PaloAlto Networks VM series Quick reference guide

Palo Alto Networks®
VM-Series Deployment Guide
PAN-OS 6.0

ii
Contact Information
Corporate Headquarters:
Palo Alto Networks
4401 Great America Parkway
Santa Clara, CA 95054
http://www.paloaltonetworks.com/contact/contact/
About this Guide
This guide describes how to set up and license the VM-Series firewall; it is
intended for administrators who want to deploy the VM-Series firewall.
For more information, refer to the following sources:
PAN-OS Administrator's Guide– for instructions on configuring the
features on the firewall.
https://paloaltonetworks.com/documentation– for access to the
knowledge base, complete documentation set, discussion forums, and
videos.
https://support.paloaltonetworks.com– for contacting support, for
information on the support programs, or to manage your account or
devices.
For the latest release notes, go to the software downloads page at
https://support.paloaltonetworks.com/Updates/SoftwareUpdates.
To provide feedback on the documentation, please write to us at:
[e-mail].
Palo Alto Networks, Inc.
www.paloaltonetworks.com
© 2007-2015 Palo Alto Networks Inc. All rights reserved.
Palo Alto Networks, and PAN-OS are registered trademarks of Palo Alto
Networks, Inc.
Revision Date: November 18, 2015

VM-Series Deployment Guide iii
Table of Contents
About the VM-Series Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1
VM-Series Models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
VM-Series Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
License the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Create a Support Account . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Register the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Activate the License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Upgrade the PAN-OS Software Version. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Upgrade the VM-Series Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Monitor Changes in the Virtual Environment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Enable VM Monitoring to Track Changes on the Virtual Network . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Use Dynamic Address Groups in Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Attributes Monitored on a VMware Source . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Set Up a VM-Series Firewall on an ESXi Server . . . . . . . . . . . . . . . . . . . . . . .9
Supported Deployments on VMware vSphere Hypervisor (ESXi) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
System Requirements and Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Install a VM-Series firewall on VMware vSphere Hypervisor (ESXi) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Provision the VM-Series Firewall on an ESXi Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Perform Initial Configuration on the VM-Series on ESXi . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Troubleshoot ESXi Deployments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Basic Troubleshooting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Installation Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Licensing Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Connectivity Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Set Up a VM-Series Firewall on the Citrix SDX Server . . . . . . . . . . . . . . . . .21
About the VM-Series Firewall on the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
System Requirements and Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Supported Deployments—VM Series Firewall on Citrix SDX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Scenario 1—Secure North-South Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Scenario 2—Secure East-West Traffic (VM-Series Firewall on Citrix SDX) . . . . . . . . . . . . . . . . . . . . 28
Install the VM-Series Firewall on the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Upload the Image to the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Provision the VM-Series Firewall on the SDX Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

iv VM-Series Deployment Guide
Secure North-South Traffic with the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Deploy the VM-Series Firewall Using L3 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Deploy the VM-Series Firewall Using Layer 2 (L2) or Virtual Wire Interfaces . . . . . . . . . . . . . . . . . . 35
Deploy the VM-Series Firewall Before the NetScaler VPX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
Secure East-West Traffic with the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Set Up a VM-Series NSX Edition Firewall. . . . . . . . . . . . . . . . . . . . . . . . . . . 43
VM-Series NSX Edition Firewall Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
What are the Components of the NSX Edition Solution?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
How Do the Components in the NSX Edition Solution Work Together?. . . . . . . . . . . . . . . . . . . . . . 49
What are the Benefits of the NSX Edition Solution?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
VM-Series NSX Edition Firewall Deployment Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
Create a Device Group and Template on Panorama . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58
Register the VM-Series Firewall as a Service on the NSX Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Deploy the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
Enable SpoofGuard . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Define an IP Address Pool . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64
Specify the Port Groups from Which to Redirect Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65
Prepare the ESXi Host for the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
Deploy the Palo Alto Networks NGFW Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67
Create Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70
Define Policies on the NSX Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Apply Policies to the VM-Series Firewall . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
Steer Traffic from Guests that are not Running VMware Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

