VM-Series Deployment Guide
    : Create a Custom VM-Series Image for Azure
    Focus
    Download PDF
    Focus
    1. Home
    2. VM-Series
    3. VM-Series Deployment Guide
    4. Set up the VM-Series Firewall on Azure
    5. Create a Custom VM-Series Image for Azure
    Download PDF

    VM-Series Deployment Guide

    Create a Custom VM-Series Image for Azure

    Table of Contents
    End-of-Life (EoL)

    Create a Custom VM-Series Image for Azure

    You can create a custom VM-Series firewall image for later use in your Azure deployment. A custom image gives you the flexibility and consistency to deploy the VM-Series firewall with the PAN-OS version you want to use instead of being restricted to using only an image available though the Azure marketplace. Additionally, your custom image can include the latest content and antivirus updates.
    Creating a custom image requires that you remove all private data—user configuration, users, plugin configuration, etc—before creating the VHD. Additionally, Complete the following procedure to prepare and create a custom image.
    If the VM-Series firewall used to create your custom image was deployed using a premium disk type, any VM-Series firewall deployed using the custom image must be deployed using the same premium disk type. However, if you create an image using firewall deployed with a standard disk type, you can deploy the firewall using a standard or premium disk type.
    1. Log in to Azure.
    2. Deploy the VM-Series firewall from the Azure Marketplace.
    3. (BYOL license only) Activate your license.
    4. Upgrade the VM-Series Firewall to PAN-OS 10.0.3. Upgrading to PAN-OS 10.0.3 also upgrades the VM-Series plugin to 2.0.3.
    5. Access the VM-Series firewall command line interface via SSH using the username and password provided in the Azure Marketplace template.
    6. Verify that you VM-Series firewall has the correct PAN-OS, VM-Series plugin, content, and antivirus versions.
      show system info
    7. ( BYOL license only) Deactivate your license.
    8. Perform a private data reset on the VM-Series firewall. This command requires the firewall to reboot. You must wait for the VM-Series firewall to reboot complete before continuing; the reboot can take five to seven minutes.
      request system private-data-reset
    9. Create a new VHD image from the VM-Series instance.
      1. Log in to the Azure CLI.
      2. Verify that you are using the correct subscription.
        az account set --subscription <subscription-id>
      3. Execute the following commands to generalize the VM, allowing it to be imaged for multiple deployments, and create the new VHD.
        az vm deallocate --resource-group <myResourceGroup> --name <myVM>
        az vm generalize --resource-group <myResourceGroup> --name <myVM>
    10. Create a new VM-Series firewall from your custom image.
      az image create --resource-group <myResourceGroup> --name <myImage> --source <resource-id-of-VM>
    11. After deploying a VM-Series firewall with your custom image, verify your deployment.
      1. You should log in to the firewall using the credentials you used previously.
      2. After logging in successfully, verify that your firewall is running the correct PAN-OS version and has the correct content and antivirus versions.
        show system info
    12. ( Optional) Copy the custom image to another region.
      az image copy –source-resource-group <source-rg> –source-object-name <pa-vm-image-name> –target-location <target-region> –target-resource-group <destination-rg>

    © 2024 Palo Alto Networks, Inc. All rights reserved.