The Palo Alto Networks VM-Series virtual firewall is a popular choice for cloud, virtualized, and software-defined network environments. Before you can deploy it on platforms like VMware ESXi, KVM, Hyper-V, or AWS/Azure, you must first download the correct virtual machine image from Palo Alto Networks.
This post covers the prerequisites, step-by-step download process, available image types, and important version considerations.
After clicking on a PAN-OS version (e.g., 10.2.3), you’ll see a page listing available file types:
Click the Download button next to the appropriate image for your hypervisor.
Once you have login credentials for the Palo Alto Networks Support Portal (support.paloaltonetworks.com), follow these steps:
Step 1: Log into the Support Portal Navigate to the official Palo Alto website and click "Support" > "Login." Use your credentials associated with an active support contract. palo alto download vm image
Step 2: Navigate to Updates Once logged in, hover over "Updates" in the top navigation bar, then select "Software Updates."
Step 3: Filter by VM-Series You will see a drop-down menu labeled "Product Family." Select "VM-Series Virtual Firewall."
Step 4: Select your Hypervisor (The Image Type) This is the most important distinction. You are downloading a virtual disk. You must choose the correct format for your environment:
| Image Type | File Extension | Best For |
| :--- | :--- | :--- |
| ESX/ESXi (OVA) | .ova | VMware ESXi environments (Standard in home labs) |
| KVM (qcow2) | .qcow2 | OpenStack, Red Hat Virtualization, Proxmox |
| Hyper-V (VHDX) | .vhdx | Microsoft Hyper-V environments |
| AWS | AMI (via Marketplace) | AWS cloud |
| Azure | VHD (via Marketplace) | Azure cloud |
For the vast majority of home labs searching for "palo alto download vm image," you want the ESX/ESXi (OVA) file. How to Download Palo Alto Networks VM-Series Images:
Step 5: Choose the PAN-OS Version You will see a list of versions (e.g., 10.2.x, 11.0.x, 11.1.x).
Step 6: Download the Base Image (Not just the updates) Click the download icon (cloud with an arrow) next to the file. This is usually a 500MB to 1.5GB download.
Important: You also need the VM-Series License File (authcodes). This is typically sent to you via email when you purchase the product. Without importing that .lic file into the firewall, your download is useless after 15 days.
Palo Alto provides VM images for multiple hypervisors and cloud platforms. Choose the one that matches your environment:
| Platform | Image Format | Filename Example |
|----------|--------------|------------------|
| VMware ESXi | .ovf or .vmdk | VMware-VM-10.2.3.ova |
| KVM | .qcow2 | kvm-10.2.3.qcow2 |
| Microsoft Hyper-V | .vhdx | hyperv-10.2.3.vhdx |
| AWS | AMI (download not direct – use marketplace) | N/A |
| Azure | VHD (download not direct) | N/A | Step 6: Locate the VM Image Download Link
For this guide, we focus on the downloadable images (VMware, KVM, Hyper-V).
Solution: Palo Alto uses Akamai CDN. If you are using a download manager, disable it. Use a wired internet connection. Verify the SHA-256 checksum provided on the support portal against your downloaded file.
Before clicking download buttons, it is critical to understand what you are downloading. Palo Alto Networks doesn't offer a free "trial edition" of its OS (PAN-OS) in the way VMware offers ESXi. Instead, they offer the VM-Series.
The VM-Series is a virtualized form factor of their next-generation firewall (NGFW). It runs the exact same PAN-OS software as their $100,000 hardware appliances (like the PA-3400 or PA-5200 series), but it runs on your hypervisor (VMware ESXi, KVM, Hyper-V, or NVIDIA BlueField DPU).
If you need the exact download link, you’ll have to log into the support portal first, as Palo Alto doesn’t allow direct public links. Tell me if you need help with VM deployment or initial configuration after your download.
The file size ranges from 1 GB to 2 GB depending on version and format. Save it to a local directory or directly to your virtualization host’s datastore if accessible.
During the annual Palo Alto Ignite conference, they often give away 90-day lab license codes to attendees. You can download the VM image directly from the portal using that code.
© 2013-2016 Discuz Team. Powered by Discuz! X3.5
