>
    Strata Copilot
    Increase in Interfaces for VM-Series on Hyper-V
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Firewall on Hyper-V
    4. Install the VM-Series Firewall on Hyper-V
    5. Increase in Interfaces for VM-Series on Hyper-V
    Download PDF
    VM-Series

    Increase in Interfaces for VM-Series on Hyper-V

    Table of Contents

    Increase in Interfaces for VM-Series on Hyper-V

    Deploy VM-Series on Hyper-V with up to 20 data interfaces for advanced network segmentation and multi-zone deployments.
    Where Can I Use This?What Do I Need?
    • VM-Series
    • PAN-OS® 12.1.8 or later
    • Windows Server 2025
    VM-Series on Hyper-V now supports up to 20 data interfaces per firewall instance, increased from the previous maximum of seven. The earlier limit forced deployments that required traffic separation across more than eight security zones to run multiple VM-Series instances (one for each set of traffic types), adding complexity and cost because each additional instance required its own license, VM resources, and management overhead. The expanded limit lets you consolidate those zones onto a single Tier 3 or Tier 4 VM-Series instance on Windows Server 2025.
    This feature applies to private cloud environments on Hyper-V that need more than eight security zones within a single firewall instance. Common deployments include environments with private virtual switches for east-west inspection between workload segments, internal virtual switches for trusted application tiers, and external virtual switches for internet-facing or untrust traffic. If your current topology uses multiple VM-Series instances purely because of the eight-interface limit, you can consolidate those instances onto a single Tier 3 or Tier 4 firewall.
    Each additional interface requires approximately 154 MB of VM memory (about 150 MB of non-reclaimable kernel memory and roughly 4 MB of reclaimable memory). Expanding from the base configuration of seven interfaces to the new maximum of 20 increases management plane memory usage by approximately 2 GB. The 64 GB minimum VM memory requirement accounts for this allocation across the full interface count.
    A minimum of 64 GB of memory is a hard requirement for this feature. 32GB will not be supported.
    See VM-Series System Requirements for per-model memory specifications.
    You must configure all interfaces while the VM is powered off; Hyper-V does not support dynamic addition or removal of network adapters on a running VM. All interfaces use Hyper-V synthetic network adapters. DPDK is not supported in this configuration.
    Power off the VM-Series firewall before adding or removing network adapters. Adding or removing adapters on a running VM is not supported and produces an inconsistent configuration.
    If you downgrade to a PAN-OS version that does not support 20 interfaces, interfaces one through seven remain functional. Interfaces eight through 20 do not appear after the downgrade.
    Ensure you delete policies and zones associated with interfaces 8-20 before initiating a downgrade.

    Configure Expanded Interface Support for VM-Series on Hyper-V

    This feature leverages your existing Hyper-V and VM-Series configuration processes for adding virtual network interfaces.
    Dynamic interface addition or deletion is not supported after initial setup. Plan your network topology and interface assignments carefully before deployment.
    1. Power off the VM-Series firewall VM in Hyper-V.
    2. Add the network adapters to the VM using either Hyper-V Manager or Windows PowerShell.
    3. Repeat for each additional interface you want to add, up to the maximum supported by your VM-Series model tier.

    Using Hyper-V Manager

    1. Right-click the VM-Series VM, then select Settings.
    2. Under Hardware, select Add Hardware, choose Network Adapter, then click Add.
    3. For Virtual switch, choose the virtual switch to attach the adapter to, then click Apply.
    4. Repeat the previous two substeps for each additional interface.

    Using Windows PowerShell

    1. Replace <vm-name> with the name of the VM-Series VM and <switch-name> with the name of the Hyper-V virtual switch to attach the adapter to, in the command:
      Add-VMNetworkAdapter -VMName "<vm-name>" -SwitchName "<switch-name>"
    2. Power on the VM-Series firewall VM.
    3. Log in to the VM-Series CLI and verify all interfaces appear, using the command:
      show interface all
      Confirm the expected number of interfaces (ethernet1/1 through ethernet1/20) is present.
    4. Configure the new interfaces with IP addresses, security zones, and security policies.
      1. In the PAN-OS web interface, select Network > Interfaces, then configure each new interface with an interface type, IP address, and security zone.
      2. Select Policies > Security and create or update security rules to permit or deny traffic between the new zones and existing zones.
    5. Commit the configuration.

    © 2026 Palo Alto Networks, Inc. All rights reserved.