Home

Location

Documentation Home
Palo Alto Networks
Support
Live Community
Knowledge Base

Home
VM-Series
VM-Series Deployment Guide
Set Up a Firewall in Cisco ACI
Integrate the Firewall with Cisco ACI in Network Policy Mode
Deploy the Firewall to Secure North-South Traffic in Network Policy Mode

Last Updated:

Mon Mar 14 13:06:30 PDT 2022

End-of-Life (EoL)

Table of Contents

Search the Table of Contents

About the VM-Series Firewall

VM-Series Deployments

VM-Series in High Availability

Upgrade the VM-Series Firewall

Upgrade the PAN-OS Software Version (Standalone Version)

Upgrade the PAN-OS Software Version (VM-Series for NSX)

Upgrade the VM-Series for NSX During a Maintenance Window

Upgrade the VM-Series for NSX Without Disrupting Traffic

Upgrade the VM-Series Model

Upgrade the VM-Series Model in an HA Pair

Enable Jumbo Frames on the VM-Series Firewall

Hypervisor Assigned MAC Addresses

Custom PAN-OS Metrics Published for Monitoring

Interface Used for Accessing External Services on the VM-Series Firewall

License the VM-Series Firewall

VM-Series Firewall Licensing

Create a Support Account

Serial Number and CPU ID Format for the VM-Series Firewall

Software NGFW Credits

Activate Credits

Transfer Credits

Create a Deployment Profile

Manage a Deployment Profile

Provision Panorama

Migrate Panorama to a FW-Flex License

Deactivate a Firewall

Migrate to a Flexible VM-Series License

VM-Series Models

VM-Series System Requirements

CPU Oversubscription

VM-50 Lite Mode

License Types—VM-Series Firewalls

VM-Series Firewall for NSX Licenses

VM-Series Firewall Licenses for Public Clouds

VM-Series Enterprise License Agreement (Multi-Model ELA)

Manage VM-Series ELA License Tokens

Accept the VM-Series ELA

Activate the License

Activate the License for the VM-Series Firewall (Standalone Version)

Activate the License for the VM-Series Firewall for VMware NSX

Activate Licenses on VM-Series Firewalls on NSX When Panorama has Internet Access

Activate Licenses on VM-Series Firewalls on NSX When Panorama has No Internet Access

Troubleshoot License Activation Issues

Switch Between the BYOL and the PAYG Licenses

Switch Between Fixed Model Licenses

Renew VM-Series Firewall License Bundles

Register the VM-Series Firewall

Register the VM-Series Firewall (Software NGFW Credits)

Register the VM-Series Firewall (with auth code)

Register the Usage-Based Model of the VM-Series Firewall for Public Clouds (no auth code)

Install a Device Certificate on the VM-Series Firewall

Deactivate the License(s)

Install a License Deactivation API Key

Deactivate a Feature License or Subscription Using the CLI

Deactivate VM

Licensing API

Manage the Licensing API Key

Use the Licensing API

Activate Licenses

Deactivate Licenses

Track License Usage

Licensing API Error Codes

Licenses for Cloud Security Service Providers (CSSPs)

Get the Auth Codes for CSSP License Packages

Register the VM-Series Firewall with a CSSP Auth Code

Add End-Customer Information for a Registered VM-Series Firewall

Add End-Customer Information for a Registered VM-Series Firewall (Customer Support Portal)

Add End-Customer Information for a Registered VM-Series Firewall (API)

Set Up a VM-Series Firewall on an ESXi Server

Supported Deployments on VMware vSphere Hypervisor (ESXi)

VM-Series on ESXi System Requirements and Limitations

VM-Series on ESXi System Requirements

VM-Series on ESXi System Limitations

Install a VM-Series firewall on VMware vSphere Hypervisor (ESXi)

Plan the Interfaces for the VM-Series for ESXi

Provision the VM-Series Firewall on an ESXi Server

Perform Initial Configuration on the VM-Series on ESXi

Add Additional Disk Space to the VM-Series Firewall

Use VMware Tools on the VM-Series Firewall on ESXi and vCloud Air

Troubleshoot ESXi Deployments

Basic Troubleshooting

Installation Issues

Issues with Deploying the OVA

Why does the firewall boot into maintenance mode?

How do I modify the base image file for the VM-1000-HV license?

Licensing Issues

Why am I unable to apply the support or feature license?

Why does my cloned VM-Series firewall not have a valid license?

Does moving the VM-Series firewall cause license invalidation?

Connectivity Issues

Why is the VM-Series firewall not receiving any network traffic?