VM-Series Deployment Guide 1
About the VM-Series Firewall
The Palo Alto Networks VM-Series firewall is the virtualized form of the Palo Alto Networks next-generation
firewall. It is positioned for use in a virtualized or cloud environment where it can protect and secure east-west
and north-south traffic.
VM-Series Models
VM-Series Deployments
License the VM-Series Firewall
Monitor Changes in the Virtual Environment

2VM-Series Deployment Guide
VM-Series Models About the VM-Series Firewall
VM-Series Models
The VM-Series firewall is available in four models—VM-100, VM-200, VM-300, and VM-1000-HV.
All four models can be deployed as guest virtual machines on VMware ESXi and on Citrix NetScaler SDX; on
VMWare NSX, only the VM-1000-HV is supported. The software package (.xva or .ovf file) that is used to deploy
the VM-Series firewall is common across all models. The VM-Series model is driven by license; when you apply
the license on the VM-Series firewall, the model number and the associated capacities are implemented on the
firewall.
Each model can be purchased as an Individual or an Enterprise version. The Individual version is in multiples
of 1. The orderable SKU, for example PA-VM-300, includes an auth-code to license one instance of the
VM-Series firewall. The Enterprise version is available in multiples of 25. For example, the orderable SKU
PAN-VM-100-ENT has a single auth-code that allows you to register 25 instances of the VM-100.
Each model of the VM-Series firewall is licensed for a maximum capacity. Capacity is defined in terms of the
number of sessions, rules, security zones, address objects, IPSec VPN tunnels and SSL VPN tunnels that the
VM-Series firewall is optimized to handle. When purchasing a license, make sure to purchase the correct model
for your network requirements. The following table depicts some of the capacity differences by model:
For information on the platforms on which you can deploy the VM-Series firewall, see VM-Series Deployments.
For general information, see About the VM-Series Firewall.
Model Sessions Security
Rules Dynamic IP Addresses Security Zones IPSec VPN Tunnels SSL VPN Tunnels
VM-100 50000 250 1000 10 25 25
VM-200 100000 2000 1000 20 500 200
VM-300 250000 5000 1000 40 2000 500
VM-1000-HV 250000 10000 100000 40 2000 500

VM-Series Deployment Guide 3
About the VM-Series Firewall VM-Series Deployments
VM-Series Deployments
The VM-Series firewall can be deployed on the following platforms:
VM-Series for VMware vSphere Hypervisor (ESXi)
VM-100, VM-200, VM-300, or VM-1000-HV is deployed as guest virtual machine on VMware ESXi; ideal
for cloud or networks where virtual form factor is required.
For details, see Set Up a VM-Series Firewall on an ESXi Server.
VM-Series for VMware NSX
The VM-1000-HV is deployed as a network introspection service with VMware NSX, and Panorama. This
deployment is ideal for east-west traffic inspection, and it also can secure north-south traffic.
For details, see Set Up a VM-Series NSX Edition Firewall
VM-Series for Citrix SDX
VM-100, VM-200, VM-300, or VM-1000-HV is deployed as guest virtual machine on Citrix NetScaler SDX;
consolidates ADC and security services for multi-tenant and Citrix XenApp/XenDesktop deployments.
For details, see Set Up a VM-Series Firewall on the Citrix SDX Server

4VM-Series Deployment Guide
VM-Series Deployments About the VM-Series Firewall
Here is a brief look at some of the requirements for deploying PAN-OS 6.0 on the VM-Series firewall:
Deployment Hypervisor
Versions
Supported
Base Image Required from the Palo Alto
Networks Support Portal Relevant Capacity Licenses
VM-Series for VMware
vSphere Hypervisor (ESXi)
(without VMware NSX)
5.0, 5.1, and 5.5 PAN-OS for VM-Series Base Images
For example, the download-able image
name reads as: PA-VM-6.0.0.zip
VM-100
VM-200
VM-300
VM-1000-HV
VM-Series for VMware
NSX
vSphere with VMware NSX
and Panorama
5.5 PAN-OS for VM-Series NSX Base Images
For example, the download-able image
name reads as: PA-VM-NSX-6.0.0.zip
VM-1000-HV
VM-Series for Citrix SDX
SDX version
XenServer version
10.1+
6.0.2 or later
PAN-OS for VM-Series SDX Base Images
For example, the download-able image
name reads as: PA-VM-SDX-6.0.0.zip
VM-100
VM-200
VM-300
VM-1000-HV

