Focus

VM-Series Deployment Guide

Components of the VM-Series Firewall on NSX-T (East-West)

Table of Contents

Components of the VM-Series Firewall on NSX-T (East-West)

The following tables show the components of this joint Palo Alto Networks and VMware NSX-T (East-West) solution.

VMware Components
vCenter/ESXi	The vCenter server is the centralized management tool for the vSphere suite. ESXi is a hypervisor that enables compute virtualization. Refer to VMware’s Compatibility Matrix for vCenter compatibility with your version of NSX-T.
NSX-T Manager	VMware NSX-T Data Center 2.5.0 and later must be installed and registered with the vCenter server. The NSX-T Manager is required to deploy the VM-Series firewall on the ESXi hosts within a ESXi cluster.

Palo Alto Networks Components
PAN-OS	PAN-OS 10.1.x and later. The VM-Series base image, for example PA-VM-NST-10.1.0zip, is required for deploying the VM-Series firewall on NSX-T. The minimum system requirement for deploying the VM-Series firewall for NSX on the ESXi server depends on your VM-Series model. See VM-Series Models for the minimum hardware requirements for your VM-Series model.
Panorama Panorama must be running the same release version or later version that the firewalls that it will manage.	The VM-Series firewall on NSX-T requires Panorama 10.1.0 and later for firewalls running 10.1.0 Panorama is the centralized management tool for the Palo Alto Networks next-generation firewalls. In this solution, Panorama works with the NSX-T Manager to deploy, license, and centrally administer—configuration and policies—the VM-Series firewall for NSX-T. Panorama must be able to connect to the NSX-T Manager, the VM-Series firewalls and the Palo Alto Networks update server. See the 10.1 Panorama Administrator’s Guide for information about deploying your Panorama appliance.
Panorama Plugin for VMware NSX	3.1.0 or later 4.0.0 or later for the security-centric workflow
VM-Series Plugin	1.0.8 or later
VM-Series Firewall Models	The VM-100, VM-300, VM-500, and VM-700 support NSX-T. Before you deploy the VM-Series firewall on NSX-T, ensure that you have sufficient hardware resources to support the number of VM-Series firewalls in your chosen deployment model (service cluster or per host). This is critical when deploying large firewalls, such as the VM-700.

Set Up the VM-Series Firewall on NSX-T (East-West)

VM-Series Firewall on NSX-T (East-West) Integration