>
    VM-Series Firewall Hypervisor Support
    Focus
    Download PDF
    Focus
    1. Home
    2. Compatibility Matrix
    3. VM-Series Firewalls
    4. VM-Series Firewall Hypervisor Support
    Download PDF
    Compatibility Matrix

    VM-Series Firewall Hypervisor Support

    Table of Contents

    VM-Series Firewall Hypervisor Support

    Palo Alto Networks offers hypervisor version support on VM-Series firewalls for both of the following deployments:

    Private Cloud Deployments

    The following Private Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal:
    In the compatibility matrix below, the PAN-OS Version Support column displays the range of versions and the (Minimum) version in parentheses. For example, if the PAN-OS Version Support column displays PAN-OS 11.1.x (11.1.3), it indicates that the integration supports PAN-OS 11.1 versions beginning with PAN-OS 11.1.3.
    Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.

    VM-Series for VMware vSphere Hypervisor (ESXi)

    This ESXi version support list does not include NSX. For NSX, see VM-Series for VMware NSX-V or VM-Series for VMware NSX (Formerly NSX-T).
    You can download base images from the Palo Alto Networks Support Portal.
    Access mode with SR-IOV on VMware ESXi is supported on PAN-OS 9.1.5 and later PAN-OS 9.1 versions and all later PAN-OS versions but only with VM-Series plugin 2.0.5 and later plugin versions. However, you must enable VLAN access mode for ESXi where needed.
    PAN-OS Version Support
    (Minimum)
    VMware ESXi Version Support
    VMware Virtual Machine Hardware Version
    		I/O Enhancement Support
    Base Image
    PAN-OS 11.1.x (11.1.5)
    7.0
    vmx-19
    		SR-IOV, DPDK
    Panorama-ESX-11.1.3.ova
    PAN-OS 11.1.x (11.1.0)
    6.7, 7.0, 8.0
    • vmx-10
    • vmx-15
      vmx-15 requires PAN-OS 11.1.3 base image
    		SR-IOV, DPDK
    PA-VM-ESX-11.1.0.ova
    PA-VM-ESX-11.1.3.ova
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    6.7, 7.0, 8.0
    vmx-10
    		SR-IOV, DPDK
    PA-VM-ESX-10.2.0.ova
    PA-VM-ESX-11.0.0.ova
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    6.7, 7.0
    vmx-10
    		SR-IOV, DPDK
    PA-VM-ESX-9.1.0.ova
    PA-VM-ESX-10.1.0.ova
    PAN-OS 9.1.x (9.1.0)
    6.5, 6.7
    vmx-10
    		SR-IOV, DPDK
    PA-VM-ESX-9.1.0.ova

    VM-Series for VMware NSX-V

    vSphere with VMware NSX is available on all VM-Series firewalls except the VM-50 and VM-700 firewalls.
    Palo Alto Networks approves the vSphere with VMware NSX and Panorama combinations listed below with the following criteria. You can download base images from the Palo Alto Networks Support Portal.
    For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
    • Panorama management servers running PAN-OS 9.1 and later versions require the VMware NSX plugin. For more plugin version information, see Panorama Plugins for VMware NSX.
    • VMware has announced EoS for NSX-V and Palo Alto Networks will continue to support the VM-Series on NSX-V running PAN-OS 9.1 when managed by Panorama management servers running PAN-OS 10.1 or PAN-OS 10.2 software.
      • Palo Alto Networks does not support VMware NSX-V on Panorama management servers running PAN-OS 11.0 or later versions.
      • There aren't any VM-Series for VMware NSX-V base images for PAN-OS 10.1 or later PAN-OS versions.
      • You cannot upgrade the VM-Series firewall for NSX-V to PAN-OS 10.1 or later PAN-OS versions.
      • The Panorama management server running PAN-OS 10.1 or PAN-OS 10.2 supports PAN-OS 9.1 base images until June 30, 2024.
    See the Palo Alto Networks End-of-Life Summary for more information about the PAN-OS EoL schedule.
    Supported Panorama Versions
    PAN-OS Version Support
    Panorama Plugin for NSX
    VMware NSX-V Manager
    		vSphere
    VMware Virtual Machine Hardware Version
    Minimum Base Image
    		I/O Enhancement Support
    10.2.x
    9.1.0 to 9.1.6
    5.0.0 and later
    6.4.1 to 6.4.7
    • 6.5
    • 6.7
    vmx-10
    PA-VM-NSX-9.1.0.zip
    LRO
    • 9.1.x
    • 10.1.x
    9.1.7 to latest 9.1.x
    3.2.0 to latest 4.0.x
    6.4.8 and later
    • 6.5
    • 6.7
    • 7.0
    vmx-10
    PA-VM-NSX-9.1.9.zip
    LRO
    • 9.1.x
    • 10.1.x
    9.1.0 to 9.1.6
    3.2.0 to latest 4.0.x
    6.4.1 to 6.4.7
    • 6.5
    • 6.7
    vmx-10
    PA-VM-NSX-9.1.0.zip
    LRO

