VM-Series Firewall Deployment

Tech Note
PAN-OS 5.0

Revision A

2012, Palo Alto Networks, Inc. www.paloaltonetworks.com

Contents
Overview ................................................................................................................................................................................. 3
Supported Topologies .............................................................................................................................................................. 3
Prerequisites ............................................................................................................................................................................. 4
Licensing .................................................................................................................................................................................. 5
Basic Installation Procedure ..................................................................................................................................................... 5
1.
2.
3.
4.
5.

Grab the Bits ................................................................................................................................................................. 6

Prep the Network in vSphere ........................................................................................................................................ 6
Template Deployment ................................................................................................................................................... 8
Initial VM-Series Firewall Configuration .................................................................................................................... 12
Verify Configuration and Upgrade Software ............................................................................................................... 14

Use Case Configuration Example .......................................................................................................................................... 15

Use Case Assumptions ........................................................................................................................................................ 16
vSphere Network Configuration ........................................................................................................................................ 16
Virtual Standard Switch Setup ........................................................................................................................................ 16
Virtual Distributed Switch Setup .................................................................................................................................... 18
Server Virtual Machine Configuration ............................................................................................................................ 21
VM-Series Configuration ................................................................................................................................................ 22
Testing the Use Case .......................................................................................................................................................... 24
Conclusion ............................................................................................................................................................................. 26

2012, Palo Alto Networks, Inc.

[2]

Overview
The VM-Series firewall is a virtual instance of PAN-OS. It is positioned for use in a virtualized data center environment and
is particularly well suited for private and public cloud deployments. The VM-Series can be quickly deployed in a virtual
environment as needed without any physical access to the hardware. This document covers how to prepare for and deploy a
VM-Series instance.
This TechNote assumes prior knowledge of VMware and vSphere including vSphere networking, ESXi host setup and
configuration, and virtual machine guest deployment.
Running Pan-OS as a virtual machine opens up many architectural possibilities. We expect the most common use cases for
the VM-Series to include the list below.

Supported Topologies
One VM-Series firewall per ESXi host
This model calls for a VM-Series firewall for every ESXi host. It has manageable scalability and it is easy to budget
resources. Every VM server on the ESXi host passes through the firewall before exiting the host for the physical network.
VM servers attach to the firewall via virtual standard switches. The guest servers have no other network connectivity and
therefore the firewall has visibility and control to all traffic leaving the ESXi host. One variation of this use case is to also
require all traffic to flow through the firewall even server to server on the same ESXi host.

One VM-Series firewall per Virtual Distributed Switch

This model calls for a VM-Series firewall for every virtual distributed switch. All VMs attach to a virtual distributed switch
and must use the firewall to talk to any other network. There is no other physical or virtual path to any other network so
the firewall has visibility and control to all traffic leaving the virtual distributed switch.

2012, Palo Alto Networks, Inc.

[3]

One VM-Series firewall per vApp Bundle

In this model, virtual systems are bundled together into a vApp that includes the VM-Series firewall. Data is unrestricted
within the vApp but any traffic that leaves the vApp for another vApp or for an external network must flow through the
firewall.

Hybrid Environment
In this model, both physical and virtual hosts are used. The VM-Series firewall would be deployed in a traditional
aggregation location in place of a physical firewall appliance to achieve the benefits of a common server platform for all
devices and to unlink hardware and software upgrade dependencies.

It is possible to combine two or more use cases into a single solution. Later in this TechNote, I cover a sample topology that
contemplates many of these use cases in a single, lab environment.

Prerequisites
The VM-Series firewall requires VMware ESXi running vSphere 4.1 or 5.0. Each instance of the firewall requires a
minimum of two vCPUs, one for the management plane and one for the data plane. The VM-Series firewall can optionally
scale to four or eight vCPUs with one always used for the management place and the remaining vCPUs allocated to the data
plane.
The VM-Series firewall uses a minimum of two virtual network interfaces cards (vmNICs) one for the management
interface and one for a data port. The firewall can support up to ten vmNICs. This is a VMware limitation and not a
firewall limitation. One of the ten NICs is required for the management port and leaving nine NICs for data. Subinterfaces
are supported so scalability isnt a concern. If a VMNIC is added to a VM-Series instance that is already running, the VMSeries firewall will not recognize the new interface and it must be rebooted. For this reason, you should always add
interfaces before they are required to avoid the need for a maintenance window. Also, all virtual port groups must be in
promiscuous mode.
2012, Palo Alto Networks, Inc.

[4]

The VM-Series firewall requires a minimum of 40GB of virtual disk. Up to 2TB of primary disk can be used. Additionally,
a second drive can be optionally added to the firewall for logging. The firewall requires a minimum of 4 GB of memory.
The firewall will use any additionally allocated memory but only for the management plane.