VM-Series Deployment Guide 5
About the VM-Series Firewall License the VM-Series Firewall
License the VM-Series Firewall
When you purchase a VM-Series firewall, you receive a set of authorization codes over email. Typically the email
includes authorization code(s) to license the VM-Series model you purchased (VM-100, VM-200, VM300,
VM-1000-HV), support entitlement that provides access to software/content updates (for example,
PAN-SVC-PREM-VM-100 SKU auth-code), and any additional subscriptions such as Threat Prevention, URL
Filtering, GlobalProtect, or WildFire. In the case of the VMware integrated NSX solution, the email contains a
single authorization code that bundles the capacity license for one or more instances of the VM-1000-HV
model, the support entitlement, and one or more subscription licenses.
To use the authorization code(s), you must register the code to the support account on the Palo Alto Network
support portal. If you have an existing support account, you can access the VM-Series Authentication Code link
on the support portal to manage your VM-Series firewall licenses and download the software.
If you do not have an existing support account, you must provide your sales order number or customer ID, and
the capacity auth-code to register and create an account on the support portal. After your account is verified
and the registration is complete, you will be able to log in and download the software package required to install
the VM-Series firewall. For details on activating the license for your deployment, refer to the relevant section in
Activate the License.
To license your VM-Series firewall, see the following sections:
Create a Support Account
Register the VM-Series Firewall
Activate the License
Upgrade the PAN-OS Software Version
Upgrade the VM-Series Model
For instructions on installing your VM-Series firewall, see VM-Series Deployments.
Create a Support Account
A support account is required to manage your VM-Series firewall licenses and to download the software package
required to install the VM-Series firewall. If you have an existing support account, continue with Register the
VM-Series Firewall.
If you have an evaluation copy of the VM-Series firewall and would like to convert it to a fully
licensed (purchased) copy, clone your VM-Series firewall and use the instructions to register and
license the purchased copy of your VM-Series firewall. For instructions, see Upgrade the
VM-Series Model.

6VM-Series Deployment Guide
License the VM-Series Firewall About the VM-Series Firewall
Register the VM-Series Firewall
Use the instructions in this section to register your capacity auth-code with your support account.
Create a Support Account
1. Log in to https://support.paloaltonetworks.com.
2. Click Register and fill in the details in the user registration form. You must use the capacity auth-code and the sales
order number or customer ID to register and create an account on the support portal.
3. Submit the form. You will receive an email with a link to activate the user account; complete the steps to activate the
account.
After your account is verified and the registration is complete, you will be able to log in and download the software
package required to install the VM-Series firewall.
Register the VM-Series Firewall
1. Log in to https://support.paloaltonetworks.com with your account credentials.
2. Select Assets and click Add VM-Series Auth-Codes.
3. In the Add VM-Series Auth-Code field, enter the capacity auth-code you received by email, and click the checkmark
on the far right to save your input. The page will display the list of auth-codes registered to your support account.
You can track the number of VM-Series firewalls that have been deployed and the number of licenses that are still
available for use against each auth-code. When all the available licenses are used, the auth-code does not display on
the VM-Series Auth-Codes page. To view all the assets that are deployed, select Assets > Devices.

