|
|
PA-VM-KVM-9.1.x.qcow2
PA-VM-KVM-10.1.x.qcow2
|
PAN-OS 9.1.x (9.1.0) | CentOS/Red Hat Enterprise Linux:
|
| PA-VM-KVM-9.1.x.qcow2 |
VM-Series for Nutanix
You can download base images from the Palo
Alto Networks Support Portal.
The VM-Series firewall for Nutanix uses the VM-Series firewall
for KVM base image (qcow2).
PAN-OS Version Support (Minimum) | VM-Series for Nutanix
Version Support (Minimum) | I/O Enhancement Support | VM-Series for KVM Base
Image |
|---|---|---|---|
PAN-OS 10.1.x (10.1.0) PAN-OS
10.2.x (10.2.0) Layer 3 deployments, and virtual
wire deployments with Service Chaining. | Nutanix AOS Version 5.20 Nutanix AHV
Release 20201105.2030 | DPDK supported | PA-VM-KVM-10.1.x.qcow2 PA-VM-KVM-10.2.x.qcow2 |
PAN-OS 10.1.x (10.1.0) Layer
3 deployments, and virtual wire deployments with Service Chaining. | Nutanix AOS 6.5 version 6.0.5 in VPC mode | L3 mode only | PA-VM-KVM-10.1.x.qcow2 |
|
PAN-OS 9.1.x (9.1.0)
PAN-OS 10.1.x (10.1.0)
Layer 3 deployments, and virtual wire deployments with
Service Chaining.
|
Nutanix AOS Version 5.10, 5.15
Nutanix AHV Release 20170830.185
|
DPDK supported
|
PA-VM-KVM-9.1.0.qcow2
PA-VM-KVM-10.1.x.qcow2
|
VM-Series for Hyper-V
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support (Minimum) | VM-Series for Hyper-V Version
Support (Minimum) | I/O Enhancement Support | Base Image |
|---|---|---|---|
|
PAN-OS 11.2.x (11.2.0)
|
Windows Server 2022 with Hyper-V role or Hyper-V 2022
|
|
PA-VM HPV-11.2.0.vhdx
|
|
PAN-OS 10.1.x (10.1.0)
PAN-OS 10.2.x (10.2.0)
PAN-OS 11.0.x (11.0.0)
|
|
|
PA-VM-HPV-10.1.0.vhdx
PA-VM-HPV-10.2.0.vhdx
PA-VM-HPV-11.0.0.vhdx
|
PAN-OS 9.1.x (9.1.0) |
|
| PA-VM-HPV-9.1.0.vhdx |
VM-Series for OpenStack
You can download base images from the Palo
Alto Networks Support Portal.
PAN-OS Version Support
(Minimum) | VM-Series for OpenStack Version
Support (Minimum) | I/O Enhancement Support | Base Image |
|---|---|---|---|
|
PAN-OS 10.1.x (10.1.3)
|
Redhat OpenStack Train 16
|
|
PA-VM-KVM-10.1.3.qcow2
|
PAN-OS 9.1.x (9.1.5) PAN-OS
10.1.x (10.1.0) | Redhat OpenStack Queens 13 |
| PA-VM-KVM-9.1.5.qcow2 PA-VM-KVM-10.1.0.qcow2 |
Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI
Review the Cisco ACI plugins information for supported PAN-OS,
Panorama, and Cisco ACI plugin versions.
You can download base images from the Palo Alto Networks Support Portal.
Public Cloud Deployments
Palo Alto Networks supports the following public cloud
deployments:
- Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, Oracle, IBM, and Tencent Cloud China
- Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air
- VM-Series Firewall for VMware Cloud on AWS
Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, Oracle, IBM, and Tencent Cloud China
| Public Cloud Deployment | PAN-OS Version Support
(Minimum) | I/O Enhancement Support |
|---|---|---|
VM-Series on AWS List of supported AWS Regions. Support
for AWS Outposts on PAN-OS 9.1 and later. | PAN-OS 9.1.x (9.1.0) PAN-OS
10.1.x (10.1.0) PAN-OS 10.2.x (10.2.0) PAN-OS
11.0.x (11.0.0)
PAN-OS 11.1.x (11.1.0) |
In PAN-OS 11.1.x (11.1.0) and later, ARM support is available
on AWS Graviton 3 and AWS Graviton 2
instances.
|
VM-Series on Azure List of
supported Azure Regions. | PAN-OS 9.1.x (9.1.0) PAN-OS
10.1.x (10.1.0) PAN-OS 10.2.x (10.2.0)PAN-OS
11.0.x (11.0.0) Azure Stack Edge: PAN-OS
10.1.x (10.1.5) | DPDK is supported in PAN-OS 9.1 and later
PAN-OS releases. |
| VM-Series on Google CloudList of supported Google Cloud Regions | PAN-OS 9.1.x (9.1.0) PAN-OS
10.1.x (10.1.0) PAN-OS 10.2.x (10.2.0)PAN-OS
11.0.x (11.0.0) | DPDK is supported and enabled by default. |
| VM-Series on Oracle Cloud Infrastructure | PAN-OS 9.1.x (9.1.0) PAN-OS
10.1.x (10.1.0) PAN-OS 10.2.x (10.2.0)PAN-OS
11.0.x (11.0.0) |
|
Oracle Gov Cloud: PAN-OS 9.1.x
(9.1.3) PAN-OS 10.1.x (10.1.2) PAN-OS
10.2.x (10.2.0)PAN-OS 11.0.x (11.0.0) | ||
| VM-Series on IBM Cloud | PAN-OS 10.1.x (10.1.0) | — |
| VM-Series on Tencent Cloud China |
PAN-OS 10.2.10(10.2.10)
|
—
|
Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To
view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.
Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air
The following Public Clouds require a PAN-OS for VM-Series
base image from the Palo Alto Networks Support Portal.
| Public Cloud Deployment | PAN-OS Version Support
(Minimum) | I/O Enhancement Support | Base Image |
|---|---|---|---|
VM-Series on Alibaba Cloud | PAN-OS 9.1.x (9.1.0) | DPDK and Packet MMAP are supported. DPDK is enabled by default. | PA-VM-KVM-9.1.0.qcow2 |
Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.
VM-Series Firewall for VMware Cloud on AWS
You can deploy the VM-Series firewall on VMware Cloud on AWS. Set Up a VM-Series Firewall on an ESXi
Server to deploy the VM-Series firewall. Review also the supported VMware
ESXi versions for the VM-Series for VMware vSphere Hypervisor (ESXi).
VMware Cloud on AWS does not support the VM-Series firewall on VMware NSX-V or NSX-T.
| PAN-OS Version Support | I/0 Enhancement Support | Documentation |
|---|---|---|
PAN-OS 9.1.x (9.1.0) | DPDK and SR-IOV |