Focus

VM-Series Deployment Guide

Use vMotion to Move the VM-Series Firewall Between Hosts

Table of Contents

Use vMotion to Move the VM-Series Firewall Between Hosts

To maintain traffic flow while using vMotion to move your VM-Series firewall between ESXi hosts with homogeneous CPU configurations in VMware NSX-T, you must use the PAN-OS CLI to pause the internal heartbeat monitoring of the VM-Series firewall during vMotion. You can specify the amount of time, in minutes, that heartbeat monitoring is paused. Heartbeat monitoring can be paused for up to 60 minutes. When the pause interval expires or you deliberately end the pause interval, heartbeat monitoring resumes.

vMotion of the VM-Series firewall is supported on vSphere 6.5, 6.7, and 7.0 if the ESXi hosts have homogeneous CPU configuration.

This procedure is not required when using vMotion to move the VM-Series firewall if you are running vSphere 7.0 or later.

Log in the VM-Series firewall CLI.
Set the heartbeat monitoring pause interval using the following command. The pause begins as soon as the command is executed. If vMotion is taking longer than expected, you can rerun this command to set a new, longer interval that starts when the command is executed again.
request system heartbeat-pause set interval <pause-time-in-minutes>
You can view the time remaining in pause interval using the following command.
request system heartbeat-pause show interval
(Optional) If you complete vMotion before the pause interval has elapsed, you can end the pause by setting the interval to zero (0).
request system heartbeat-pause set interval 0

Apply Security Policies to the VM-Series Firewall on NSX-T (East-West)

Deploy the VM-Series Using the Security-Centric Workflow