(/content/techdocs/en_US.

html)

Updated on Mar 13, 2025

Home (/) | Panorama (/content/techdocs/en_US/panorama.html)

| Panorama Administrator's Guide (/content/techdocs/en_US/panorama/10-1/panorama-admin.html)
| Set Up Panorama (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama.html)
| Set Up the Panorama Virtual Appliance (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/set-up-the-
panorama-virtual-appliance.html)
| Install the Panorama Virtual Appliance (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/set-up-the-
panorama-virtual-appliance/install-the-panorama-virtual-appliance.html)
| Install Panorama on KVM (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-
appliance/install-the-panorama-virtual-appliance/install-panorama-on-kvm.html)

DOWNLOAD PDF (/CONTENT/DAM/TECHDOCS/EN_US/PDF/PANORAMA/10-1/PANORAMA-ADMIN/PANORAMA-

ADMIN.PDF)

Panorama Administrator's Guide

(/content/techdocs/en_US/panorama/10-
1/panorama-admin.html)
Install Panorama on KVM

Table of Contents

You can now deploy Panorama™ and a Dedicated Log Collector on KVM. Panorama deployed on KVM is Bring Your Own
License (BYOL), supports all deployment modes (Panorama, Log Collector, and Management Only), and shares the same
processes and functionality as the M-Series hardware appliances. For more information on Panorama modes, see Panorama
Models (/content/techdocs/en_US/panorama/10-1/panorama-admin/panorama-overview/panorama-
models.html#id6a2d6388-f727-45aa-ae7e-ef7599379871).

STEP 1 -
Download the Panorama 10.1 base image QCOW2 file.

A Log in to the Palo Alto Networks Support Portal

(https://support.paloaltonetworks.com/SupportAccount/MyAccounts/245).

B Select Updates > Software Updates and filter by Panorama Base Images to download the QCOW2 file
(Panorama-KVM-10.1.0.qcow2).

STEP 2 -
Create a new virtual machine image and add the Panorama virtual appliance image for KVM to the Virtual
Machine Manager.

This site uses cookies essential to its operation, for analytics, and for personalized content and ads. By
On the Virtual Machine Manager, select Create a new virtual machine.
continuing to A
browse this site, you acknowledge the use of cookies. Privacy statement ❯ Cookie Settings
(https://www.paloaltonetworks.com/legal-notices/privacy)
 B Select Import Existing disk image and click Forward.

C Browse and select the Panorama virtual appliance image volume and Choose volume.

D Click Forward.

STEP 3 -
This site usesConfigure
cookies essential to its operation,
the memory and CPUfor analytics, and for personalized content and ads. By
settings.
continuing to browse this site, you acknowledge the use of cookies. Privacy statement ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)
 Review the Setup Prerequisites for the Panorama Virtual Appliance (/content/techdocs/en_US/panorama/10-
1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/setup-prerequisites-for-the-
panorama-virtual-appliance.html#id4430de3f-a44c-4b24-b9c3-52cef1f0bc96) for minimum resource
requirements.

If you plan to use the Panorama virtual appliance as a Dedicated Log Collector, ensure that
you configure the appliance with the required resources during initial deployment. The
Panorama virtual appliance does not remain in Log Collector mode if you resize the virtual
machine after you deploy it, and this results in a loss of log data.

A Configure the Memory based on the requirements for the desired operational mode.

The Virtual Machine Manager may use MiB (mebibyte) to allocate memory depending on

the version you are running. If MiB is used, be sure to correctly convert your required
memory allocation to avoid under provisioning the Panorama virtual appliance.

B Configure the CPU based on the requirements for the desired operational mode.

C Click Forward.

STEP 4 -
Name the Panorama virtual appliance, enable configuration customization, and select the management
interface bridge.

A Enter a descriptive Name for the Panorama virtual appliance.

B Customize configuration before install.

C Make a Network selection—select the bridge for the management interface and accept the default settings.

D Click Finish.

STEP 5 -
Configure the virtual system disk settings.

A Select IDE Disk 1, go to Advanced options, and select the following:

Disk Bus—VirtIO or IDE, depending on your configuration.

This site uses cookiesStorage

essentialformat
to its operation,
—qcow2 for analytics, and for personalized content and ads. By
continuing to browse this site, you acknowledge the use of cookies. Privacy statement ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)
 B Go to Performance options and set Cache mode to writethrough. This setting improves installation time
and execution speed on the Panorama virtual appliance.

C Click Apply.

STEP 6 -
Configure the virtual machine console display to use the VNC server to interact with the virtual machine.

A Select Display Spice.

Continue to the next step if Display VNC is listed in the Hardware list because the virtual

machine is already configured to use the VNC server for the display.

B In the Type drop-down, select VNC server.

C Click Apply.