Licensing
Before a VM-Series firewall is licensed, it will have no serial number, it will have non-unique data plane interface MAC
addresses and will support only a minimal number of sessions. After the VM-Series firewall is licensed, it will be assigned a
unique serial number and will receive unique MAC addresses. Because the MAC addresses are not unique prior to licensing,
it is possible to have overlapping MAC addresses and it is not recommended to have multiple, unlicensed VM-Series
firewalls.
There are currently two types of licensing models supported for the VM-Series. The first is a standard license that ties a
unique authcode to each firewall. This authcode will result in the firewall getting a unique serial number and unique dataplane MAC addresses.
The other license model is a bulk model that provides one authcode that can be applied to up to fifty VM-Series firewalls.
The authcode is applied as above but is reusable up to fifty times.
Applying the authcode will raise the session limit and other limits based on the VM-Series SKU:

Model

Sessions

Rules

Security
Zones

Address
Objects

IPSec VPN
Tunnels

SSL VPN
Tunnels

VM-100

50,000

250

10

2,500

25

25

VM-200

100,000

2,000

20

4,000

500

200

VM-300

250,000

5,000

40

10,000

1,000

500

The authcode is tied to the Universally Unique ID (UUID). If the firewall is cloned, the UUID will change and the license
will become invalid. Moving the firewall from one host to another will not change the UUID (only the CPUID) and
therefore the license will remain valid.
All other authcodes (for support, threat, wildfire etc.) are applied after the initial version authcode is applied. This is the
same process as for other PAN-OS firewalls.

Basic Installation Procedure

The high level process for deploying the VM-Series firewall is:
1. Download the OVF template
2. Prep the Network in vSphere
3. Deploy the OVF template and power on the virtual machine
4. Configure the management interface via the vSphere console
5. Finish the setup via the web GUI or CLI including software upgrade
Note: Most of the steps in the procedure below can be automated. In a large, dynamic cloud data center, manual
deployment of a firewall is not reasonable and should be automated with a data center orchestration process. For examples
of how to use VMwares and Palo Alto Networks APIs to automated many of these steps, please refer to the Data Center
Automation with the VM-Series TechNote.

2012, Palo Alto Networks, Inc.

[5]

1. Grab the Bits

Initially, the VM-Series is installed from an OVF template. The Open Virtualization Format or OVF is an open format for
creating and deploying virtual machines. From the VMware website, http://www.vmware.com/technicalresources/virtualization-topics/virtual-appliances/ovf:
OVF enables efficient, flexible, and secure distribution of enterprise software, facilitating the mobility of virtual
machines and giving customers vendor and platform independence. Customers can deploy an OVF formatted virtual
machine on the virtualization platform of their choice.
After registering for the VM-Series, the customer will be given a download link. The OVF is downloaded as a zip archive
that is expanded into three files. The ovf extension is for the OVF descriptor file that contains all metadata about the
package and its contents. The mf extension is for the OVF manifest file that contains the SHA-1 digests of individual files in
the package. And the vmdk extension is for the virtual disk image file.
Note: the OVF will include a baseline version of PAN-OS and you will likely need to upgrade after the installation is
complete to get the latest features and functionality.

2. Prep the Network in vSphere

Before deploying the template, it is helpful to setup whatever virtual standard switches and virtual distributed switches you
will need for the VM-Series firewall. The firewall requires any attached port group to have promiscuous mode enabled to
function properly.
To access this setting for a virtual standard switch in vSphere Client, go to Home > Inventory > Hosts and Clusters. Then
click on the Configuration tab and under Hardware click on Networking. For each virtual switch that connects to a VMSeries firewall, click on Properties

Next, highlight the virtual switch or port group and click Edit Click the Security tab and set Promiscuous Mode to Accept.

2012, Palo Alto Networks, Inc.

[6]

If this is done for the virtual switch, this change will propagate to all Port Groups on the virtual switch.
For a virtual distributed switch, go to Home > Inventory > Networking. Highlight the Distributed Port Group in question
and select the Summary tab. Click on Edit Settings and select Policies > Security. Set Promiscuous Mode to Accept.

2012, Palo Alto Networks, Inc.

[7]

3. Template Deployment

To deploy the OVF template, log into vCenter (or directly into the target ESXi host if needed) using the vSphere Client.
From the vSphere client, select File > Deploy OVF Template

Browse to the OVF template that you downloaded previously and click Next.

Review the Template Details and click Next.

2012, Palo Alto Networks, Inc.

[8]

Give the new VM-Series a name. Select a Data Center and folder and click Next.

Select an ESXi host for the new VM-Series firewall and click Next

2012, Palo Alto Networks, Inc.

