This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
VM-Series in the Public Cloud
The VM-Series is the virtualized form factor of the next-generation firewall. Use this discussion as a resource to discuss VM-Series deployments across public clouds like AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud, and Alibaba.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
VM-Series in the Public Cloud
The VM-Series is the virtualized form factor of the next-generation firewall. Use this discussion as a resource to discuss VM-Series deployments across public clouds like AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud, and Alibaba.
About VM-Series in the Public Cloud

Welcome to the VM-Series in the Public Cloud discussion forum! This community exists as a resource for you to discuss VM-Series deployments on AWS, Microsoft Azure, Google Cloud Platform, Oracle Cloud and Alibaba. We encourage you to engage in this rapidly growing community to share ideas, pose questions, and propose real-world solutions to any challenges that may arise.

Disclaimer:
This forum is provided for Live Community members to discuss and share information pertaining to the VM-Series deployments on AWS, Microsoft Azure, Google Cloud Platform Oracle Cloud and Alibaba. Please use the information from this forum at your own risk and make sure to test and verify proposed solutions presented here. For information on contacting Palo Alto Networks support, click here.

Discussions

Start a conversation

Welcome to the VM-Series in the Public Cloud Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

JayGolf by • Community Team Member
  • 3729 Views
  • 0 replies
  • 0 Likes

CUSTOMER ADVISORY: Required Action for Azure hosted VM-Series & AIRS Instances

*********************************************************************************************************************************** (07/20/26) Update: The information in this post is outdated and is no longer applicable. For the latest guidance and required actions, please refer to the updated customer advisory: CUSTOMER ADVISORY: Action Requi...

GRE Tunnels to Zscaler in Public Cloud VM Firewalls

Hi Team, Has anyone created GRE tunnels to Zscaler or anyother third party from a Palo Alto firewall in Azure or GCP? I tried and didn't work and bit of research seem to suggest that Palo Alto doesn't support GRE behind NAT ( Azure or GCP you can't assign public IP directly to the firewall interface and NAT is done by them)

Namalw by • L2 Linker
  • 77 Views
  • 0 replies
  • 0 Likes

VM Firewall deployment in GCP

Hi Team, I have deployed VM series firewalls in GCP with 3x NICs ( mgmt, untrust, trust) I have private subnets assigned for all subnets and mgmt and untrust interfaces have an public IP attached to it. Problem I have is I'm unable access Internet via vm-series firewalls, using its untrust public IP. Internet works if I use the next-hop for my...

Namalw by • L2 Linker
  • 136 Views
  • 3 replies
  • 0 Likes

Azure VM-Series HA: MismatchingResourceName — safest way to repair standby NIC order?

Hi community,We have an Azure active/passive pair running PAN-OS 10.2.2 / VM-Series plugin 3.0.2, without an active support contract.During failover, PA02 becomes active, but the floating IPs remain on PA01 and traffic fails. Azure authentication succeeds; NIC updates return HTTP 400 — MismatchingResourceName.Our findings:Firewall Azure NIC orde...

VM-Series Upgrade

Hi Team, Recently we performed VM-Series NGFW PAN-OS upgrade from 11.2.7-h13 to 11.2.13 (which is deployed on GCP). Before upgrade ingress & egress traffic was working fine, post upgrade we faced issue with ingress traffic. For this issue we raise TAC ticket, we didn't not received any conclusive resolution. After reverting back to 11.2....

HA FW on AWS

I want to deploy two firewalls on AWS, in different availability zones. I understand from the guide that this isn't recommended, but that it is supported. I've managed to complete the deployment without any issues. However, I have some questions. Since it’s not possible to move an ENI between AZs, if there’s a failure with FW-A or AZ-A, FW-B wil...

ARM (Graviton) PAYG listing with Advanced Threat Prevention: on the roadmap?

We run the VM-Series on AWS, x86, purchased self-serve through AWS Marketplace as "VM-Series Next-Gen Virtual Firewall w/Advanced Threat Prevention (PAYG)". We would like to move to Graviton, but the licensing doesn't line up. The ARM PAYG listing (prodview-cjfzbdnaojqci) names no security subscription and no 24/7 premium support. Both x86 PAYG ...

b3ll1s by • L0 Member
  • 182 Views
  • 0 replies
  • 0 Likes

VM-Series on AWS (c8i.xlarge, PAN-OS 12.1.7-h3, T1-8GB) – "Number of sessions supported" is 65536, docs say 300,000

Hi all, I'm running a VM-Series on AWS c8i.xlarge (4 vCPU / 8 GiB) with PAN-OS 12.1.7-h3.c8i is documented as supported from PAN-OS 12.1.3, so the instance/version combination should be fine.The max session count is much lower than documented, and I can't find why. > show system info | match "vm-|sw-version"vm-license: VM-SERIES-4vm-cap-tier:...

Guidance Required for VM-500 Redeployment in Azure Due to Root Partition Limitation

Hello All,We are running two VM-500 firewalls in Azure configured in an Active-Passive HA pair. Currently, we are encountering high root partition utilization on both firewalls.A TAC case was opened, and although some files were deleted to reduce disk usage, the root partition utilization remains high. Palo Alto TAC has informed us that to incre...

kganesh by • L0 Member
  • 260 Views
  • 1 replies
  • 0 Likes

Max limit for URL Categories in a single Security Policy Rule?

Hi everyone, I'm trying to find the exact maximum limit for how many URL Categories (predefined + custom) can be added as match conditions in a single Security Policy Rule (under the Service/URL Category tab). Checking the official capacity limits documentation (specifically for VM-500), I see limits for total custom URL categories (500 per VSYS...

The XFF IP is the same, but the country of origin appears differently; please let me know why.

Hello everyone, As shown in the screenshot, you can see that the traffic has the same X-Forwarded-For (XFF) value, but one session is allowed while the other is denied. The allowed session matched our custom application policy. The denied session matched the any deny policy. Based on what I am seeing, it appears that when the session is al...

JiHwanHam_0-1785823048716.png

Active Passive Failover in AWS

Hello Guys,I am trying to configure Active-Passive (A/P) HA failover for Palo Alto VM-Series firewalls in AWS.I have completed the HA configuration and updated the required IAM roles and permissions. Currently, the setup is partially working as expected:Primary Public IP (EIP) successfully moves from Passive ENI to Active ENI during failover.Rou...

  • 535 Posts
  • 107 Subscriptions
Top Liked Authors
View All
Labels
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks