Focus

CN-Series

PAN-OS 11.1

Table of Contents

PAN-OS 11.1 supported environments.

You can deploy the CN-Series firewall in the following environments:

Product	Version
Container runtime	Docker CRI-O Containerd
Kubernetes version	1.17 through 1.31
Cloud provider managed Kubernetes	AWS EKS (1.17 through 1.31 for CN-Series as a daemonset and CN-Series as a Service mode of deployment. ) AWS EKS (1.17 through 1.31 for CN-Series as a CNF mode of deployment.) EKS on AWS Outpost (1.17 through 1.31) CN-Series for EKS on AWS Outpost does not support SR-IOV or Multus. Azure AKS (1.17 through 1.31) In Azure AKS, PAN-OS 11.0.2 is the minimum required version to support kubernetes 1.25 and above. GCP GKE (1.17 through 1.31) Includes GKE Dataplane V2. OCI OKE (1.23)
Customer managed Kubernetes	On the public cloud or on-premise data center. Make sure that the Kubernetes version, CNI Types, and Host VM OS versions are as listed in this table. VMware TKG+ version 1.1.2 Infrastructure Platform—vSphere 7.0 Kubernetes Host VM OS—Photon OS
Kubernetes Host VM	Operating System: Ubuntu 16.04 Ubuntu 18.04 Ubuntu 22.04 RHEL/Centos 7.3 and later CoreOS 21XX, 22XX Container-Optimized OS
	Linux Kernel Version: 4.18 or later (K8s Service Mode only) 5.4 or later required to enable AF_XDP mode. See Editable Parameters in CN-Series Deployment YAML Files for more information.
	Linux Kernel Netfilter: Iptables
CNI Plugins	CNI Spec 0.3 and later: AWS-VPC Azure Calico Flannel Weave For Openshift, OpenshiftSDN, OVN Kubernetes The following are supported on the CN-Series firewall as a DaemonSet. Multus Bridge SR-IOV Macvlan
OpenShift	Version 4.2, 4.4, 4.5, 4.6, 4.7, 4.8, 4.9, 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, and 4.16. OpenShift 4.7 is qualified on the CN-Series as a DaemonSet only. The PAN-OS 11.0.2 is the minimum required version to support 4.12 and above. OpenShift on AWS

Also review the CN-Series System Requirements, before you Deploy the cn-series firewall.

© 2025 Palo Alto Networks, Inc. All rights reserved.