    VM-Series for VMware NSX (Formerly NSX-T)

    Palo Alto Networks approves the VMware NSX-T and Panorama combinations listed below. You can download base images from the Palo Alto Networks Support Portal.
    For versions of PAN-OS certified by VMware, see the VMware Compatibility Guide.
    VMware NSX 4.0.x Service Deployments for partner Service Virtual Machines (SVM) sometimes experience a known traffic redirect issue. Contact VMware NSX Technical Support for details.
    Panorama Version Support
    		Panorama Plugin for NSX
    VMware NSX-T Version Support
    VMware Virtual Machine Hardware Version
    PAN-OS Version Support (Minimum)
    Latest Base Image
    11.0.x
    5.0.1 and later
    3.2.x, 4.1.x
    vmx-10
    PAN-OS 10.1.x (10.1.9-h1)
    PAN-OS 10.2.x (10.2.4)
    PA-VM-NST-10.2.4-vmwaresigned.zip
    10.2.x
    5.0.0 and later
    NSX 4.1.x with PAN-OS 10.2 requires NSX plugin 5.0.1 or later.
    3.2.x, 4.0.x, 4.1.x
    vmx-10
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.4)
    PA-VM-NST-10.2.4-vmwaresigned.zip
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    10.1.x
    3.2.0 to 4.0.x
    2.5.x, 3.0.x, 3.1.x, 3.2.x
    vmx-10
    PAN-OS 10.1.x (10.1.0)
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    PA-VM-NST-9.1.9-vmwaresigned.zip
    4.0.x
    4.0.x
    vmx-10
    PAN-OS 10.1.x (10.1.9-h1)
    PA-VM-NST-10.1.9-h1-vmwaresigned.zip
    9.1.x
    3.2.0 to 4.0.x
    2.5.x, 3.0.x, 3.1.x
    vmx-10
    PAN-OS 9.1.x (9.1.0)
    PA-VM-NST-9.1.9.zip

    VM-Series for KVM

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support (Minimum)
    VM-Series for KVM Version Support (Minimum)
    		I/O Enhancement SupportPAN-OS for VM-Series KVM Base Images
    PAN-OS 11.1.4 (11.1.4)
    Oracle Linux 8.10
    DPDK Virtio
    		PA-VM-KVM-11.1.4-h7.qcow2
    PAN-OS 11.0.4 (11.0.4)
    PAN-OS 10.2.x (10.2.5)
    PAN-OS 10.1.x (10.1.11)
    RHEL 9.2
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-11.0.4.qcow2
    PA-VM-KVM-10.2.5-h1.qcow2
    PA-VM-KVM-10.1.11-h1.qcow2
    PAN-OS 11.1.x (11.1.0)
    		Ubuntu 20.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-11.1.0.qcow2 for ARM
    PA-VM-KVM-11.1.x.qcow2 for x86
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    		Ubuntu 22.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    		CentOS/Red Hat Enterprise Linux 9.1.x (9.1.x)
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    CentOS/Red Hat Enterprise Linux:
    • 7.x.x (7.6.x)
    • 8.x.x (8.0.x)
    • 9.0.x (9.0.x)
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.1.x.qcow2
    PA-VM-KVM-10.2.x.qcow2
    PA-VM-KVM-11.0.0.qcow2
    PAN-OS 10.1.x (10.1.0)
    		Ubuntu 20.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 10.1.x (10.1.0)
    		SUSE Enterprise Server 15 with QEMU 3.1.1
    • MacVTap
    • Virtio
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    Ubuntu 18.04
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-9.1.x.qcow2
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 9.1.x (9.1.0)
    CentOS/Red Hat Enterprise Linux:
    • 7.x.x (7.6.x)
    • 8.x.x (8.0.x)
    • DPDK with SR-IOV
    • DPDK with Virtio
    PA-VM-KVM-9.1.x.qcow2