[9]

Select the datastore to use for the new VM and click Next.

Leave the default settings for datastore provisioning and click Next.

2012, Palo Alto Networks, Inc.

[10]

Select the port groups to use for the two initial VMNICs. The first VMNIC will be used for the VM-Series management
interface. Make sure the first Source Network is mapped to the Destination network used for management traffic. Click
Next.

Review the settings. Then click on Power on after deployment and Finish.

2012, Palo Alto Networks, Inc.

[11]

Monitor the Recent Tasks list for progress of the new deployment. When it is complete, click on the VM and click the
Summary tab to review the current status.

4. Initial VM-Series Firewall Configuration

Initially, the VM-Series firewall will have a management IP address of 192.168.1.1 like other default PAN-OS
configurations. In a VMware environment, the easiest way to edit this is via the vSphere console. From the summary tab
under Commands click Open Console or right click on the VM and select Open Console.

2012, Palo Alto Networks, Inc.

[12]

Login with the default username/password, admin/admin. Go into configuration mode and setup the management IP
address, netmask, default gateway and optionally DNS server(s).

Verify correct routing.

2012, Palo Alto Networks, Inc.

[13]

5. Verify Configuration and Upgrade Software

Next, verify SSH access and copy over the latest downloaded PAN-OS version. For example, from the CLI:
admin@PA-VM> scp import software from [email protected]:bits/PanOS_vm-5.0.0-c102
Password:
PanOS_vm-5.0.0-c102
29.6MB/s
00:10

100%

296MB

PanOS_vm-5.0.0-c102 saved
admin@PA-VM>

To finish the upgrade, you will need to license the device first using the internal or external update server. Once that is
complete, load the imported PAN-OS version (shown here in the web GUI).

When the load is completed successfully, you we receive a confirmation message.

2012, Palo Alto Networks, Inc.

[14]

Reboot the firewall to finish the upgrade and verify the new version.

Use Case Configuration Example

In this next section, I show how to setup a VM-Series for a particular scenario using the instructions above. In this scenario,
the firewall will be used to secure all traffic coming into and leaving an ESXi host. All of the interfaces for the firewall used
to secure the host traffic will be layer-two interfaces.
In addition, there will be another VM-Series that is used as the gateway to the external, physical network. On this other
VM-Series all the interfaces will be layer-three interfaces. Below is a diagram showing the topology used in the lab for this
use case.

2012, Palo Alto Networks, Inc.

[15]

Use Case Assumptions

The following procedures are based on vSphere 5.0 with vCenter and three ESXi hosts. The VM-Series firewalls are already
created using the procedures above. Instructions for creating the server VMs are beyond the scope of this document and are
not included in this TechNote.

vSphere Network Configuration

Virtual Standard Switch Setup
Two types of virtual switches are used in this use case. There are for intra-ESXi host traffic and do not have physical NICs
attached. The virtual distributed switches are used for traffic between ESXi hosts and tie together layer-two and layer-three
firewalls.
For our use case, there are four virtual standard switches: two for ESXi3 and three for ESXi4. Functionally, one virtual
switch could be used for each host with multiple port groups for each customer but this is less secure and a single
configuration mistake would bridge segregated traffic.
To create a new virtual standard switch, log into vCenter and switch to the Hosts and Clusters view under Home >
Inventory > Hosts and Clusters. Make sure vSphere Standard Switch is selected on the top of the screen and select Add
Networking. Select Virtual Machine on the first screen and click Next.

2012, Palo Alto Networks, Inc.

[16]

Make sure no physical NICs are highlighted and click Next.

Give the initial port group a name, make sure the VLAN ID is 0, and click Next.

2012, Palo Alto Networks, Inc.

[17]

Review the summary page and click Finish.

Virtual Distributed Switch Setup

For ESXi host-to-host traffic, Virtual Distributed Switches are used. It is possible to use multiple virtual standard switches
but virtual distributed switches ensure common characteristics across multiple ESXi hosts. To create a virtual distributed
switch, go to the Networking view under Home > Inventory > Networking.
2012, Palo Alto Networks, Inc.

[18]

Under the Summary tab, select New vSphere Distributed Switch.

Keep the default choice of vSphere Distributed Switch Version: 5.0.0 and click Next.

This use case uses only one physical port per host but in production, at least two should be used for redundancy. Select the
quantity and click Next.

2012, Palo Alto Networks, Inc.

[19]

Select the hosts and NICs for the virtual distributed switch to use and click Next.

Review the summary and when ready, click Finish.

2012, Palo Alto Networks, Inc.

[20]

Server Virtual Machine Configuration

You will need to map the interfaces in vSphere to the correct virtual switches. From the Hosts and Clusters view or from the
VMs and Templates view, select the relevant VM and from the Summary tab, select Edit Settings. Then, select the Network
Adapter and under Network Connection, select the necessary label. Do this for each interface per the topology and add new
adapters as needed.

