Panorama is available in the following appliances, each of which supports firewall management licenses for managing up to 25, 100, or 1,000 firewalls:
Panorama virtual appliance —You can install the Panorama virtual appliance on a VMware ESXi server or in VMware vCloud Air. The virtual appliance allows for simple installation and facilitates server consolidation for sites that need a virtual management appliance. By default, the Panorama virtual appliance has one disk partition for all data. Approximately 11GB of the partition is allocated to store the logs collected from firewalls and the logs that Panorama and Log Collectors generate. If you need more log storage, you can add a virtual disk of up to 8TB on vCloud Air or ESXi 5.5 and later versions. Earlier ESXi versions support a virtual disk of up to 2TB. If you need more than 8TB, you can mount Panorama to an NFS datastore but only on the ESXi server, not in vCloud Air. The Panorama virtual appliance works best in environments with logging rates of up to 10,000 logs per second. You can forward firewall logs directly to the Panorama virtual appliance (see Deploy Panorama Virtual Appliances with Local Log Collection) or use the Panorama virtual appliance to manage Dedicated Log Collectors that are M-Series appliances (see Deploy Panorama with Dedicated Log Collectors). M-Series appliance —The M-100 appliance and M-500 appliance are dedicated hardware models intended for large-scale deployments. In environments with high logging rates (over 10,000 logs per second) and log retention requirements, these appliances enables scaling of your log collection infrastructure. Both appliances use RAID drives to store firewall logs and support RAID 1 mirroring to protect against disk failures. Both appliances use an SSD to store the logs that Panorama and Log Collectors generate. Only the M-500 appliance has redundant, hot-swappable power supplies and front-to-back airflow. The M-500 appliance also has faster processors and greater memory for better performance (for example, faster commit times). These attributes make the M-500 appliance more suitable for datacenters than the M-100 appliance. You can deploy the M-Series appliance in the following modes to separate the central management function from the log collection function: Panorama mode : The appliance performs both central management and log collection. This is the default mode. For configuration details, see Deploy Panorama with Default Log Collectors. Log Collector mode : The appliance functions as a Dedicated Log Collector. If multiple firewalls forward large volumes of log data, the M-Series appliance in Log Collector mode provides increased scale and performance. In this mode, the appliance has no web interface for administrative access, only a command line interface (CLI). However, you can manage the appliance using the web interface of the Panorama management server (M-Series appliance in Panorama mode or a Panorama virtual appliance). CLI access to an M-Series appliance in Log Collector mode is only necessary for initial setup and debugging. For configuration details, see Deploy Panorama with Dedicated Log Collectors.
The log storage capacity and maximum log collection rate varies by appliance and mode, as described in the following table. For more details and specifications, see the M-100 and M-500 Hardware Reference Guides.
The best appliance for your network depends on whether you must deploy within a virtual infrastructure, your bandwidth resources (some networks benefit from deploying Log Collectors close to the firewalls), and your log storage requirements (see Determine Panorama Log Storage Requirements). The following table summarizes the logging capacities of each appliance.
Appliance Capacities and Features M-500 Appliance M-100 Appliance Virtual Appliance
Maximum Logging Rate for Panorama management server (M-Series appliance in Panorama mode or Panorama virtual appliance) 20,000 logs/second 10,000 logs/second 10,000 logs/second
Maximum Logging Rate for Dedicated Log Collector 50,000 logs/second 30,000 logs/second Not applicable: the Panorama virtual appliance cannot be a Dedicated Log Collector.
Maximum Log Storage 8TB (16 RAID drives) 4TB (8 RAID drives) 8TB (2TB for ESXi releases before v5.5)
Default Log Storage 4TB (8 drives) 1TB (2 drives) ~11GB
SSD Storage (for logs that M-Series appliances generate) 240GB 120GB Not applicable
NFS Attached Log Storage Not available Not available ESXi server only

Related Documentation