    VM-Series for Nutanix

    You can download base images from the Palo Alto Networks Support Portal.
    The VM-Series firewall for Nutanix uses the VM-Series firewall for KVM base image (qcow2).
    PAN-OS Version Support (Minimum)
    VM-Series for Nutanix Version Support (Minimum)
    I/O Enhancement Support
    VM-Series for KVM Base Image
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS Version 5.20
    Nutanix AHV Release 20201105.2030
    DPDK supported
    PA-VM-KVM-10.1.x.qcow2
    PA-VM-KVM-10.2.x.qcow2
    PAN-OS 10.1.x (10.1.0)
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS 6.5 version 6.0.5 in VPC mode
    L3 mode only
    PA-VM-KVM-10.1.x.qcow2
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    Layer 3 deployments, and virtual wire deployments with Service Chaining.
    Nutanix AOS Version 5.10, 5.15
    Nutanix AHV Release 20170830.185
    DPDK supported
    PA-VM-KVM-9.1.0.qcow2
    PA-VM-KVM-10.1.x.qcow2

    VM-Series for Hyper-V

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support
    (Minimum)    		VM-Series for Hyper-V
    Version Support (Minimum)
    I/O Enhancement Support
    Base Image
    PAN-OS 11.2.x (11.2.0)
    Windows Server 2022 with Hyper-V role or Hyper-V 2022
    • DPDK with SR-IOV supported
    • Packet MMAP with Virtio supported
    • Packet MMAP with SR-IOV supported
    PA-VM HPV-11.2.0.vhdx
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
    • Windows Server 2016 with Hyper-V role or Hyper-V 2016
    • Windows Server 2019 with Hyper-V role or Hyper-V 2019
    • DPDK with SR-IOV supported
    • Packet MMAP with Virtio supported
    • Packet MMAP with SR-IOV
    supported
    PA-VM-HPV-10.1.0.vhdx
    PA-VM-HPV-10.2.0.vhdx
    PA-VM-HPV-11.0.0.vhdx
    PAN-OS 9.1.x (9.1.0)
    • Windows Server 2012 R2 with Hyper-V role or Hyper-V 2012 R2
    • Windows Server 2016 with Hyper-V role or Hyper-V 2016
    • Windows Server 2019 with Hyper-V role or Hyper-V 2019
    • Packet MMAP supported
    • DPDK not supported
    PA-VM-HPV-9.1.0.vhdx

    VM-Series for OpenStack

    You can download base images from the Palo Alto Networks Support Portal.
    PAN-OS Version Support (Minimum)
    VM-Series for OpenStack Version Support (Minimum)
    		I/O Enhancement Support
    Base Image
    PAN-OS 10.1.x (10.1.3)
    Redhat OpenStack Train 16
    • DPDK with Virtio
    • DPDK with SR-IOV
    • Packet MMAP with Virtio
    • Packet MMAP with SR-IOV
    PA-VM-KVM-10.1.3.qcow2
    PAN-OS 9.1.x (9.1.5)
    PAN-OS 10.1.x (10.1.0)
    Redhat OpenStack Queens 13
    • DPDK with Virtio
    • DPDK with SR-IOV
    • Packet MMAP with Virtio
    • Packet MMAP with SR-IOV
    PA-VM-KVM-9.1.5.qcow2
    PA-VM-KVM-10.1.0.qcow2

    Cisco ACI: Hardware and VM-Series Firewalls in Cisco ACI

    Review the Cisco ACI plugins information for supported PAN-OS, Panorama, and Cisco ACI plugin versions.
    You can download base images from the Palo Alto Networks Support Portal.