STEP 7 -
( Optional ) Add additional storage for log collection. Repeat this step as needed to add additional virtual
logging disks.

If you intend to use the Panorama virtual appliance in Panorama mode or as a Dedicated Log Collector, add the
virtual logging disks during the initial deployment. By default, the Panorama virtual appliance is in Panorama
mode for the initial deployment when you meet the Panorama mode resource requirements and have added at
least one virtual logging disk. Otherwise, the Panorama virtual appliance defaults to Management Only mode.
Change the Panorama virtual appliance to Management Only mode if you just want to manage devices and
Dedicated Log Collectors, and to not collect logs locally.

The Panorama virtual appliance on KVM only supports 2TB logging disks, and in total supports up to 24TB of
log storage. You are unable to add a logging disk smaller than 2TB, or a logging disk with a size not divisible by
the 2TB logging disk requirement. The Panorama virtual appliance partitions logging disks larger than 2TB into
2TB partitions.

A Add Hardware.

B Configure the new Storage disk:

1. Create a disk image for a virtual machine and configure the virtual disk storage capacity to 14901.2 GiB
(this is equivalent to 2TB).

The Virtual Machine Manager may use GiB (gibibyte) to allocate memory depending on
This site uses cookies essential to its operation, for analytics, and for personalized content and ads. By
the version you are running. If GiB is used, be sure to correctly convert the required stor-


continuing to browse this site, you acknowledge the use of cookies. Privacy statement ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)
 age capacity to avoid under provisioning the virtual logging disk and sending the

Panorama virtual appliance into maintenance mode.

2. Set the Device type to Disk device.

3. Set the Bus type to VirtIO or IDE, depending on your configuration.

4. Go to Advanced options and set Cache mode to writethrough.

C Click Finish.

STEP 8 -
Begin Installation ( ). The Panorama virtual appliances takes approximately 10 minutes to boot.

STEP 9 -
Configure a new administrative password for the Panorama virtual appliance.

You must configure a unique administrative password before you can access the web interface or CLI of the
Panorama virtual appliance. The new password must be a minimum of eight characters and include a minimum
of one lowercase character, one uppercase character, and one number or special character.

When you first log in to the Panorama CLI, you are prompted to enter the Old Password and the New Password
for the admin user before you can continue.

STEP 10 -
Configure the network access settings for the management interface.

A Open a connection to the console.

B Log in to the firewall using the default username and password: admin/admin.

C Enter configuration mode using the following command:

admin> configure

D Use the following commands to configure and enable access to the management interface:

admin# set deviceconfig system type static

admin# set deviceconfig system ip-address <Panorama-IP> netmask <netmask> default-gateway <
gateway-IP> dns-setting servers primary <DNS-IP>

where <Panorama-IP> is the IP address you want to assign to the management interface, <netmask> is the
subnet mask, <gateway-IP> is the IP address of the network gateway, and <DNS-IP> is the IP address of

the DNS server.

This site uses cookies essential to its operation, for analytics, and for personalized content and ads. By
continuing to browseadmin#
this site, you acknowledge the use of cookies. Privacy statement
commit ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)
 STEP 11 -
Register the Panorama virtual appliance and activate the device management license and support licenses.

A ( VM Flex Licensing Only ) Provisioning the Panorama Virtual Appliance Serial Number
(https://docs.paloaltonetworks.com/vm-series/10-1/vm-series-deployment/license-the-vm-series-
firewall/software-ngfw/provision-panorama.html).

When leveraging VM Flex licensing, this step is required to generate the Panorama virtual appliance serial
number needed to register the Panorama virtual appliance with the Palo Alto Networks Customer Support

Portal (CSP).

B Register Panorama (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-

panorama/register-panorama-and-install-licenses/register-panorama.html#ida7cedf7f-3d4e-4b8d-aa27-
e31e359c6962).

You must register the Panorama virtual appliance using the serial number provided by Palo Alto Networks in
the order fulfillment email.

This step is not required when leveraging VM Flex licensing as the serial number is automatically registered
with the CSP when generated.

C Activate the firewall management license.

Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is Internet-

connected (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/register-
panorama-and-install-licenses/activateretrieve-a-firewall-management-license-on-the-panorama-

virtual-appliance.html#id5fd6c4c0-1cc7-456d-a959-291b1726cda6).

Activate/Retrieve a Firewall Management License when the Panorama Virtual Appliance is not Internet-

connected (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/register-
panorama-and-install-licenses/activateretrieve-a-firewall-management-license-when-the-panorama-

virtual-appliance-is-not-internet-connected.html#id181QAN006N4).

D Activate a Panorama Support License (/content/techdocs/en_US/panorama/10-1/panorama-admin/set-

up-panorama/register-panorama-and-install-licenses/activate-a-panorama-support-
license.html#id7ece970a-4a9a-49f5-a11a-cb16bcd2332a).

