This ensures the VM-series will inspect all traffic between the groups. You would configure your vSwitches and guest virtual machine, so there is no other physical or virtual path to any other network. You could have a VM=-series firewall sitting on each virtual switch, filtering traffic for each group. A common use case for this is you may have an internal network, an external network, and a DMZ.

One VM-series firewall per virtual network – You can also deploy a VM-series firewall for each virtual network you have configured on your ESXi host.

You can also require all VM guests to traverse the firewall for all server to server communication (east-west). The guest servers are configured, so they have no other network connectivity aside from traversing the Palo VM.

One VM-series firewall per ESXi host – In this scenario, you utilize the Palo VM series firewall to inspect all traffic leaving the ESXi host.

There are many supported deployment scenarios when it comes to getting a Palo VM series in your VMware vSphere environment. Deployment Scenarios on VMware vSphere Hypervisor (ESXi)

Let’s take a quick look at how to install Palo Alto VM series in VMware vSphere environments. I am installing the Palo VM inside a VMware vSphere 7 U1 environment, with a few hosts running various network configurations. However, before you can use the Palo VM-series firewall, you have to get it deployed into your virtual environment. Recently, thanks to the great guys at Palo Alto, I was able to get my hands on a VM-series firewall to do some testing across various fronts, including VMware NSX-T. Recently, in the home lab, I have been doing a lot of lab networking configurations and testing various scenarios.

Palo alto firewall image download