    Public Cloud Deployments

    Palo Alto Networks supports the following public cloud deployments:

    Public Cloud Deployments Available from a Marketplace—AWS, Azure, GCP, Oracle, IBM, and Tencent Cloud China

    Public Cloud Deployment
    PAN-OS Version Support (Minimum)
    		I/O Enhancement Support
    VM-Series on AWS
    List of supported AWS Regions.
    Support for AWS Outposts on PAN-OS 9.1 and later.
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    PAN-OS 11.1.x (11.1.0)
    In PAN-OS 11.1.x (11.1.0) and later, ARM support is available on AWS Graviton 3 and AWS Graviton 2 instances.
    VM-Series on Azure
    List of supported Azure Regions.
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    Azure Stack Edge:
    PAN-OS 10.1.x (10.1.5)
    DPDK is supported in PAN-OS 9.1 and later PAN-OS releases.
    VM-Series on Google CloudList of supported Google Cloud Regions
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    DPDK is supported and enabled by default.
    VM-Series on Oracle Cloud Infrastructure
    PAN-OS 9.1.x (9.1.0)
    PAN-OS 10.1.x (10.1.0)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    • DPDK is supported and enabled by default.
    • SR-IOV and MMAP mode is supported with jumbo and non-jumbo frames on PAN-OS 9.1.x and PAN-OS 10.1.x and later with VM-Series plugin 2.1.0 and later.
    Oracle Gov Cloud:
    PAN-OS 9.1.x (9.1.3)
    PAN-OS 10.1.x (10.1.2)
    PAN-OS 10.2.x (10.2.0)
    PAN-OS 11.0.x (11.0.0)
    VM-Series on IBM Cloud
    PAN-OS 10.1.x (10.1.0)
    —
    VM-Series on Tencent Cloud China
    PAN-OS 10.2.10(10.2.10)
    —
    Further I/O Enhancement support is detailed in PacketMMAP and DPDK Drivers on VM-Series Firewalls.
    To view the hypervisor support for Panorama versions, see Panorama Hypervisor Support. To view the Panorama plugin requirements for public clouds, see Public Cloud-AWS, Azure, GCP.

    Public Cloud Deployments Requiring a Base Image—Alibaba, Oracle, vCloud Air

    The following Public Clouds require a PAN-OS for VM-Series base image from the Palo Alto Networks Support Portal.
    Public Cloud Deployment
    PAN-OS Version Support (Minimum)
    		I/O Enhancement Support
    Base Image
    VM-Series on Alibaba Cloud
    PAN-OS 9.1.x (9.1.0)
    		DPDK and Packet MMAP are supported. DPDK is enabled by default.
    PA-VM-KVM-9.1.0.qcow2
    Further I/O Enhancement support is detailed in the list of PacketMMAP and DPDK Drivers on VM-Series Firewalls.

    VM-Series Firewall for VMware Cloud on AWS

    You can deploy the VM-Series firewall on VMware Cloud on AWS. Set Up a VM-Series Firewall on an ESXi Server to deploy the VM-Series firewall. Review also the supported VMware ESXi versions for the VM-Series for VMware vSphere Hypervisor (ESXi).
    VMware Cloud on AWS does not support the VM-Series firewall on VMware NSX-V or NSX-T.
    PAN-OS Version SupportI/0 Enhancement SupportDocumentation
    PAN-OS 9.1.x (9.1.0)
    DPDK and SR-IOV

    © 2024 Palo Alto Networks, Inc. All rights reserved.