VM-Series
Deployment
Guide
11
Set Up a VM-Series Firewall on an ESXi Server
System Requirements and Limitations
System Requirements and Limitations
This section lists requirements and limitations for the VM-Series firewall on VMware vSphere Hypervisor
(ESXi). To deploy the VM-Series firewall, see
Install a VM-Series firewall on VMware vSphere Hypervisor
(ESXi)
.
Requirements
Limitations
Requirements
You can create and deploy multiple instances of the VM-Series firewall on an ESXi server. Because each instance
of the firewall requires a minimum resource allocation—number of CPUs, memory and disk space—on the
ESXi server, make sure to conform to the specifications below to ensure optimal performance.
The VM-Series firewall has the following requirements:
VMware ESXi with vSphere 5.0, 5.1, and 5.5 for VM-Series running PAN-OS 6.0.
Minimum of two vCPUs per VM-Series firewall. One for the management plane and one for the dataplane.
You can assign 2 or 6 additional vCPUs to allocate a total of 2, 4 or 8 vCPUs to the firewall; the management
plane only uses one vCPU and any additional vCPUs are assigned to the dataplane.
Minimum of two network interfaces (vmNICs). One will be a dedicated vmNIC for the management
interface and one for the data interface. You can then add up to eight more vmNICs for data traffic. For
additional interfaces, use VLAN Guest Tagging (VGT) on the ESXi server or configure subinterfaces on the
firewall.
If you are deploying the VM-Series firewall using layer 2, virtual wire, or tap interfaces you must enable
promiscuous mode on the port group of the virtual switch to which the data interfaces on the firewall are
attached. If promiscuous mode is not enabled, the firewall will not receive any traffic because the destination
MAC addresses assigned by PAN-OS will be different from the vmNIC MAC addresses assigned by
vSphere. By default, vSphere will not forward a frame to a virtual machine if the destination MAC address
of the frame does not match the vmNIC MAC address.
If you are deploying the VM-Series firewall using layer 3 interfaces, you can instead set the vmNIC MAC
address to match the PAN-OS MAC address by manually editing the MAC address for each vmNIC in
vSphere to match what is assigned on the VM-Series firewall. This change must be done while the VM-Series
is powered off; it allows the firewall to receive frames that are meant for it.
Minimum of 4GB of memory for all models except the VM-1000-HV, which needs 5GB. Any additional
memory will be used by the management plane only. If you are applying the VM-1000-HV license, see
How
do I modify the base image file for the VM-1000-HV license?
Minimum of 40GB of virtual disk space. You can add additional disk space of 40GB to 2TB for logging
purposes.