VM-Series Deployment Guide 7
About the VM-Series Firewall License the VM-Series Firewall
Activate the License
To activate the license on your VM-Series firewall, you must have deployed the VM-Series firewall and
completed initial configuration. For instructions to deploy the VM-Series firewall, see VM-Series Deployments.
Until you activate the license on the VM-Series firewall, the firewall does not have a serial number, the MAC
address of the dataplane interfaces are not unique, and only a minimal number of sessions are supported.
Because the MAC addresses are not unique until the firewall is licensed, to prevent issues caused by overlapping
MAC addresses, make sure that you do not have multiple, unlicensed VM-Series firewalls.
When you activate the license, the licensing server uses the UUID and the CPU ID of the virtual machine to
generate a unique serial number for the VM-Series firewall. The capacity auth-code in conjunction with the serial
number is used to validate your entitlement.
After you license a VM-Series firewall, if you delete and redeploy the VM-Series firewall on the same host
(typically occurs only in a lab environment), use a unique name when redeploying the firewall. Using a unique
name ensures that the UUID assigned to the firewall is not the same as that assigned to the deleted instance of
the firewall. A unique UUID is required to complete the licensing process without any problems.
Activate the License for the VM-Series Firewall (Standalone Version)
Activate the License for the VM-Series NSX Edition Firewall
Activate the License for the VM-Series Firewall (Standalone Version)
To activate the license on your VM-Series firewall, you must have deployed the VM-Series firewall and
completed initial configuration.
Activate the License
• If your VM-Series firewall has direct Internet
access.
To activate the license, the firewall must be
configured with an IP address, netmask, default
gateway, and DNS server IP address.
1. Select Device >Licenses and select the Activate feature using
authentication code link.
2. Enter the capacity auth-code that you registered on the support
portal. The firewall will connect to the update server
(updates.paloaltonetworks.com), and download the license and
reboot automatically.
3. Log back in to the web interface and confirm that the
Dashboard displays a valid serial number. If the term Unknown
displays, it means the device is not licensed.
4. On Device > Licenses, verify that PA-VM license is added to the
device.

8VM-Series Deployment Guide
License the VM-Series Firewall About the VM-Series Firewall
Activate the License for the VM-Series NSX Edition Firewall
Panorama serves as the central point of administration for the VM-Series NSX edition firewalls and the license
activation process is automated. When a new VM-Series NSX edition firewall is deployed, it communicates with
Panorama to obtain the license. Therefore, you need to make sure that Panorama has internet access and can
connect to the Palo Alto Networks update server to retrieve the licenses. For an overview of the components
and requirements for deploying the VM-Series NSX edition firewall, see VM-Series NSX Edition Firewall
Overview.
For this integrated solution, the auth-code (for example, PAN-VM-!000-HV-SUB-BND-NSX2) includes
licenses for threat prevention, URL filtering and WildFire subscriptions and premium support for the requested
period.
In order to activate the license, you must have completed the following tasks:
• If your VM-Series firewall does not have Internet
access.
1. Select Device > Licenses and click the Activate Feature using
Auth Code link.
2. Click Download Authorization File, and download the
authorizationfile.txt on the client machine.
3. Copy the authorizationfile.txt to a computer that has access to the
Internet and log in to the support portal. Click My VM-Series
Auth-Codes link and select the applicable auth-code from the
list and click the Register VM link.
4. On the Register Virtual Machine tab upload the authorization
file. This will complete the registration process and the serial
number of your VM-Series firewall will be attached to your
account records.
5. Navigate to Assets > My Devices and search for the VM-Series
device just registered and click the PA-VM link. This will
download the VM-Series license key to the client machine.
6. Copy the license key to the machine that can access the web
interface of the VM-Series firewall and navigate to Device >
Licenses.
7. Click Manually Upload License link and enter the license key.
When the capacity license is activated on the firewall, a reboot
occurs.
8. Log in to the device and confirm that the Dashboard displays a
valid serial number and that the PA-VM license displays in the
Device > Licenses tab.
Activate the License

VM-Series Deployment Guide 9
About the VM-Series Firewall License the VM-Series Firewall
Registered the auth-code to the support account. If you don’t register the auth-code, the licensing server
will fail to create a license.
Configured the VMware Service Manager and entered this auth-code on Panorama. On Panorama, select
VMWare Service Manager to add the Authorization Code.
In order to activate the licenses, complete the following tasks:
Verify that the VM-Series firewalls that you just deployed, display as Managed Devices and are connected to
Panorama.
Select Panorama > Device Deployment > Licenses and click Refresh. Select the VM-Series firewalls for which
to retrieve subscription licenses and click OK.
Panorama will apply the licenses to each firewall that has been deployed with the matching auth-code.
Upgrade the PAN-OS Software Version
Now that the VM-Series firewall has network connectivity and the base PAN-OS software is installed, consider
upgrading to the latest version of PAN-OS.
Upgrade the VM-Series Model
The licensing process for the VM-Series firewall uses the UUID and the CPU ID to generate a unique serial
number for each VM-Series firewall. Hence, when you generate a license, the license is mapped to a specific
instance of the VM-Series firewall and cannot be modified.
In order to apply a new capacity license to a firewall that has been previously licensed, you need to clone the
existing (fully configured) VM-Series firewall. During the cloning process, the firewall is assigned a unique
UUID, and you can therefore apply a new license to the cloned instance of the firewall.
Use the instructions in this section, if you are:
If you have purchased an evaluation auth-code, you can license up to 5 VM-Series firewalls with
the VM-1000-HV capacity license for a period of 30 or 60 days. Because this solution allows you
to deploy one VM-Series firewall per ESXi host, the ESXi cluster can include a maximum of 5
ESXi hosts when using an evaluation license.
Upgrade PAN-OS Version
1. From the web interface, navigate to Device > Licenses and make sure you have the correct VM-Series firewall license
and that the license is activated.
On the VM-Series firewall standalone version, navigate to Device > Support and make sure that you have activated
the support license.
2. To upgrade the VM-Series firewall PAN-OS software, select Device > Software.
3. Click Refresh to view the latest software release and also review the Release Notes to view a description of the
changes in a release and to view the migration path to install the software.
4. Click Download to retrieve the software then click Install.

