Home

Products
Releases
Best Practices
Resources
By Type

Location

Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base

Products

Releases

Best Practices

Resources

By Type

Network Security

Cloud-Delivered Security Services

Advanced DNS Security Advanced WildFire Advanced Threat Prevention Advanced URL Filtering AI Access Security Enterprise Data Loss Prevention SaaS Security IoT Security

Cloud Identity Engine Cloud NGFW for AWS Cloud NGFW for Azure CN-Series

Common Services

License Activation & Subscription Management Tenant Management Identity & Access Management Device Associations FAQ

Next-Generation Firewall

PAN-OS AIOps for NGFW Firewalls SD-WAN Service Provider

Panorama Strata Logging Service Strata Cloud Manager AI Runtime Security VM-Series

Secure Access Service Edge

Common Services

License Activation & Subscription Management Tenant Management Identity & Access Management Device Associations FAQ

FedRAMP Next-Generation CASB

Prisma Access Browser Prisma Access Agent

Remote Browser Isolation Strata Cloud Manager Strata Multitenant Cloud Manager

Cloud-Native Security

Security Operations

Cortex XDR Cortex XSOAR Cortex XPANSE Cortex XSIAM

What's New

What's New Releases

All Release Notes

View All Release Notes

Recently Updated Release Notes

PAN-OS Release Notes (PAN-OS 10.2) PAN-OS Release Notes (PAN-OS 11.2) VM-Series and Panorama Plugins Release Notes Strata Logging Service Release Notes PAN-OS Release Notes (PAN-OS 11.1) Release Notes Strata Cloud Manager Release Notes Prisma Access Agent Release Notes GlobalProtect™ App Release Notes (6.2) SaaS Security Release Notes

See All Recently Updated Release Notes

Recently Updated Documentation

PAN-OS Upgrade Guide (PAN-OS 11.1 & Later ) SaaS Security Inline Administration Strata Cloud Manager Getting Started Palo Alto Networks Compatibility Matrix Cloud NGFW for Azure Data Security Administration Getting Started Prisma SASE FedRAMP PAN-OS® Networking Administrator’s Guide (PAN-OS 10.1) Prisma Access Agent Administration

See All Recent Updates

Applications and Threats Content Updates

Best Practices for Migrating to Application-Based Policy

Internet Gateway Security Policy

Secure Administrative Access

Security Policy

WildFire

VIEW ALL

All Release Notes

Blog

Compatibility Matrix

Licensing, Registration, and Activation

Translated Documents

VIEW ALL

API Documentation

VM-Series Deployment Guide

VM-Series Deployment Guide
All VM-Series Documentation
All Documentation

VM-Series Deployment Guide

: Deploy the VM-Series Firewall on AWS

Updated on

Thu Apr 17 08:19:01 PDT 2025

Focus

Download PDF

English
日本語 (Japanese)
中文 (Chinese Simplified)
Español (Spanish)
Français (French)
Français (French)

Filter

Version

PAN.OS 11.1 & Later

PAN-OS 11.1 & Later

Expand all | Collapse all

About the VM-Series Firewall
Virtual Systems Support on VM-Series Firewall
License the VM-Series Firewall
Set Up a VM-Series Firewall on an ESXi Server
Set Up the VM-Series Firewall on vCloud Air
Set Up the VM-Series Firewall on VMware NSX-T
- Set Up the VM-Series Firewall on VMware NSX-T (North-South)
- Set Up the VM-Series Firewall on NSX-T (East-West)
Set Up the VM-Series Firewall on AWS
Set Up the VM-Series Firewall on KVM
Set Up the VM-Series Firewall on Hyper-V
Set up the VM-Series Firewall on Azure
Set Up the VM-Series Firewall on OpenStack
Set Up the VM-Series Firewall on Google Cloud Platform
Set Up a VM-Series Firewall on a Cisco ENCS Network
Set up the VM-Series Firewall on Oracle Cloud Infrastructure
Set Up the VM-Series Firewall on IBM Cloud
Set Up the VM-Series Firewall on Alibaba Cloud
Set up the VM-Series Firewall on Tencent Cloud China
- License the VM-Series Firewall on Tencent Cloud
- Deploying the VM-Series Firewall on Tencent Cloud
Set Up a Firewall in Cisco ACI
Set Up the VM-Series Firewall on Cisco CSP
- VM-Series on Cisco CSP System Requirements
- Deploy the VM-Series Firewall on Cisco CSP
Set Up the VM-Series Firewall on Nutanix AHV
- VM Monitoring on Nutanix
Bootstrap the VM-Series Firewall