Performance Tuning of the VM-Series for ESXi

Install the NIC Driver on ESXi

Enable DPDK on ESXi

Enable SR-IOV on ESXi

Enable Multi-Queue Support for NICs on ESXi

VNF Tuning for Performance

Set Up the VM-Series Firewall on vCloud Air

About the VM-Series Firewall on vCloud Air

Deployments Supported on vCloud Air

Deploy the VM-Series Firewall on vCloud Air

Set Up the VM-Series Firewall on VMware NSX-V

VM-Series for NSX-V Firewall Overview

What are the Components of the VM-Series for NSX Solution?

vCenter Server

NSX-V Manager

Panorama

VM-Series Firewall for NSX-V

Ports/Protocols used Network Communication

How Do the Components in the VM-Series Firewall for NSX-V Solution Work Together?

Integrated Policy Rules

Policy Enforcement using Dynamic Address Groups

What are the Benefits of the NSX-V VM-Series firewall for NSX-V Solution?

What is Multi-Tenant Support on the VM-Series Firewall for NSX-V?

VM-Series Firewall for NSX-V Deployment Checklist

Install the VMware NSX-V Plugin

Register the VM-Series Firewall as a Service on the NSX-V Manager

Enable Communication Between the NSX-V Manager and Panorama

Create Template(s), Template Stack(s), and Device Group(s) on Panorama

Create the Service Definitions on Panorama

Deploy the VM-Series Firewall

Define an IP Address Pool

Prepare the ESXi Host for the VM-Series Firewall

Deploy the Palo Alto Networks NGFW Service

Enable Large Receive Offload

Create Security Groups and Steering Rules

Create Security Groups and Steering Rules in a Security Centric Deployment

Set Up Dynamic Address Groups on Panorama

Create Steering Rules on Panorama

Create Security Groups and Steering Rules in an Operations Centric Deployment

Set Up Security Groups on the NSX-V Manager

Create Steering Rules on NSX-V Manager

Apply Security Policies to the VM-Series Firewall

Steer Traffic from Guests that are not Running VMware Tools

What is Multi-NSX-V Manager Support on the VM-Series for NSX-V?

Plan Your Multi-NSX-V Deployment

Deploy the VM-Series Firewall in a Multi-NSX-V Manager Environment

Dynamically Quarantine Infected Guests

Migrate Operations-Centric Configuration to Security-Centric Configuration

Use Case: Shared Compute Infrastructure and Shared Security Policies

Use Case: Shared Security Policies on Dedicated Compute Infrastructure

Dynamic Address Groups—Information Relay from NSX-V Manager to Panorama

Set Up the VM-Series Firewall on AWS

About the VM-Series Firewall on AWS

AWS EC2 Instance Types

VM-Series Firewall on AWS GovCloud

VM-Series Firewall on AWS China

AWS Terminology

Management Interface Mapping for Use with Amazon ELB

Performance Tuning for the VM-Series on AWS

Deployments Supported on AWS

Deploy the VM-Series Firewall on AWS

Obtain the AMI

AMI in the Public AWS Cloud

AMI on AWS GovCloud

Planning Worksheet for the VM-Series in the AWS VPC

Launch the VM-Series Firewall on AWS

Create a Custom Amazon Machine Image (AMI)

Encrypt EBS Volume for the VM-Series Firewall on AWS

Use the VM-Series Firewall CLI to Swap the Management Interface

Enable CloudWatch Monitoring on the VM-Series Firewall

High Availability for VM-Series Firewall on AWS

Overview of HA on AWS

IAM Roles for HA

HA Links

Heartbeat Polling and Hello Messages

Device Priority and Preemption

HA Timers

Configure Active/Passive HA on AWS

Use Case: Secure the EC2 Instances in the AWS Cloud

Use Case: Use Dynamic Address Groups to Secure New EC2 Instances within the VPC

Use Case: VM-Series Firewalls as GlobalProtect Gateways on AWS

Components of the GlobalProtect Infrastructure

Deploy GlobalProtect Gateways on AWS

VM Monitoring on AWS

VM Monitoring with the AWS Plugin on Panorama

Set Up the AWS Plugin for VM Monitoring on Panorama

Auto Scale VM-Series Firewalls with the Amazon ELB Service

VM-Series Auto Scale Template for AWS Version 2.0

What Components Does the VM-Series Auto Scaling Template for AWS (v2.0) Leverage?

How Does the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1) Enable Dynamic Scaling?

