Palo Alto Networks VM Firewalls

When cloning a lab VM firewall to use on another machine, edit the VMware VMX config file to use uuid.action = “keep”. When you boot the VM, click “I moved it”.

• PAN-SOFTWARE-NGFW-CR
• PAN-SOFTWARE-NGFW-LAB
• PAN-SOFTWARE-NGFW-NFR

Data gathered Nov 2021.

Useful Page on VM-FLEX migration.

You can migrate a VM-100 firewall to VM-FLEX licencing while still keeping it a VM-100.

I had a VM-100 on PAN-OS 9.1.11. I found I had to de-register the VM, reboot it, apply the FLEX VM-100 auth code, reboot and that was it. I could then add/remove subscriptions, etc. I noticed that after upgrading to 10.1.3 there were issues with refreshing the licences but I don't know if that was due to some other lab stuff (I increased the CPU count to 4 when it was only licenced for 2). I'll need to recheck.

When you “Upgrade capacity”, to change a VM-100 to a VM-FLEX-2, the firewall rebooted and was automatically moved from one FLEX profile (VM-100) to the other (FLEX) in the support portal.

I also had a PAN-OS 10.1.3 VM that I licensed directly as VM-100.

The VM Capacity Tier is based on RAM. From PAN-OS 10.0.4, CPU will control throughput while RAM controls limits like sessions, addres objects, etc. See here.

• 4.5 GB (VM-50-lite ish)
• 5.5 GB (VM-50 ish)
• 6.5 GB (VM-100 ish)
• 9 GB (VM-300 ish)
• 16 GB (VM-500 ish)
• 56 GB (VM-700 ish)

For the old model of VM licencing (e.g. VM-100), if you assign more vCPUs than those officially supported by the license, any additional vCPUs are assigned to the management plane.

For operation, the VM-50 firewall requires minimum 32GB of hard drive space. However, because the VM-Series base image is common to all models, you must allocate 60GB of hard drive space until you license the VM-50.

To achieve the best performance, all of the needed cores should be available on a single CPU socket.

In 10.1.X, 9 GB might be insufficient for VM-300 depending upon the feature set or combination of feature sets used on the firewall. If you experience memory resource related issues, increase memory to 11 GB to accommodate the additional memory requirements of some of the features or combination of features. Alternately, you can Enable ZRAM on the VM-Series Firewall to improve memory usage.

To enable ZRAM, the documentation is here.

• grep pattern “KiB Mem :” mp-log mp-monitor.log
• Convert the above total memory from KB to MB. For example: 9202656 / 1024 = 8987 MB
• debug software kernelcfg zram-swap enable
• debug software kernelcfg zram-swap modify host-mem-threshold <total-memory-in-MB>
• Reboot
• Verify debug software kernelcfg zram-swap show config

System requirements are here.

For VM-FLEX firewalls, the ammount of RAM you give the VM determins the “Memory Profile”. Depending on what memory profile you have, the firewall will assign the available CPU's in different ways between MGMT and Dataplane.

• AWS VM Firewall Performance and Capacity
• Azure VM Firewall Performance and Capacity
• GCP VM Firewall Performance and Capacity
• Oracle VM Firewall Performance and Capacity

• AWS Underlying VM Instances
• Azure Underlying VM Instances

Assign cores here.

show plugins vm_series dp-cores

request plugins vm_series dp-cores 14

Request the license for the VM. In my case, I got an evaluation licence that includes Threat Prevention, URL Filtering (PAN-DB) and WildFire. I was sent an Authorisation Code that is in the following format V1234567.

I've noticed that, for renewing evaluation VMs, it can be cleaner to create a band new VM, license it and then migration the configuration from the old VM to the new one.

1. Log into the support portal.
2. Go to Assets→VM-Series Auth-Codes and add VM-Series Auth-Code.
3. If you have a Panorama auth code and serial number, go to Assets→Devices and register the serial number as a new sevice and then apply the auth code to it
4. Log into the Palo Alto Networks support portal.
5. Click the Software Updates in the row of tabs.
6. You should now see a list of downloads. The size of the list depends on the access your account has.
7. Search for PA-VM-ESX-10.1.3
8. Click the appropriate link and download the OVA file.
9. In VMware, deploy the OVA as a new machine.
10. Boot the VM and configure the management interface with an IP, default gateway and DNS.
11. Go to Device→Licenses and click Activate support using authorisation code and use the VM auth code you were given. The VM will reboot. On the support portal under Assets→Devices, the VM serial number will appear. Under Assets→VM-Series Auth-Codes, the VM auth code will now show you are using 1/X (where X is the numeber of VMs you are licences for).
12. For the Panorama VM, you will need to add the serial number under Panorama→Setup→General→Management. Then go to Panorama→Licenses and click Activate support using authorisation code and use the VM auth code you were given.

Retrieve the license deactivation API key from the Customer Support Portal.

1. Log in to the Customer Support Portal.
2. Uner Assets > API Key Management, select Licensing API.
3. Copy the API key (each customer has one API key that covers all their firewalls).
4. SSH to the CLI of a Palo VM and run the following command

   request license api-key set key <key>

To deactivate a licence from the GUI you need to enable 'verify update server' and install an API key.

The Verify Update Server Identity option under Device > Setup > Services is enabled by default. Before deactivating an VM-Series firewall, verify that this option is enabled.

You can deactivate using the “Deactivate VM” link under Device > Licences.

In my case, I had VM-50 that I wanted to make VM-100. We purchased VM-100 licence and got that set in the support portal. Once the VM Auth code section showed the VM auth code as a VM-100 instead of VM-50, we could still see the deployed VM as a VM-50.

We then logged in, set the API key (see above) and the clicked Device→Licence→Upgrade VM Capacity. The firewall restarted and was then a VM-100.

A trial VM will not produce traffic/threat logs but it will pass traffic (with a limited number of concurrent sessions ~1K). If you activate a trail Auth code, when the trial period is up, GlobalProtect client and Software sections of the GUI will go blank and say “Operation Failed: An active license is required for this feature”. You can still download App updates and manually upload and install PAN-OS though.

Warning Be aware that the subscription costs get cheaper when you buy more than three subscriptions. I can't (yet) figure out the formula.