Updated on

Thu Apr 17 08:19:01 PDT 2025

Focus

Home
VM-Series
VM-Series Deployment Guide
Set Up the VM-Series Firewall on AWS
Deploy the VM-Series Firewall on AWS

Download PDF

English
日本語 (Japanese)
中文 (Chinese Simplified)
Español (Spanish)
Français (French)
Français (French)

VM-Series Deployment Guide

Deploy the VM-Series Firewall on AWS

Table of Contents

Filter

Version

PAN.OS 11.1 & Later

PAN-OS 11.1 & Later

Expand all | Collapse all

About the VM-Series Firewall
- VM-Series Deployments
- VM-Series in High Availability
- IPv6 Support on Public Cloud
- Upgrade the VM-Series Firewall
- VM-Series Plugin
  - Configure the VM-Series Plugin on the Firewall
  - Upgrade the VM-Series Plugin
- Enable Jumbo Frames on the VM-Series Firewall
- Hypervisor Assigned MAC Addresses
- Custom PAN-OS Metrics Published for Monitoring
- Interface Used for Accessing External Services on the VM-Series Firewall
- PacketMMAP and DPDK Driver Support
- Enable NUMA Performance Optimization on the VM-Series
- Enable ZRAM on the VM-Series Firewall
Virtual Systems Support on VM-Series Firewall
- Licensing and Prerequisites for Virtual Systems Support on VM-Series
- System Requirements for Virtual Systems Support on VM-Series
- Enable Multiple Virtual Systems Support on VM-Series Firewall
- Enable Multiple Virtual Systems Support on VM-Series in Panorama Console
- Enable Multiple Virtual Systems Support Using Bootstrap Method
License the VM-Series Firewall
- VM-Series Firewall Licensing
- Create a Support Account
- Serial Number and CPU ID Format for the VM-Series Firewall
- Use Panorama-Based Software Firewall License Management
- Software NGFW Credits
- VM-Series Models
- What Happens When Licenses Expire?
- Licenses for Cloud Security Service Providers (CSSPs)
Set Up a VM-Series Firewall on an ESXi Server
- Supported Deployments on VMware vSphere Hypervisor (ESXi)
- VM-Series on ESXi System Requirements and Limitations
  - VM-Series on ESXi System Requirements
  - VM-Series on ESXi System Limitations
- Install a VM-Series firewall on VMware vSphere Hypervisor (ESXi)
- VM Monitoring on vCenter
- Troubleshoot ESXi Deployments
- Performance Tuning of the VM-Series for ESXi
Set Up the VM-Series Firewall on vCloud Air
- About the VM-Series Firewall on vCloud Air
- Deployments Supported on vCloud Air
- Deploy the VM-Series Firewall on vCloud Air
Set Up the VM-Series Firewall on VMware NSX-T
- Set Up the VM-Series Firewall on VMware NSX-T (North-South)
- Set Up the VM-Series Firewall on NSX-T (East-West)
Set Up the VM-Series Firewall on AWS
- About the VM-Series Firewall on AWS
- Deployments Supported on AWS
- Deploy the VM-Series Firewall on AWS
- Panorama Orchestrated Deployments in AWS
- VM-Series Integration with an AWS Gateway Load Balancer
- High Availability for VM-Series Firewall on AWS
- Use AWS Secrets Manager to Store VM-Series Certificates
- Use Case: Secure the EC2 Instances in the AWS Cloud
- Use Case: Use Dynamic Address Groups to Secure New EC2 Instances within the VPC
- Use Case: VM-Series Firewalls as GlobalProtect Gateways on AWS
  - Components of the GlobalProtect Infrastructure
  - Deploy GlobalProtect Gateways on AWS
- Resource Monitoring on AWS
  - AWS Resource Monitoring with the AWS Plugin on Panorama
  - Set Up the AWS Plugin for VM Monitoring on Panorama
- List of Attributes Monitored on the AWS VPC
  - IAM Permissions Required for Monitoring the AWS VPC
Set Up the VM-Series Firewall on KVM
- VM-Series on KVM—Requirements and Prerequisites
  - Options for Attaching the VM-Series on the Network
  - Prerequisites for VM-Series on KVM
