You can deploy the VM-Series firewall on an AWS instance size
with more resources than the minimum VM-Series
System Requirements. If you choose a larger instance size
for the VM-Series firewall model, although the firewall only uses
the max vCPU cores and memory shown in the table, it does take advantage
of the faster network performance that AWS provides. If you want
to change the instance type on your VM-Series firewall that is licensed
with the BYOL option, you must deactivate the VM before
you switch the instance type to ensure that your license is valid.
See Upgrade the VM-Series Model to know why.
The C3, C4, M3, M4 instance types support both DPDK and SR-IOV
modes. The C5 and M5 instance types that have the Elastic Network
Adapter (ENA) support SR-IOV mode only on PAN-OS 9.0.3 or earlier
versions. DPDK support is available starting with PAN-OS 9.0.3.xfr.
For SR-IOV and DPDK driver support by PAN-OS version, see PacketMMAP and DPDK Drivers on
For guidance with sizing the VM-Series firewall on AWS, refer
to this article.