About the VM-Series Firewall on Azure

The VM-Series firewall on Azure must be deployed in a virtual network (VNet) using the Resource Manager deployment mode. You can deploy the VM-Series firewall on the following Azure geographies: Standard Azure public cloud, Azure China, Azure Germany, and Azure Government.
Marketplace
VM-Series Offering
Standard Azure public cloud
On standard Azure public cloud, the VM-Series firewall is available in both the Bring Your Own License (BYOL) model and the hourly Pay-As-You-Go (PAYG) option (usage-based licensing).
For licensing details, see License Types—VM-Series Firewalls, and refer to the list of supported Azure regions in which you can deploy the VM-Series firewall.
Azure Government
VM-Series firewall is available in the BYOL option.
To deploy the VM-Series on Azure Government, use the BYOL workflow outlined in the Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template).
Azure China
VM-Series firewall is available in the BYOL option.
Azure China has a slightly different workflow that is outlined in Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)
Azure Germany
VM-Series firewall is available in the BYOL and ELA options.
Unlike other Azure regions, on Azure Germany only the VM-Series VHD/image is published to the Marketplace. You will need to reference this VHD image within your custom ARM templates, or deploy it on the Azure CLI, Azure PowerShell or Azure ARM API. To locate the image, you the need the following details to complete the command (show vm-image list):
  • Publisher: paloaltonetworks
  • Offer: vmseries1
  • SKU: byol
  • Version: 8.0.7 or latest
To test the VM-Series firewall on Azure Germany, try the sample ARM template that deploys the firewall with three network interfaces.
This sample template is under the community-support policy and is available in the GitHub repository at: https://github.com/PaloAltoNetworks/azure-germany

Related Documentation