>
    Strata Copilot
    Create a Custom VM-Series Image for Azure
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Firewall on Azure
    4. Create a Custom VM-Series Image for Azure
    Download PDF
    VM-Series

    Create a Custom VM-Series Image for Azure

    Table of Contents

    Create a Custom VM-Series Image for Azure

    Use a custom image to avail flexibility and consistency to deploy the VM-Series firewall with the PAN-OS version you choose.
    Where Can I Use This?What Do I Need?
    • Microsoft Azure
    • Microsoft Azure Stack
    • Azure® Marketplace
    • Azure China Marketplace
    • Azure Government Marketplace
    • VM-Series License (PAYG or BYOL)
    • VM-Series plugin
    • Panorama
    • Panorama plugin for Azure
    You can create a custom VM-Series firewall image for later use in your Azure deployment. A custom image gives you flexibility and consistency to deploy the VM-Series firewall with the PAN-OS version you want to use instead of being restricted to using only an image available through the Azure marketplace. Additionally, your custom image can include the latest content and antivirus updates.
    Creating a custom image requires that you remove all private data—user configuration, users, plugin configuration, etc—before creating the VHD. Additionally, Complete the following procedure to prepare and create a custom image.
    If the VM-Series firewall used to create your custom image was deployed using a premium disk type, any VM-Series firewall deployed using the custom image must be deployed using the same premium disk type. However, if you create an image using firewall deployed with a standard disk type, you can deploy the firewall using a standard or premium disk type.
    1. Log in to Azure.
    2. Deploy the VM-Series firewall from the Azure Marketplace.
    3. (BYOL license only) Activate your license.
    4. Upgrade the VM-Series Firewall to PAN-OS 10.0.3. Upgrading to PAN-OS 10.0.3 also upgrades the VM-Series plugin to 2.0.3.
    5. Access the VM-Series firewall command-line interface via SSH using the username and password provided in the Azure Marketplace template.
    6. Verify that your VM-Series firewall has the correct PAN-OS, VM-Series plugin, content, and antivirus versions.
      show system info
      If you're using PAN-OS 10.1, ensure that you upgrade the VM-Series plugin to version 2.1.7 or higher and if you're using PAN-OS 10.2.0, ensure you're using VM-Series plugin to 3.0.3 or higher.
    7. (BYOL license only) Deactivate your license.
    8. Perform a private data reset on the VM-Series firewall. This command requires the firewall to reboot. Wait for the VM-Series firewall to reboot complete before continuing; the reboot can take five to seven minutes.
      request system private-data-reset shutdown
      Wait for firewall to shutdown.
    9. Create a new VHD image from the VM-Series instance.
      1. Log in to the Azure CLI.
      2. Verify that you're using the correct subscription.
        az account set --subscription <subscription-id>
      3. Execute the following commands to generalize the VM, allowing it to be imaged for multiple deployments, and create the new VHD.
        az vm deallocate --resource-group <myResourceGroup> --name <myVM>
        az vm generalize --resource-group <myResourceGroup> --name <myVM>
        az image create --resource-group <myResourceGroup> --name <myImage> --source <resource-id-of-VM>
    10. Create a new VM-Series firewall from your custom image.
      az vm create --resource-group <myResourceGroup> --name <myNewVM> --image <myImage> --admin-username <newUser> --admin-password <newPassword> --plan-name byol --plan-product vmseries-flex --plan-publisher paloaltonetworks --size Standard_DS2_v2
    11. After deploying a VM-Series firewall with your custom image, verify your deployment.
      1. Log in to the firewall using the credentials provided while bringing up the VM from the custom image.
      2. After logging in successfully, verify that your firewall is running the correct PAN-OS version and has the correct content and antivirus versions.
        show system info
    12. (Optional) Copy the custom image to another region.
      az image copy –source-resource-group <source-rg> –source-object-name <pa-vm-image-name> –target-location <target-region> –target-resource-group <destination-rg>

    © 2026 Palo Alto Networks, Inc. All rights reserved.