2012, Palo Alto Networks, Inc.

[21]

For each simulated server, setup the network interfaces and static routes in the operating system. Set the default gateway to
the IP address of the layer-three firewall.
warby@server-a1:~$ ifconfig eth1
eth1
Link encap:Ethernet HWaddr 00:50:56:a0:7c:89
inet addr:10.5.125.2 Bcast:10.5.125.7 Mask:255.255.255.248
inet6 addr: fe80::250:56ff:fea0:7c89/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:911916 errors:0 dropped:308 overruns:0 frame:0
TX packets:620204 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:971622659 (971.6 MB) TX bytes:290895163 (290.8 MB)
warby@server-a1:~$ netstat -rn | grep 'Gateway\|eth1'
Destination
Gateway
Genmask
Flags
0.0.0.0
10.5.125.1
0.0.0.0
UG
10.5.125.0
0.0.0.0
255.255.255.248 U

VM-Series Configuration

The two layer-two firewall configurations are very similar:

2012, Palo Alto Networks, Inc.

[22]

MSS Window
0 0
0 0

irtt Iface
0 eth1
0 eth1

The layer-three firewall has similar policies but more networking configuration due to the IP addressing.

2012, Palo Alto Networks, Inc.

[23]

Testing the Use Case

First, verify the severs can ping each other within a subnet and they can ping their gateway:
warby@server-a1:~$ ping -c 5 10.5.125.3

2012, Palo Alto Networks, Inc.

[24]

PING 10.5.125.3 (10.5.125.3) 56(84) bytes of data.

64 bytes from 10.5.125.3: icmp_req=1 ttl=64 time=3.17 ms
64 bytes from 10.5.125.3: icmp_req=2 ttl=64 time=0.244 ms
64 bytes from 10.5.125.3: icmp_req=3 ttl=64 time=0.229 ms
64 bytes from 10.5.125.3: icmp_req=4 ttl=64 time=0.223 ms
64 bytes from 10.5.125.3: icmp_req=5 ttl=64 time=0.265 ms
--- 10.5.125.3 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 3998ms
rtt min/avg/max/mdev = 0.223/0.826/3.171/1.172 ms
warby@server-a1:~$ ping -c 5 10.5.125.1
PING 10.5.125.1 (10.5.125.1) 56(84) bytes of data.
64 bytes from 10.5.125.1: icmp_req=1 ttl=64 time=18.0 ms
64 bytes from 10.5.125.1: icmp_req=2 ttl=64 time=0.494 ms
64 bytes from 10.5.125.1: icmp_req=3 ttl=64 time=0.493 ms
64 bytes from 10.5.125.1: icmp_req=4 ttl=64 time=0.527 ms
64 bytes from 10.5.125.1: icmp_req=5 ttl=64 time=0.516 ms
--- 10.5.125.1 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 3999ms
rtt min/avg/max/mdev = 0.493/4.013/18.039/7.013 ms
warby@server-a1:~$

There should be traffic on the layer-two firewall showing the successful pings:

Next, ping from the server to an external site and check the layer-three firewall log:
warby@server-a1:~$ ping -c 5 4.2.2.2
PING 4.2.2.2 (4.2.2.2) 56(84) bytes of data.
64 bytes from 4.2.2.2: icmp_req=1 ttl=55 time=3.47
64 bytes from 4.2.2.2: icmp_req=2 ttl=55 time=3.24
64 bytes from 4.2.2.2: icmp_req=3 ttl=55 time=3.48
64 bytes from 4.2.2.2: icmp_req=4 ttl=55 time=3.38
64 bytes from 4.2.2.2: icmp_req=5 ttl=55 time=3.45

ms
ms
ms
ms
ms

--- 4.2.2.2 ping statistics --5 packets transmitted, 5 received, 0% packet loss, time 4006ms
rtt min/avg/max/mdev = 3.246/3.409/3.488/0.088 ms
warby@server-a1:~$

2012, Palo Alto Networks, Inc.

[25]

Finally, verify isolation. In this example, server C1 attempts an SSH session to server B1:
warby@server-c1:~$ ssh [email protected]
ssh: connect to host 10.5.125.10 port 22: Operation timed out
warby@server-c1:~$

Conclusion
The VM-Series firewall has many characteristics in common with Palo Alto Networks appliance based firewalls including
common features and management interfaces. The main difference in production will be the deployment for VM-Series
firewalls in a virtualized environment. Once it is installed, the VM-Series can be used and managed in a manner similar to
other Palo Alto Networks products.

2012, Palo Alto Networks, Inc.

[26]