After registering the VM-Series firewall as a service (Palo Alto Networks NGFW) on the NSX Manager, complete the following tasks on the NSX Manager.
Support for vMotion of guest virtual machines in the vSphere/NSX Environment When a guest VM is vMotioned from one host to another within a cluster, the target host NSX distributed firewall will steer all new sessions to the VM-Series firewall on the destination host. To ensure that all active (existing sessions) remain uninterrupted during and after the guest vMotion, the NSX Manager polls the VM-Series firewall for existing allowed sessions and then shares these sessions with the NSX distributed firewall on the destination host. All existing sessions that were allowed by the original VM-Series will be allowed by the NSX distributed firewall (filtering module) on the destination host without steering to the target host VM-Series firewall to prevent session loss. The VM-Series firewall runs as a service on each host of the cluster and therefore is never vMotioned.

Related Documentation