Plan the VM-Series Auto Scaling Template for AWS (v2.0 and v2.1)

Customize the Firewall Template Before Launch (v2.0 and v2.1)

Launch the VM-Series Auto Scaling Template for AWS (v2.0)

Customize the Bootstrap.xml File (v2.0)

Create a new Bootstrap File from Scratch

Use the GitHub Bootstrap Files as Seed

SQS Messaging Between the Application Template and Firewall Template (v2.0)

Stack Update with VM-Series Auto Scaling Template for AWS (v2.0)

Modify Administrative Account and Update Stack (v2.0)

VM-Series Auto Scale Templates for AWS Version 2.1

Launch the Firewall Template (v2.1)

Launch the Application Template (v2.1)

Create a Custom Amazon Machine Image (v2.1)

VM-Series Auto Scaling Template Cleanup (v2.1)

SQS Messaging Between the Application Template and Firewall Template (v2.1)

Stack Update with VM-Series Auto Scaling Template for AWS (v2.1)

Change Scaling Parameters and CloudWatch Metrics (v2.1)

Modify Administrative Account (v2.1)

List of Attributes Monitored on the AWS VPC

IAM Permissions Required for Monitoring the AWS VPC

Set Up the VM-Series Firewall on KVM

VM-Series on KVM— Requirements and Prerequisites

Options for Attaching the VM-Series on the Network

Prerequisites for VM-Series on KVM

Prepare the Linux Server

Prepare to Deploy the VM-Series Firewall

Supported Deployments on KVM

Secure Traffic on a Single Host

Secure Traffic Across Linux hosts

Install the VM-Series Firewall on KVM

Install the VM-Series Firewall Using Virt-Manager

Provision the VM-Series Firewall on a KVM Host

Perform Initial Configuration of the VM-Series Firewall on KVM

Install the VM-Series Firewall Using an ISO

Use an ISO File to Deploy the VM-Series Firewall

Sample XML file for the VM-Series Firewall

Enable the Use of a SCSI Controller

Verify PCI-ID for Ordering of Network Interfaces on the VM-Series Firewall

Performance Tuning of the VM-Series for KVM

Install KVM and Open vSwitch on Ubuntu 16.04.1 LTS

Enable Open vSwitch on KVM

Integrate Open vSwitch with DPDK

Install QEMU, DPDK, and OVS on Ubuntu

Configure OVS and DPDK on the Host

Edit the VM-Series Firewall Configuration File

Enable SR-IOV on KVM

Enable Multi-Queue Support for NICs on KVM

Isolate CPU Resources in a NUMA Node on KVM

Set Up the VM-Series Firewall on Hyper-V

Supported Deployments on Hyper-V

Secure Traffic on a Single Hyper-V Host

Secure Traffic Across Multiple Hyper-V Hosts

System Requirements on Hyper-V

Linux Integration Services

Install the VM-Series Firewall on Hyper-V

Before You Begin

Virtual Switch Types

MAC Address Spoofing

Performance Tuning of the VM-Series Firewall on Hyper-V

Disable Virtual Machine Queues

Isolate CPU Resources in a NUMA Node

Provision the VM-Series Firewall on a Hyper-V host with Hyper-V Manager

Provision the VM-Series Firewall on a Hyper-V host with PowerShell

Perform Initial Configuration on the VM-Series Firewall

Set Up the VM-Series Firewall on Azure

About the VM-Series Firewall on Azure

Azure Networking and VM-Series Firewall

Azure Security Center Integration

VM-Series Firewall Templates on Azure

Minimum System Requirements for the VM-Series on Azure

Support for High Availability on VM-Series on Azure

Deployments Supported on Azure

Deploy the VM-Series Firewall from the Azure Marketplace (Solution Template)

Deploy the VM-Series Firewall from the Azure China Marketplace (Solution Template)

Use Azure Security Center Recommendations to Secure Your Workloads

Use Panorama to Forward Logs to Azure Security Center

Deploy the VM-Series Firewall on Azure Stack

Enable Azure Application Insights on the VM-Series Firewall

VM Monitoring on Azure

About VM Monitoring on Azure

Set Up the Azure Plugin for VM Monitoring on Panorama

Attributes Monitored Using the Panorama Plugin on Azure

Use the ARM Template to Deploy the VM-Series Firewall

Deploy the VM-Series and Azure Application Gateway Template

VM-Series and Azure Application Gateway Template

Start Using the VM-Series & Azure Application Gateway Template

Deploy the Template to Azure

VM-Series and Azure Application Gateway Template Parameters

Sample Configuration File

Adapt the Template

Auto Scaling the VM-Series Firewall on Azure

Auto Scaling on Azure - Components and Planning Checklist

Azure Auto Scaling Deployment Use Cases

Auto Scaling on Azure—How it Works

Deploy Azure Auto Scaling Template

Parameters in the Auto Scaling Templates for Azure

Secure Kubernetes Services on Azure

How Does the Panorama Plugin for Azure Secure Kubernetes Services?

