VM-Series Plugin

Table of Contents

VM-Series Performance and Capacity on Private Clouds

Custom PAN-OS Metrics Published for Monitoring

VM-Series Plugin

The VM-Series plugin enables Palo Alto Networks to release cloud provider integrations or hypervisor integrations without upgrading PAN-OS.

Where Can I Use This?	What Do I Need?
VM-Series deployment	VM-Series 10.x or above Panorama running PAN-OS 10.1.x or above versions Customer Support Portal (CSP) account with one of the following user roles: Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User. Superuser access to the VM-Series firewall

Where Can I Use This?

What Do I Need?

VM-Series deployment

VM-Series 10.x or above
Panorama running PAN-OS 10.1.x or above versions
Customer Support Portal (CSP) account with one of the following user roles:
- Superuser, Standard User, Limited User, Threat Researcher, AutoFocus Trial Role, Group superuser, Group Standard User, Group Limited User, Group Threat Researcher, Authorized Support Center (ASC) User, and ASC Full Service User.
- Superuser access to the VM-Series firewall

The VM-Series firewalls include the VM-Series plugin, a built-in plugin architecture for integration with public cloud providers or private cloud hypervisors. The VM-Series plugin can be manually upgraded independent of PAN-OS, enabling Palo Alto Networks® to accelerate the release of new features, fixes, or integrations with new cloud providers or hypervisors.

The VM-Series plugin enables you to manage cloud-specific interactions between the VM-Series firewalls and the supported public cloud platforms—AWS, GCP, and Azure. The plugin enables publishing custom metrics to cloud monitoring services (such as AWS CloudWatch), bootstrapping, configuring user credential provisioning information from public cloud environments, and seamless updates for cloud libraries or agents on PAN-OS.

The VM-Series plugin does not manage capabilities that are common to both VM-Series firewalls and hardware-based firewalls. For example, VM Monitoring is not part of the VM-Series plugin because it is a core PAN-OS feature that helps you enforce policy consistently on your virtual machine workloads from both VM-Series firewalls and hardware-based firewalls.

The VM-Series plugin does not manage Panorama plugins. For the difference between the VM-Series plugin and Panorama plugins, see VM-Series Plugin and Panorama Plugins.

The VM-Series plugin is a built-in component that can be upgraded or downgraded, but not removed. Each PAN-OS release includes a specific VM-Series plugin version that corresponds to the PAN-OS software version. When you downgrade to an earlier PAN-OS software version, the plugin version is downgraded to the version compatible with the PAN-OS version. You can upgrade or downgrade the VM-Series plugin locally on the virtual firewall, or manage the plugin version centrally from Panorama.

To enable Panorama to manage the VM-Series plugin version itself, or cloud-specific metrics publishing your managed firewalls, you must manually install the VM-Series plugin on Panorama as described in Panorama Plugins.

Configure the VM-Series Plugin on the Firewall

Select DeviceVM-Series to configure the plugin integration for the cloud provider on which this instance of the VM-Series firewall is deployed.

If your firewall is deployed on a hypervisor or cloud without a public interface (for example, VM-Series ESXi), the tab is named VM-Series and displays a general message.

Upgrade the VM-Series Plugin

When a plugin update is released independent of PAN-OS, you can independently upgrade the plugin version from your VM-Series firewall (like software or content updates) or from a bootstrap file.

Each plugin version provides PAN-OS compatibility information and includes new features or bug fixes for one or more cloud environments.

Before upgrading, check the latest Release Notes for details on whether a new VM-Series plugin affects your environment.

For example, suppose a new VM-Series plugin version only includes AWS features. To take advantage of the new features, you must update the plugin on your VM-Series firewall instances on AWS.

Do not install an upgrade that does not apply to your environment.

VM-Series 3.0.0 Plugin is supported only in PAN-OS 10.2.0.
Log in to the VM-Series firewall and check the dashboard to view the plugin version.
Select PanoramaPlugins

and type vm_series in the search field.

Select Check Now to view the available versions.
Choose a VM-Series plugin version and click Download.
When the download finishes, click Install in the Actions column.

The firewall automatically uninstalls the previously installed version of the plugin.
View the Dashboard to verify that the plugin upgraded successfully.