    - Prepare the Linux Server
    - Prepare to Deploy the VM-Series Firewall
- Supported Deployments on KVM
  - Secure Traffic on a Single Host
  - Secure Traffic Across Linux hosts
- Install the VM-Series Firewall on KVM
- Performance Tuning of the VM-Series for KVM
- Intelligent Traffic Offload
- Software Cut-through Based Offload
Set Up the VM-Series Firewall on Hyper-V
- Supported Deployments on Hyper-V
  - Secure Traffic on a Single Hyper-V Host
  - Secure Traffic Across Multiple Hyper-V Hosts
- System Requirements on Hyper-V
- Linux Integration Services
- Install the VM-Series Firewall on Hyper-V
Set up the VM-Series Firewall on Azure
- About the VM-Series Firewall on Azure
- Deployments Supported on Azure
- Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)
- Simplified Onboarding of VM-Series Firewall on Azure
- Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)
- Panorama Orchestrated Deployments in Azure
  - Prepare for an Orchestrated Deployment
  - Orchestrate a VM-Series Firewall Deployment in Azure
- Deploy the VM-Series with the Azure Gateway Load Balancer
- Create a Custom VM-Series Image for Azure
- Use Azure Security Center Recommendations to Secure Your Workloads
  - Use Panorama to Forward Logs to Azure Security Center
- Deploy the VM-Series Firewall on Azure Stack
- Deploy the VM-Series Firewall on Azure Stack HCI
- Enable Azure Application Insights on the VM-Series Firewall
- Monitoring on Azure
- Set up Active/Passive HA on Azure
- Use Azure Key Vault to Store VM-Series Certificates
- Use the ARM Template to Deploy the VM-Series Firewall
- Deploy the VM-Series and Azure Application Gateway Template
  - VM-Series and Azure Application Gateway Template
  - Start Using the VM-Series & Azure Application Gateway Template
- Secure Kubernetes Services on Azure
  - How Does the Panorama Plugin for Azure Secure Kubernetes Services?
  - Secure an AKS Cluster
Set Up the VM-Series Firewall on OpenStack
- VM-Series Deployments in OpenStack
  - Basic Gateway
  - Service Chaining and Service Scaling
- Components of the VM-Series for OpenStack Solution
- Heat Template for a Basic Gateway Deployment
- Heat Templates for Service Chaining and Service Scaling
- Install the VM-Series Firewall in a Basic Gateway Deployment
- Install the VM-Series Firewall with Service Chaining or Scaling
Set Up the VM-Series Firewall on Google Cloud Platform
- About the VM-Series Firewall on Google Cloud Platform
- Supported Deployments on Google Cloud Platform
- Create a Custom VM-Series Firewall Image for Google Cloud Platform
- Prepare to Set Up VM-Series Firewalls on Google Public Cloud
- Deployment Models for VM-Series on GCP
  - Auto Scale Model
  - Active/Passive HA Model
- Deploy the VM-Series Firewall on Google Cloud Platform
- VM Monitoring with the Panorama Plugin for GCP
  - Configure VM Monitoring with the Panorama Plugin for GCP
- Auto Scaling the VM-Series Firewall on Google Cloud Platform
  - Auto Scaling Components for Google Cloud Platform
  - Deploy GCP Auto Scaling Templates
- Set up Active/Passive HA on Google Cloud Platform
  - Architecture of Active/Passive HA on GCP
  - Deploy the GCP Active/Passive HA
- Securing VPC Networks with VM-Series Firewall on GCP
- Configuring GCP Load Balancer
Set Up a VM-Series Firewall on a Cisco ENCS Network
- Plan Your Cisco ENCS Deployment
- Prepare the VM-Series Firewall Image for Cisco ENCS
- Deploy the VM-Series Firewall on Cisco ENCS
Set up the VM-Series Firewall on Oracle Cloud Infrastructure
- OCI Shape Types
- Deployments Supported on OCI
- Prepare to Set Up the VM-Series Firewall on OCI