Secure an AKS Cluster

Set Up the VM-Series Firewall on OpenStack

VM-Series Deployments in OpenStack

Basic Gateway

Service Chaining and Service Scaling

Components of the VM-Series for OpenStack Solution

Heat Template for a Basic Gateway Deployment

Heat Templates for Service Chaining and Service Scaling

Virtual Network

Virtual Machine

Service Template

Service Instance

IPAM

Service Policy

Alarm

Install the VM-Series Firewall in a Basic Gateway Deployment

Install the VM-Series Firewall with Service Chaining or Scaling

Set Up the VM-Series Firewall on Google Cloud Platform

About the VM-Series Firewall on Google Cloud Platform

Supported Deployments on Google Cloud Platform

Prepare to Set Up VM-Series Firewalls on Google Public Cloud

Deploy the VM-Series Firewall from Google Cloud Platform Marketplace

Management Interface Swap for Google Cloud Platform Load Balancing

Use the VM-Series Firewall CLI to Swap the Management Interface

Create a Custom VM-Series Firewall Image for Google Cloud Platform

Use Custom Templates or the gcloud CLI to Deploy the VM-Series Firewall

Enable Google Stackdriver Monitoring on the VM Series Firewall

Enable VM Monitoring to Track VM Changes on Google Cloud Platform (GCP)

Use Dynamic Address Groups to Secure Instances Within the VPC

Secure Kubernetes Services in a Google Kubernetes Engine Cluster

Secure Google Kubernetes Engine Services with Google Cloud Platform Plugin for Panorama