STEP 12 -
Complete configuring the Panorama virtual appliance for your deployment needs.

For Panorama in Log Collector Mode.

1. Add a Virtual Disk to Panorama on KVM (/content/techdocs/en_US/panorama/10-1/panorama-

admin/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-
panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-kvm.html#id1849E08A0HQ) as
needed.

This site uses cookiesAdding

essentialat to
least one virtual
its operation, for logging
analytics,disk
andisforrequired before
personalized you can
content change
and ads. By the Panorama virtual appliance
continuing to browse to
thisLog
site,Collector mode. the use of cookies. Privacy statement
you acknowledge ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)
 2. Begin at Step 6 to switch to Log Collector mode. (/content/techdocs/en_US/panorama/10-1/panorama-
admin/set-up-panorama/set-up-the-panorama-virtual-appliance/set-up-the-panorama-virtual-
appliance-as-a-log-collector.html#id17C8C0Z0H2M_id2ef0782e-1afd-4219-8e26-a8a4b02a97f6)

Enter the Public IP address of the Dedicated Log Collector when you add the Log
Collector as a managed collector to the Panorama management server. You cannot
specify the IP Address, Netmask, or Gateway.

For Panorama in Panorama mode.

1. Add a Virtual Disk to Panorama on KVM (/content/techdocs/en_US/panorama/10-1/panorama-

admin/set-up-panorama/set-up-the-panorama-virtual-appliance/expand-log-storage-capacity-on-the-
panorama-virtual-appliance/add-a-virtual-disk-to-panorama-on-kvm.html#id1849E08A0HQ).

Adding at least one virtual logging disk is required before you can change the Panorama virtual appliance
to Panorama mode.

2. Set up a Panorama Virtual Appliance in Panorama Mode (/content/techdocs/en_US/panorama/10-

1/panorama-admin/set-up-panorama/set-up-the-panorama-virtual-appliance/set-up-the-panorama-
virtual-appliance-in-panorama-mode.html#id1846A0G0Y3C).

3. Configure a Managed Collector (/content/techdocs/en_US/panorama/10-1/panorama-admin/manage-

log-collection/configure-a-managed-collector.html#idf8d86697-3296-455d-93a7-16abbb3e9aa3).

For Panorama in Management Only mode.

1. Set up a Panorama Virtual Appliance in Management Only Mode

(/content/techdocs/en_US/panorama/10-1/panorama-admin/set-up-panorama/set-up-the-panorama-
virtual-appliance/set-up-the-panorama-virtual-appliance-in-management-only-
mode.html#id182QC0YK0ED).

2. Configure a Managed Collector (/content/techdocs/en_US/panorama/10-1/panorama-admin/manage-

log-collection/configure-a-managed-collector.html#idf8d86697-3296-455d-93a7-16abbb3e9aa3) to
add a Dedicated Log Collector to the Panorama virtual appliance.

Management Only mode does not support local log collection, and requires a Dedicated Log Collector to
store managed device logs.

Was this information helpful?

Yes No

Previous
(/content/techdocs/en_US/panorama/10- Next (/content/techdocs/en_US/panorama/10-
Install
1/panorama-admin/set-up-panorama/set-up- Install 1/panorama-admin/set-up-panorama/set-up-
Panorama
the-panorama-virtual-appliance/install-the- Panorama the-panorama-virtual-appliance/install-the-
on Google
panorama-virtual-appliance/install- on Hyper- panorama-virtual-appliance/install-
Cloud panorama-on-gcp.html) panorama-on-hyper-v.html)
V
Platform

Technical Documentation Co

Release Notes (/content/techdocs/en_US/release-notes.html) Abo

Search (/content/techdocs/en_US/search.html) Care
Blog (https://www.paloaltonetworks.com/blog/category/technical- Cus
This site uses cookies essential to its operation, for analytics, and for personalized content and ads. By
continuing to browse this site, you acknowledge the use documentation/)
of cookies. Privacy statement ❯ LIVE

(https://www.paloaltonetworks.com/legal-notices/privacy) Kno
 Compatibility Matrix (/content/techdocs/en_US/compatibility-
matrix.html)
OSS Listings (/content/techdocs/en_US/oss-listings.html)
Sitemap (/content/techdocs/en_US/sitemap.html)

(https://www.facebook.com/PaloAltoNetworks) (https://w
(https://www.youtube.com/channel/UCPRouchFt58TZnjoI65aelA)

(/content/techdocs/en_US.html) © 2025 Palo Alto Ne

This site uses cookies essential to its operation, for analytics, and for personalized content and ads. By
continuing to browse this site, you acknowledge the use of cookies. Privacy statement ❯
(https://www.paloaltonetworks.com/legal-notices/privacy)