topic Re: VM-Series firewall on VirtualBox in General Topics

VM-Series firewall on VirtualBox

mariusz_sawczuk — Thu, 17 Jan 2013 13:23:21 GMT

Hi,

I know that VM-Series firewall requires VMware ESXi running vSphere 4.1 or 5.0.

But I don't have VMware right now on my laptop and only I have is Oracle VirtualBox 4.2.6 - just for tests and presentations (not for commercial purpose)

On VirtualBox I've already imported vmdk file but when I launch PA-VM I see: 'Welcome to the PanOS Bootloader. Hit any key to stop autoboot...' and nothing happens.

Does anyone knows how to run VM-Series firewall on VirtualBox?

Re: VM-Series firewall on VirtualBox

ericgearhart — Thu, 17 Jan 2013 14:57:13 GMT

I am betting you've got to get the disk controller and drive settings exactly right... I've booted VMs designed for VMware on Virtualbox before, and I remember having to tweak the drive controller settings in VirtualBox.

I'll pull down the PANOS VM and give it a shot on my laptop... if I can get it to boot I'll reply here

Re: VM-Series firewall on VirtualBox

JohanL — Thu, 17 Jan 2013 15:32:04 GMT

I'm running a PA-VM in VMware workstation 9. It is important that your network adapters supports vmxnet3.

It runs smootly.

Re: VM-Series firewall on VirtualBox

mariusz_sawczuk — Fri, 18 Jan 2013 00:14:35 GMT

You're right. I've installed VMWorkstation 9 on my laptop and then VM-300. Now I have access to console of VM-300 and I can do some changes.

Hovewer I have networks porblems and I can't upgrade VM-300 and update it.

On my lapotp I have only one physical ethernet card.

My physical laptop ip adrress is: 192.168.0.25/24, default gateway is 192.168.0.1.

VM-300 on Vmware has two interfaces: Network Adapter, Network Adapter2

On VMware settings for VM-300 I've set

- Network Adapter as Bridged (Automatic)

- Network Adapter2 as NAT

After login to VM-300 through console I've set up IP address, netmask, default-gateway and dns server fir management interface:

set deviceconfig system ip-address 192.168.0.26 netmask 255.255.255.0 default-gateway 192.168.0.1 dns-setting servers primary 192.168.0.92

of course I do commit,,,

But still when I try to ping my physical laptop address (ping host 192.168.0.25) from VM-300, I get: host unreachable and I don't have access to web-gui VM-300 (https://192,168.0.26) from my laptop.

What I'm doing wrong?

Re: VM-Series firewall on VirtualBox

JohanL — Fri, 18 Jan 2013 06:52:57 GMT

Normally you should have 3 network adapters. One for management, one for e1/1 and one for e1/2. Probarly you've configured your trusted ethernet adapter and not the management interface.

The first network adapter in vmware is your management adapter

Be sure that your vmx file contains the correct adapter settings:

ethernet0.virtualdev="vmxnet3"

Because by default when you add ethernet adapters into vmware it is set to e1000.

Register your device on the PA portal. After entering the auth code, the license file is available. Download this file and import this file into your VM, reboot.

whithout this file, routing is not possible.

Also have a look at this: https://live.paloaltonetworks.com/docs/DOC-4200

Re: VM-Series firewall on VirtualBox

mariusz_sawczuk — Wed, 06 Feb 2013 07:51:17 GMT

Thanks for your advice.

As you notice, by default I had two interfaces: management and e1/1.

For Layer3 deployment I added 3rd network adapter (in preferences of Palo Alto VM), and manualy set to vmxnet3. Palo Alto VM recognize this adater as an e1/2 interface.

I need also another one interface, but when I add network adapter and set as an vmxnet3, Palo Alto VM doesn't recognize this interface at all. This adapter does'nt even appeared on the list of interfaces.

What's the problem, what I'm doing wrong?

Re: VM-Series firewall on VirtualBox

JohanL — Wed, 06 Feb 2013 08:21:35 GMT

You cannot add interfaces while the VM is running. Shut down your VM series firewall, add a network adapter and power-on your VM FW.

Re: VM-Series firewall on VirtualBox

mariusz_sawczuk — Wed, 06 Feb 2013 08:27:02 GMT

I did this. I even shut down whole VMware Workstation, but after restart interface doesn't appears on PAN VM.

Maybe there is limitation regarding virtual network adapters/interface on VMWare Workstation 9.0 or in PAN VM?

Re: VM-Series firewall on VirtualBox

JohanL — Wed, 06 Feb 2013 08:29:27 GMT

The only limitation is het one from VMware. When you go to interfaces in your WEB UI, can het assign an IP address to the interface and change the status to up ?

Re: VM-Series firewall on VirtualBox

mariusz_sawczuk — Wed, 06 Feb 2013 08:51:08 GMT

All is working now

For the records - the interface will not appear (even in 'show interfaces all' report command) unless it will be not configured.

Thanks for your support

Re: VM-Series firewall on VirtualBox

Vortex_Rotor — Tue, 06 Aug 2013 14:58:36 GMT

Did you ever get this working within VB?

Re: VM-Series firewall on VirtualBox

ericgearhart — Tue, 06 Aug 2013 16:23:53 GMT

I believe this is impossible based on the post by JohnaL:

JohanL wrote:

I'm running a PA-VM in VMware workstation 9. It is important that your network adapters supports vmxnet3.

It runs smootly.

If VMware proprietary vmxnet3 adapters are "baked into" the VM series appliance and they are required, then there's no way to get the appliance to work in VirtualBox. The only way to even possibly get it to work is if some generic adapter were used in VirtualBox, that the VM series appliance kernel would happen to see and recognize as valid eth interfaces.

Sorry! I basically gave up after seeing that vmxnet3 was required as the adapter.

Re: VM-Series firewall on VirtualBox

Vortex_Rotor — Tue, 06 Aug 2013 17:17:54 GMT

Thanks... I read that but didn't know if anyone was able to actually get it to work.

Re: VM-Series firewall on VirtualBox

DavidSchmitt — Mon, 11 Jun 2018 17:47:24 GMT

I've got the 8.1 PA-VM running on VirtualBox 5.2 with exactly the same message, it just takes, like, 5+ minutes before it actually boots.

Even after that the system needs several more minutes until the default login of admin/admin is available.

Re: VM-Series firewall on VirtualBox

jvalentine — Mon, 11 Jun 2018 17:56:10 GMT

This also happens in VMware environments (delayed bootup) when you upgrade the "VM Hardware" compatibility past a certain level. I believe it has something to do with a virtual serial port or somesuch, but don't have the details at my fingertips.

I'm sure you could dig in the Palo Alto Networks documentation and find which VM Hardware versions are fully supported, and then look at what VMware changed in subsequent hareware compatibility updates/versions.

Re: VM-Series firewall on VirtualBox

DavidSchmitt — Tue, 12 Jun 2018 10:27:34 GMT

Thanks for the hint! Adding a virtual serial port has cut down boot times dramatically!

Re: VM-Series firewall on VirtualBox

Retired Member — Thu, 06 Sep 2018 02:58:45 GMT

Hi, i also have this issue, able to share more details on the serial port that you add to speed up the boot up?

Re: VM-Series firewall on VirtualBox

DavidSchmitt — Thu, 06 Sep 2018 07:13:45 GMT

Not really. I added a serial port with default values in the virtualbox UI. That was all.