10 VM-Series Deployment Guide
License the VM-Series Firewall About the VM-Series Firewall
Migrating from an evaluation license to a production license.
Upgrading the model to allow for increased capacity. For example you want to upgrade from the VM-200 to
the VM-1000-HV license.
Migrate the License on the VM-Series Firewall
Step 1 Power off the VM-Series firewall.
Step 2 Clone the VM-Series firewall. If you are manually cloning, when prompted indicate that you are
copying and not moving the firewall.
Step 3 Power on the new instance of the
VM-Series firewall.
1. Launch the serial console of the firewall on the vSphere/SDX
web interface and enter the following command:
show system info
2. Verify that:
• the serial number is unknown
• the firewall has no licenses
• the configuration is intact
Step 4 Register the new auth-code on the
support portal.
See Register the VM-Series Firewall.
Step 5 Apply the new license. See Activate the License.
After you successfully license the new firewall, delete the previous
instance of the firewall to prevent conflict in configuration or IP
address assignments.

VM-Series Deployment Guide 11
About the VM-Series Firewall Monitor Changes in the Virtual Environment
Monitor Changes in the Virtual Environment
In a legacy client-server architecture with physical infrastructure resources, security administrators controlled
the deployment of servers on the network, and had visibility over the applications that traversed the network;
security policies were based on static IP addresses. By nature, the network architecture was static and inflexible,
and therefore unable to meet the scale and performance needs that emerged with growth.
To mitigate the challenges of scale, lack of flexibility and performance, server virtualization technology was
globally adopted. Virtual networks allow for servers and applications to be provisioned, changed, and deleted
on demand. This agility poses a challenge for security administrators because they have little visibility into the
IP addresses of the dynamically provisioned servers and the plethora of applications that can be enabled on
these virtual resources.
In order to protect the network resources and safely enable applications, the VM-Series firewall provides an
automated way to gather information on the virtual machine (or guest) inventory on each monitored source and
create policy objects that stay in sync with the dynamic changes on the network. This capability is provided by
the coordination between the VM Information Sources and Dynamic Address Groups features on the firewall.
The following tasks are applicable to the VM-Series firewall deployed on a VMware ESXi server or on the Citrix
SDX server.
Enable VM Monitoring to Track Changes on the Virtual Network
Use Dynamic Address Groups in Policy
Attributes Monitored on a VMware Source
Enable VM Monitoring to Track Changes on the Virtual Network
VM Information sources provides an automated way to gather information on the Virtual Machine (VM)
inventory on each monitored source (host); the sources that the firewall can monitor include VMware ESXi and
vCenter Server. As new virtual machines (guests) are deployed, the firewall monitors 16 metadata elements in
the VMware environment and collects the list of tags assigned to each guest; these tags can then be used to
define Dynamic Address Groups (see Use Dynamic Address Groups in Policy) and matched against in policy.
The firewall can monitor the VMware vCenter server and/or an ESX(i) server version 4.1 or 5.0, and poll for
information on IP address and tags on newly provisioned VMs, or on VMs that have been updated or moved
on the network. Up to 10 VM information sources can be configured on the firewall. By default, the traffic
between the firewall and the monitored sources uses the management (MGT) port on the firewall.
The VM-Series NSX edition firewall, which is jointly developed by Palo Alto Networks and VMware, is designed for
automated provisioning and distribution of Palo Alto Networks next-generation security services and the delivery of
dynamic context-based security policies using Panorama. For information on how the VM-Series NSX edition firewall
meets the security challenges on the virtual network, see Set Up a VM-Series NSX Edition Firewall.
VM Information Sources offers easy configuration and enables you to monitor a predefined
set of 16 metadata elements or attributes in the VMware environment. See Attributes Monitored
on a VMware Source for the list.
If you can use the set of attributes that the firewall monitors (and do not need a customized set
of attributes), use the VM Information Sources on the firewall to enable VM monitoring, in lieu of
using external scripts and the XML API on the firewall.

