Focus

VM-Series Deployment Guide

Plan Your Cisco ENCS Deployment

Table of Contents

Plan Your Cisco ENCS Deployment

Ensure the Cisco ENCS environment can support the VM-Series firewall.

In your Cisco SD-Branch, deploy the VM-Series Firewall on the Cisco ENCS appliance as a VNF that provides next generation firewall capabilities to secure your applications and users at the branch office. You can deploy the firewall in a virtual wire, Layer 2, or Layer 3 deployment, and in high availability configuration.

To manage the VM-Series firewall, the Panorama appliance can be deployed on premises or in the cloud. The following topology shows the VM-Series firewall at the branch edge.

Cisco ENCS Requirements

For supported NFVIS versions and hardware platforms, see the Palo Alto Networks Compatibility Matrix.

In NFVIS, set up networks and bridges.
- Create virtual NICs and attach them to a virtual bridge so the ENCS appliance can steer traffic through the VM-Series firewall.
  On the Cisco ENCS appliance, the VM-Series firewall supports up to 8 dataplane interfaces.
  
  The dataplane interfaces of the VM-Series firewall on Cisco ENCS support Virtio mode only; ENCS SR-IOV and PCI passthrough modes are not supported.
- Set up network connections for VM-Series firewall management access. If you are using Panorama, ensure that Panorama has network access to manage the firewall you deploy.
Python 2.7. Required on your local machine if you are using the command line to convert.

VM-Series Firewall and Panorama Requirements

VM-Series Firewall—The VM-50 and VM-100 are recommended. The VM-300, VM-500, and VM-700 are also supported, provided the ENCS hardware has sufficient resources that can be assigned to the VM-Series firewall. Consult the VM-Series System Requirements to ensure that the Cisco ENCS appliance has adequate resources to support the VM-Series model you choose.
- qcow2 file (the PAN-OS for VM-Series KVM base image) for PAN-OS 9.1 or later. See Convert a qcow2 File from the Graphical User Interface, Step 2 or Convert a qcow2 File from the Command Line Interface, Step 2.
- VM-Series firewall capacity license and subscription auth codes that meet your requirements. See VM-Series Model License Types. You enter auth codes in the NFVIS user interface, or include the auth codes in the authcodes text file in the conversion folder as described in Convert a qcow2 File from the Command Line Interface, Step 4.
- With PAN-OS 9.1, the VM-Series firewall on Cisco ENCS supports Virtio with DPDK mode enabled by default.
Panorama hardware or virtual appliance. While you can deploy a single VM-Series firewall in a Cisco SD-Branch network, it is more common to deploy firewalls in many branches and centrally manage them with Panorama.
- Panorama version 9.1 or later. The version must be the same or higher than the version on your VM-Series firewall.
- A VM auth key generated on Panorama. This key allows the VM-Series firewall to authenticate with Panorama.

Set Up a VM-Series Firewall on a Cisco ENCS Network

Prepare the VM-Series Firewall Image for Cisco ENCS