Panorama VM

[bearsethi96]

We are planning to migrate from physical M-500 appliance to virtual Pan VM. Which would be a better option to deploy it considering the availability, complexity of deployment and others. We don't use Aws in our environment most of the work is done on VMware side but we are ready to use Aws given the options. Let me know your thoughts and any other things I should consider.

[SureshReddyM]

Hi,

As per M-500 physical appliance specification 

Processor  Intel Xeon 6-core CPU

Memory/Internal Storage  128GB DDR4 RAM/240GB SSD storage

Storage  Up to 24TB storage for logs; default is 4TB

So you can configure Panorama to function in one of several different modes:

•A physical Panorama appliance (such as an M-500) can operate in:

•Panorama mode – firewall management and log collection

•Log Collector mode – dedicated log collector only

•Management Only mode – firewall management only without log collection capabilities

•The Panorama virtual appliance can function in one of four different modes:

•Panorama mode – firewall management and log collection

•Log Collector mode – dedicated log collector only

•Management Only mode – firewall management only without log collection capabilities

•Legacy mode

The default mode for both virtual appliances and for M-Series appliances is Panorama mode.

Legacy mode is a transitional option to help customers upgrade from older Panorama versions (such as version 7). The legacy mode does not support any of the logging and reporting enhancements made since Panorama 8.0. Legacy mode is available only when you have an existing Panorama 8.0 virtual appliance running in Legacy mode and you upgrade that device to 8.1. You can change a Panorama virtual appliance from Legacy mode to one of the other options; however, once you make the change you cannot revert the appliance to Legacy mode. On a fresh install of 8.1 and later versions, Legacy mode no longer is available.

You can change Panorama from one mode to another if the following resource requirements are met:

System Mode  Minimum Resource Requirements  Maximum Log Storage Capacity

Panorama  16 CPUs, 32GB RAM  24TB

Log Collector  16 CPUs, 32GB RAM  24TB

Management Only  16 CPUs, 32GB RAM.

And many enterprises have moved to the public cloud to reduce cost and simplify the management efforts of their applications and services. With this move, enterprises can avoid the need to deploy an on-premises M-Series Panorama to manage their VM-Series firewalls in public cloud environments. Now you can deploy the entire Panorama solution on an M-Series appliance, in a public cloud, on a hypervisor such as ESXi, or a combination, depending on your requirements.

A Panorama virtual appliance deployed in a public cloud offering can manage firewalls inside and outside the cloud. Likewise, a Panorama physical appliance can manage physical firewalls as well as virtual firewalls in public and private clouds

Best Regards,

Suresh

[billfoster]

With a VM, you can manage up to 1k devices and up to 20,000 log/sec with:

32 CPUs 128GB memory 8x2TB logging disks

The limit is 24TB of logging space in the Panorama mode VM. You can deploy Log Collector VMs but they are still limited to 24TB.

You can just deploy the VM on-site (it’ll probably be cheaper than AWS) and then allow access to AWS if needed over a VPN tunnel.

You can setup A/P Panorama VMs, but it might be cheaper to use the DR functions of a well-built ESXi environment.

[Meenakshiwt]

Palo Alto Networks VM-Series firewall is the virtualized form of the Palo Alto Networks next-generation firewall. Learn how to deploy 2 VM-Series firewalls that secure ingress/egress traffic from 2 spoke VPCs using Terraform by doing the hands-on lab VM-Series Advanced Deployment launched by Palo Alto Networks.

[anna777]

Moving from a physical M-500 appliance to a virtual Pan VM is a good option for improved flexibility and scalability. Deploying on VMware would be a more straightforward option, but if AWS is an option, it could provide additional benefits such as better availability and disaster recovery. Careful planning and consideration of factors like licensing and network configurations will be crucial for a successful migration.

[thayolakoli]

Migrating from a physical M-500 appliance to a virtual Pan VM can provide various benefits such as flexibility, scalability, and cost-efficiency. When it comes to deploying the virtual Pan VM.

[alicesimth5765g]

Considering your existing VMware infrastructure and familiarity, deploying the VM-Series firewall on VMware is a suitable choice. It offers seamless integration, lower complexity, and cost-effectiveness compared to adopting AWS for this purpose.