12 VM-Series Deployment Guide
Monitor Changes in the Virtual Environment About the VM-Series Firewall
Set up the VM Monitoring Agent
Step 1 Enable the VM Monitoring Agent.
Up to 10 sources can be
configured for each firewall, or for
each virtual system on a multiple
virtual systems capable firewall.
If your firewalls are configured in a high
availability configuration:
• An active/passive setup, only the active
firewall monitors the VM sources.
• An active/active setup, only the
firewall with the priority value of
primary monitors the VM sources.
1. Select Device > VM Information Sources.
2. Click Add and enter the following information:
• AName to identify the VMware ESX(i) or vCenter server
that you want to monitor.
• Enter the Host information for the server—hostname or IP
address and the Port on which it is listening.
• Select the Type to indicate whether the source is a VMware
ESX(i) server or a VMware vCenter server.
• Add the credentials (Username and Password) to
authenticate to the server specified above.
• Use the credentials of an administrative user to enable access.
• (Optional) Modify the Update interval to a value between
5-600 seconds. By default, the firewall polls every 5 seconds.
The API calls are queued and retrieved within every 60
seconds, so updates may take up to 60 seconds plus the
configured polling interval.
• (Optional) Enter the interval in hours when the connection
to the monitored source is closed, if the host does not
respond. (default: 2 hours, range 2-10 hours)
To change the default value, select the check box to Enable
timeout when the source is disconnected and specify the
value. When the specified limit is reached or if the host
cannot be accessed or does not respond, the firewall will
close the connection to the source.
• Click OK, and Commit the changes.
• Verify that the connection Status displays as connected.

VM-Series Deployment Guide 13
About the VM-Series Firewall Monitor Changes in the Virtual Environment
Use Dynamic Address Groups in Policy
Dynamic address groups allow you to create policy that automatically adapts to changes—adds, moves, or
deletions of servers. It also enables the flexibility to apply different rules to the same server based on its role on
the network or the different kinds of traffic it processes.
Each metadata element or attribute that the firewall tracks in the VMware environment can be tagged with a
value. A dynamic address group uses the tag(s) as a filtering criteria, and matches on the tags(s) to determine its
members. The filter uses a logical and and or operators. Therefore, multiple tags can be applied to each guest to
represent virtual machine attributes such as IP address, operating system, the virtual switch to which it belongs,
for example.
Tags can be defined statically on the firewall and/or registered (dynamically) to the firewall. All entities that have
the tags and match the defined criteria become members of the dynamic group. The difference between static
and dynamic tags is that static tags are part of the configuration on the firewall, and dynamic tags are part of the
runtime configuration. This implies that a commit is not required to update dynamic tags; the tags must however
be used in policy and the policy must be committed on the device.
The IP address and associated tags for an entity can be dynamically registered on the firewall using the XML API
or the VM Monitoring agent on the firewall; each registered IP address can have up to 32 tags. Within 60 seconds
of the API call, the firewall registers the IP address and associated tags, and automatically updates the
membership information for the dynamic address group(s). Because the members of a dynamic address group
are automatically updated, using dynamic address groups in lieu of static address objects, allows you to adapt to
changes in your environment without relying on a system administrator to make policy changes and committing
them on the firewall.
Use the following table to verify the maximum number of IP addresses that can be registered for each model of
firewall:
Step 2 Verify the connection status. Verify that the connection Status displays as connected.
If the connection status is pending or disconnected, verify that the
source is operational and that the firewall is able to access the source.
If you use a port other than the MGT port for communicating with
the monitored source, you must change the service route (Device >
Setup > Services, click the Service Route Configuration link and
modify the Source Interface for the VM Monitor service).
Platform Maximum number of dynamically registered IP addresses
PA-7050, PA-5060, VM-1000 100,000
PA-5050 50,000
PA-5020 25,000
Set up the VM Monitoring Agent (Continued)

