The VM-Series plugin enables Palo Alto Networks to release
cloud provider integrations or hypervisor integrations without upgrading
The VM-Series firewalls include the VM-Series plugin,
a built-in plugin architecture for integration with public cloud
providers or private cloud hypervisors. The VM-Series plugin can
be manually upgraded independent of PAN-OS, enabling Palo Alto Networks®
to accelerate the release of new features, fixes, or integrations
with new cloud providers or hypervisors.
The VM-Series plugin enables you to manage cloud-specific interactions
between the VM-Series firewalls and the supported public cloud platforms—AWS,
GCP, and Azure. The plugin enables publishing custom metrics to
cloud monitoring services (such as AWS CloudWatch), bootstrapping,
configuring user credential provisioning information from public
cloud environments, and seamless updates for cloud libraries or agents
The VM-Series plugin does not manage capabilities that are
common to both VM-Series firewalls and hardware-based firewalls.
For example, VM Monitoring is not part of the VM-Series plugin because
it is a core PAN-OS feature that helps you enforce policy consistently
on your virtual machine workloads from both VM-Series firewalls
and hardware-based firewalls.
The VM-Series plugin is a built-in component that can be upgraded
or downgraded, but not removed. Each PAN-OS release includes a specific
VM-Series plugin version that corresponds to the PAN-OS software
version. When you downgrade to an earlier PAN-OS software version,
the plugin version is downgraded to the version compatible with
the PAN-OS version. You can upgrade or downgrade the VM-Series plugin locally
on the virtual firewall, or manage the plugin version centrally
To enable Panorama to manage the VM-Series plugin version itself,
or cloud-specific metrics publishing your managed firewalls, you
must manually install the VM-Series plugin on Panorama as described
in Panorama Plugins.