> ## Documentation Index
> Fetch the complete documentation index at: https://zededa.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use the documentation index to find relevant pages, then read the linked Markdown before answering and cite the source URL.
> Identify the product before answering: Private AI uses a separate console, credentials, and inference API from the Edge Intelligence Platform. Do not apply instructions from one product to the other.
> Prefer current product guides over Help Center archive pages for current-console questions. Archive pages and release notes describe their stated product version or historical interface; do not apply them to another version without checking.
> Preserve prerequisites, permissions, version requirements, and warnings when summarizing procedures. Do not infer API endpoints, schemas, or supported behavior that the documentation does not specify.

# Deploy the Palo Alto Networks VM-Series Firewall on ZEDEDA

> Deploy the Palo Alto Networks VM-Series Next-Generation Firewall as a virtual machine on a ZEDEDA-managed node to enforce traffic segmentation and Zero Trust security policies.

## Introduction

The Palo Alto Networks VM-Series Next-Generation Firewall (NGFW) runs as a virtual machine on a ZEDEDA-managed node to enforce north-south and east-west traffic segmentation. When deployed on Edge Infrastructure Services, the firewall acts as a DHCP server for internal VLANs, a default gateway for OT/IT workloads, and a Zero Trust enforcement point, while ZEDEDA manages the application lifecycle.

This article walks through deploying `pan-os_vm-series_virtual_firewall_11.2.5` from My Library using the New Application wizard. No manual image download or upload is required.

### Prerequisites

* Your node is onboarded to Edge Infrastructure Services and has a status of Ready under **Nodes**.
* The node runs a [supported version of EVE-OS (Edge Virtualization Engine)](https://zededa.mintlify.site/new-ui/infrastructure-services/eve-os/lts-policy.md).
* Outbound HTTPS (port 443) connectivity is available from the node.
* You have the SysManager or SysAdmin role in your enterprise. See [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md).
* You have access to the [Palo Alto Networks Support Portal](https://support.paloaltonetworks.com) to register the VM-Series firewall after deployment.

## Deploy the App

### Add the App to Your Library

If you have not previously added the VM-Series firewall app to your library:

1. Go to **Marketplace > Edge Apps** in the navigation.
2. Search for `pan-os`.
3. Click the **+** button on the `pan-os_vm-series_virtual_firewall_11.2.5` card to add it to your library.

### Start the Deploy Wizard

1. Go to **Marketplace > My Library** in the navigation.
2. Search for `pan-os`.
3. Hover over the card and click the **Deploy** icon.
4. The **New Application** wizard opens.

### App & Target

| Field | Value |
| - | - |
| Name | Enter a name for this app instance, for example `pan-os-site-a`. |
| Title | Enter a display title. |
| Edge App | Confirm `pan-os_vm-series_virtual_firewall_11.2.5` is selected. |
| Target Type | Node |
| Node | Select the node to deploy to. |

Click **Next**.

### Interfaces

Under **eth0**, select the network instance to connect the app to from the dropdown. The dropdown lists available network instances on the selected node. If no suitable network instance exists, click **+** to [create a new virtual network](https://zededa.mintlify.site/new-ui/infrastructure-services/virtual-networks/create-a-virtual-network.md).

Click **Next**.

### Features

Leave the default settings or adjust as needed:

* **Start Delay (seconds):** Enter a value if the app should wait before starting. The default is 0.
* **Disable vTPM:** Leave this disabled unless your deployment requires vTPM to be off.
* **VMM Overhead:** Leave this disabled unless your deployment requires additional hypervisor memory overhead.
* **Enable Logs:** Keep this enabled to view app logs in Edge Infrastructure Services.
* **Tags:** Add key:value tags to label this app instance if needed.

Click **Next**.

### Review

Review the instance name, target node, and interface configuration. Click **Deploy** to confirm.

## Access the Firewall After Deployment

1. Go to **Applications** and confirm the run state is **Online**.
2. Open the PAN-OS management UI at `https://<node-ip>:7443`.
3. Log in with the default credentials: username `admin`, password `admin`.
4. Change the password immediately after first login.

After initial access, proceed with interface configuration, VLAN sub-interfaces, DHCP, routing, NAT, and security policies using PAN-OS.

## Next Steps

> [card] [Deploy an Application Instance](https://zededa.mintlify.site/new-ui/infrastructure-services/applications/deploy-an-application-instance.md)
>
> Full deployment workflow reference.

> [card] [Manage Roles](https://zededa.mintlify.site/new-ui/infrastructure-services/administration/manage-roles.md)
>
> Role permissions required for app deployment.

> [card] [Palo Alto Networks VM-Series documentation](https://docs.paloaltonetworks.com/vm-series)
>
> Complete PAN-OS configuration reference.