14 VM-Series Deployment Guide
Monitor Changes in the Virtual Environment About the VM-Series Firewall
The following example shows how dynamic address groups can simplify network security enforcement. The
example workflow shows how to:
Enable the VM Monitoring agent on the firewall, to monitor the VMware ESX(i) host or vCenter Server and
register VM IP addresses and the associated tags.
Create dynamic address groups and define the tags to filter. In this example, two address groups are created.
One that only filters for dynamic tags and another that filters for both static and dynamic tags to populate
the members of the group.
Validate that the members of the dynamic address group are populated on the firewall.
Use dynamic address groups in policy. This example uses two different security policies:
– A security policy for all Linux servers that are deployed as FTP servers; this rule matches on
dynamically registered tags.
– A security policy for all Linux servers that are deployed as web servers; this rule matches on a dynamic
address group that uses static and dynamic tags.
Validate that the members of the dynamic address groups are updated as new FTP or web servers are
deployed. This ensure that the security rules are enforced on these new virtual machines too.
PA-4000 Series, PA-3000 Series 5000
PA-2000 Series, PA-500, PA-200, VM-300, VM-200,
VM-100
1000
Use Dynamic Address Groups in Policy
Step 1 Enable VM Source Monitoring. See Enable VM Monitoring to Track Changes on the Virtual
Network.
Platform Maximum number of dynamically registered IP addresses

VM-Series Deployment Guide 15
About the VM-Series Firewall Monitor Changes in the Virtual Environment
Step 2 Create dynamic address groups on the
firewall.
View the tutorial to see a big
picture view of the feature.
1. Log in to the web interface of the firewall.
2. Select Object > Address Groups.
3. Click Add and enter a Name and a Description for the address
group.
4. Select Type as Dynamic.
5. Define the match criteria. You can select dynamic and static tags
as the match criteria to populate the members of the group.
Click Add Match Criteria, and select the And or Or operator and
select the attributes that you would like to filter for or match
against. and then click OK.
6. Click Commit.
The match criteria for each dynamic address group in this example is as follows:
ftp_server: matches on the guest operating system “Linux 64-bit” and annotated as “ftp” ('guestos.Ubuntu Linux 64-bit'
and 'annotation.ftp').
web-servers: matches on two criteria—the tag black or if the guest operating system is Linux 64-bit and the name of the
server us Web_server_Corp. ('guestos.Ubuntu Linux 64-bit' and 'vmname.WebServer_Corp' or 'black')
Step 3 Use dynamic address groups in policy.
View the tutorial.
1. Select Policies > Security.
2. Click Add and enter a Name and a Description for the policy.
3. Add the Source Zone to specify the zone from which the traffic
originates.
4. Add the Destination Zone at which the traffic is terminating.
5. For the Destination Address, select the Dynamic address group
you created in Step 2 above.
6. Specify the action— Allow or Deny—for the traffic, and
optionally attach the default security profiles to the rule.
7. Repeats Steps 1 through 6 above to create another policy rule.
8. Click Commit.
Use Dynamic Address Groups in Policy (Continued)

16 VM-Series Deployment Guide
Monitor Changes in the Virtual Environment About the VM-Series Firewall
This example shows how to create two policies: one for all access to FTP servers and the other for access to web servers.
Step 4 Validate that the members of the dynamic
address group are populated on the
firewall.
1. Select Policies > Security, and select the rule.
2. Select the drop-down arrow next to the address group link, and
select Inspect. You can also verify that the match criteria is
accurate.
3. Click the more link and verify that the list of registered IP
addresses is displayed.
Policy will be enforced for all IP addresses that belong to
this address group, and are displayed here.
Use Dynamic Address Groups in Policy (Continued)