Deploy the Palo Alto Networks VM-Series Firewall on ZEDEDA

​

Introduction

The Palo Alto Networks VM-Series Next-Generation Firewall (NGFW) runs as a virtual machine on a ZEDEDA-managed node to enforce north-south and east-west traffic segmentation. When deployed on Edge Infrastructure Services, the firewall acts as a DHCP server for internal VLANs, a default gateway for OT/IT workloads, and a Zero Trust enforcement point, while ZEDEDA manages the application lifecycle. This article walks through deploying pan-os_vm-series_virtual_firewall_11.2.5 from My Library using the New Application wizard. No manual image download or upload is required.

​

Prerequisites

• Your node is onboarded to Edge Infrastructure Services and has a status of Ready under Nodes.
• The node runs a supported version of EVE-OS (Edge Virtualization Engine).
• Outbound HTTPS (port 443) connectivity is available from the node.
• You have the SysManager or SysAdmin role in your enterprise. See Manage Roles.
• You have access to the Palo Alto Networks Support Portal to register the VM-Series firewall after deployment.

​

Deploy the App

​

Add the App to Your Library

If you have not previously added the VM-Series firewall app to your library:

1. Go to Marketplace > Edge Apps in the navigation.
2. Search for pan-os.
3. Click the + button on the pan-os_vm-series_virtual_firewall_11.2.5 card to add it to your library.

​

Start the Deploy Wizard

1. Go to Marketplace > My Library in the navigation.
2. Search for pan-os.
3. Hover over the card and click the Deploy icon.
4. The New Application wizard opens.

​

App & Target

Click Next.

​

Interfaces

Under eth0, select the network instance to connect the app to from the dropdown. The dropdown lists available network instances on the selected node. If no suitable network instance exists, click + to create a new virtual network. Click Next.

​

Features

Leave the default settings or adjust as needed:

• Start Delay (seconds): Enter a value if the app should wait before starting. The default is 0.
• Disable vTPM: Leave this disabled unless your deployment requires vTPM to be off.
• VMM Overhead: Leave this disabled unless your deployment requires additional hypervisor memory overhead.
• Enable Logs: Keep this enabled to view app logs in Edge Infrastructure Services.
• Tags: Add key:value tags to label this app instance if needed.

Click Next.

​

Review

Review the instance name, target node, and interface configuration. Click Deploy to confirm.

​

Access the Firewall After Deployment

1. Go to Applications and confirm the run state is Online.
2. Open the PAN-OS management UI at https://<node-ip>:7443.
3. Log in with the default credentials: username admin, password admin.
4. Change the password immediately after first login.

After initial access, proceed with interface configuration, VLAN sub-interfaces, DHCP, routing, NAT, and security policies using PAN-OS.

​

Next Steps