Deploy a Kubernetes Service Using a Sample Terraform Template

Configure Google Cloud Platform Plugin for Google Kubernetes Engine

Set Up a VM-Series Firewall on a Cisco ENCS Network

Plan Your Cisco ENCS Deployment

Prepare the VM-Series Firewall Image for Cisco ENCS

Deploy the VM-Series Firewall on Cisco ENCS

Set Up the VM-Series Firewall on Oracle Cloud Infrastructure

OCI Shape Types

Deployments Supported on OCI

Deploy the VM-Series Firewall on OCI

Upload the VM-Series Image to OCI

Deploy the VM-Series Firewall on OCI Manually

Configure a VCN

Launch the VM-Series Firewall in OCI

Deploy the VM-Series Firewall on OCI Using the Terraform Template

Prepare the Terraform Template Files

Launch the VM-Series Firewall Using a Terraform Template

Set Up the VM-Series Firewall on Alibaba Cloud

VM-Series Firewall on Alibaba Cloud

Minimum System Requirements for the VM-Series Firewall on Alibaba Cloud

Prepare to Deploy the VM-Series Firewall on Alibaba Cloud

Deploy the VM-Series Firewall on Alibaba Cloud

Create a VPC and Configure Networks

Create and Configure the VM-Series Firewall

Secure North-South Traffic on Alibaba Cloud

Configure Load Balancing on Alibaba Cloud

Set Up a Firewall in Cisco ACI

Palo Alto Networks Firewall Integration with Cisco ACI

Service Graph Templates

Multi-Context Deployments

Prepare Your ACI Environment for Integration

Integrate the Firewall with Cisco ACI in Network Policy Mode

Deploy the Firewall to Secure East-West Traffic in Network Policy Mode

Create a Virtual Router and Security Zone

Configure the Network Interfaces

Configure a Static Default Route

Create Address Objects for the EPGs

Create Security Policy Rules

Create a VLAN Pool and Domain

Configure an Interface Policy for LLDP and LACP for East-West Traffic

Establish the Connection Between the Firewall and ACI Fabric

Create a VRF and Bridge Domain

Create an L4-L7 Device

Create a Policy-Based Redirect

Create and Apply a Service Graph Template

Deploy the Firewall to Secure North-South Traffic in Network Policy Mode

Create a VLAN Pool and External Routed Domain

Configure an Interface Policy for LLDP and LACP for North-South Traffic

Create an External Routed Network

Configure Subnets to Advertise to the External Firewall

Create an Outbound Contract

Create an Inbound Web Contract

Apply Outbound and Inbound Contracts to the EPGs

Create a Virtual Router and Security Zone for North-South Traffic

Configure the Network Interfaces

Configure Route Redistribution and OSPF

Configure NAT for External Connections

Endpoint Monitoring in Cisco ACI

Install the Cisco ACI Plugin for Panorama

Configure the Cisco ACI Plugin

Set Up the VM-Series Firewall on Cisco CSP

VM-Series on Cisco CSP System Requirements

Deploy the VM-Series Firewall on Cisco CSP

Bootstrap the VM-Series Firewall

VM-Series Firewall Bootstrap Workflow

Bootstrap Package

Bootstrap Configuration Files

Generate the VM Auth Key on Panorama

Create the init-cfg.txt File

init-cfg.txt File Components

Sample init-cfg.txt File

Create the bootstrap.xml File

Prepare the Licenses for Bootstrapping

Prepare the Bootstrap Package

Bootstrap the VM-Series Firewall on AWS

Bootstrap the VM-Series Firewall on Azure

Bootstrap the VM-Series Firewall on ESXi

Bootstrap the VM-Series Firewall on ESXi with an ISO

Bootstrap the VM-Series Firewall on ESXi with a Block Storage Device

Bootstrap the VM-Series Firewall on Google Cloud Platform

Bootstrap the VM-Series Firewall on Hyper-V

Bootstrap the VM-Series Firewall on Hyper-V with an ISO

Bootstrap the VM-Series Firewall on Hyper-V with a Block Storage Device

Bootstrap the VM-Series Firewall on KVM

Bootstrap the VM-Series Firewall on KVM with an ISO

Bootstrap the VM-Series Firewall on KVM With a Block Storage Device

Bootstrap the VM-Series Firewall on KVM in OpenStack

Verify Bootstrap Completion

Bootstrap Errors

About the VM-Series Firewall
License the VM-Series Firewall
Set Up a VM-Series Firewall on an ESXi Server
Set Up the VM-Series Firewall on vCloud Air
Set Up the VM-Series Firewall on VMware NSX-V
Set Up the VM-Series Firewall on AWS
Set Up the VM-Series Firewall on KVM
Set Up the VM-Series Firewall on Hyper-V
Set Up the VM-Series Firewall on Azure
Set Up the VM-Series Firewall on OpenStack
Set Up the VM-Series Firewall on Google Cloud Platform
Set Up a VM-Series Firewall on a Cisco ENCS Network
Set Up the VM-Series Firewall on Oracle Cloud Infrastructure
Set Up the VM-Series Firewall on Alibaba Cloud
Set Up a Firewall in Cisco ACI
Set Up the VM-Series Firewall on Cisco CSP
- VM-Series on Cisco CSP System Requirements
- Deploy the VM-Series Firewall on Cisco CSP
Bootstrap the VM-Series Firewall

Document:VM-Series Deployment Guide

Deploy the Firewall to Secure North-South Traffic in Network Policy Mode

Last Updated:

Mon Mar 14 13:06:30 PDT 2022

Table of Contents

Search the Table of Contents

About the VM-Series Firewall

VM-Series Deployments

VM-Series in High Availability

Upgrade the VM-Series Firewall

Upgrade the PAN-OS Software Version (Standalone Version)

Upgrade the PAN-OS Software Version (VM-Series for NSX)

Upgrade the VM-Series for NSX During a Maintenance Window

Upgrade the VM-Series for NSX Without Disrupting Traffic

Upgrade the VM-Series Model

Upgrade the VM-Series Model in an HA Pair

Enable Jumbo Frames on the VM-Series Firewall

Hypervisor Assigned MAC Addresses

Custom PAN-OS Metrics Published for Monitoring

Interface Used for Accessing External Services on the VM-Series Firewall

License the VM-Series Firewall

VM-Series Firewall Licensing

Create a Support Account

Serial Number and CPU ID Format for the VM-Series Firewall

Software NGFW Credits

Activate Credits

Transfer Credits

Create a Deployment Profile

Manage a Deployment Profile

Provision Panorama

Migrate Panorama to a FW-Flex License

Deactivate a Firewall

Migrate to a Flexible VM-Series License

VM-Series Models

VM-Series System Requirements

CPU Oversubscription

VM-50 Lite Mode

License Types—VM-Series Firewalls

VM-Series Firewall for NSX Licenses

VM-Series Firewall Licenses for Public Clouds

VM-Series Enterprise License Agreement (Multi-Model ELA)

Manage VM-Series ELA License Tokens

Accept the VM-Series ELA