- Deploy the VM-Series Firewall From the Oracle Cloud Marketplace
- Configure Active/Passive HA on OCI
Set Up the VM-Series Firewall on IBM Cloud
- About the VM-Series Firewall on IBM Cloud
- Prepare to Set Up VM-Series Firewalls on IBM Cloud
- Deploy the VM-Series Firewall Using IBM Cloud Schematics
- High Resiliency for VM-Series Firewall on IBM Cloud
- Use Case: Deploy a NLB Using the VM-Series Firewall
Set Up the VM-Series Firewall on Alibaba Cloud
- VM-Series Firewall on Alibaba Cloud
- Minimum System Requirements for the VM-Series Firewall on Alibaba Cloud
- Prepare to Deploy the VM-Series Firewall on Alibaba Cloud
- Deploy the VM-Series Firewall on Alibaba Cloud
- Set up Active/Passive HA on Alibaba Cloud
  - Architecture
  - Deploy the Active/Passive HA on Alibaba Cloud
Set up the VM-Series Firewall on Tencent Cloud China
- License the VM-Series Firewall on Tencent Cloud
- Deploying the VM-Series Firewall on Tencent Cloud
Set Up a Firewall in Cisco ACI
- Palo Alto Networks Firewall Integration with Cisco ACI
  - Service Graph Templates
  - Multi-Context Deployments
- Prepare Your ACI Environment for Integration
- Integrate the Firewall with Cisco ACI in Network Policy Mode
  - Deploy the Firewall to Secure East-West Traffic in Network Policy Mode
  - Deploy the Firewall to Secure North-South Traffic in Network Policy Mode
- Endpoint Monitoring in Cisco ACI
Set Up the VM-Series Firewall on Cisco CSP
- VM-Series on Cisco CSP System Requirements
- Deploy the VM-Series Firewall on Cisco CSP
Set Up the VM-Series Firewall on Nutanix AHV
- VM Monitoring on Nutanix
Bootstrap the VM-Series Firewall
- Choose a Bootstrap Method
- VM-Series Firewall Bootstrap Workflow
- Bootstrap Package
- Bootstrap Configuration Files
- Bootstrapping VM-Series in Virtual Metadata Collector Mode
- Generate the VM Auth Key on Panorama
- Create the init-cfg.txt File
  - init-cfg.txt File Components
  - Sample init-cfg.txt File
- Create the bootstrap.xml File
- Prepare the Licenses for Bootstrapping
- Prepare the Bootstrap Package
- Bootstrap the VM-Series Firewall on AWS
- Bootstrap the VM-Series Firewall on Azure
- Bootstrap the VM-Series Firewall on Azure Stack HCI
- Bootstrap the VM-Series Firewall on ESXi
  - Bootstrap the VM-Series Firewall on ESXi with an ISO
  - Bootstrap the VM-Series Firewall on ESXi with a Block Storage Device
- Bootstrap the VM-Series Firewall on Google Cloud Platform
- Bootstrap the VM-Series Firewall on Hyper-V
  - Bootstrap the VM-Series Firewall on Hyper-V with an ISO
  - Bootstrap the VM-Series Firewall on Hyper-V with a Block Storage Device
- Bootstrap the VM-Series Firewall on KVM
  - Bootstrap the VM-Series Firewall on KVM with an ISO
  - Bootstrap the VM-Series Firewall on KVM With a Block Storage Device
- Verify Bootstrap Completion
- Bootstrap Errors

Deploy the VM-Series Firewall on AWS

Obtain the AMI
Planning Worksheet for the VM-Series in the AWS VPC
Launch the VM-Series Firewall on AWS
Launch the VM-Series Firewall on AWS Outpost
Create a Custom Amazon Machine Image (AMI)
Encrypt EBS Volume for the VM-Series Firewall on AWS
Use the VM-Series Firewall CLI to Swap the Management Interface
Enable CloudWatch Monitoring on the VM-Series Firewall
VM-Series Firewall Startup and Health Logs on AWS

Deployments Supported on AWS

Technical Documentation

Release Notes
Search
Blog
Compatibility Matrix
OSS Listings
Sitemap

Company

About
Careers
Customer Support
LIVE Community
Knowledge Base

Legal Notices

Privacy
Trust Center
Terms of Use
Documents

© 2025 Palo Alto Networks, Inc. All rights reserved.