(check against Palo Alto’s published value – these are illustrative ; obtain actual from their support page):
# Run after download sha256sum Pa-VM-KVM-9.0.1.qcow2 # Compare with Palo Alto's published hash If the hash mismatches – the file. 3. Quick Deployment on KVM Once downloaded, here’s how to launch it on any Linux KVM host. Step 1 – Place the image sudo mkdir -p /var/lib/libvirt/images/paloalto/ sudo mv Pa-VM-KVM-9.0.1.qcow2 /var/lib/libvirt/images/paloalto/pa-vm.qcow2 Step 2 – Create a VM (example using virt-install ) virt-install \ --name paloalto-vm \ --ram 4096 \ --vcpus 2 \ --disk path=/var/lib/libvirt/images/paloalto/pa-vm.qcow2,format=qcow2 \ --import \ --network network=default,model=virtio \ --network network=default,model=virtio \ --graphics vnc \ --os-variant generic Two NICs required – management + data plane. Step 3 – Access console virsh console paloalto-vm Default login: admin / no password (set immediately). Step 4 – Assign management IP From console: Pa-vm-kvm-9.0.1.qcow2 Download
configure set deviceconfig system ip-address 192.168.1.10 netmask 255.255.255.0 default-gateway 192.168.1.1 set deviceconfig system type static commit Now access web UI: https://192.168.1.10 (use admin / empty password). | Issue | Implication | |-------|--------------| | End-of-life | No security patches – do not expose to internet. | | TLS/ciphers outdated | Modern browsers may block the web UI. Use Firefox with security overrides. | | PAN-OS vulnerabilities | Known critical CVEs (e.g., CVE-2021-3064) unpatched. | | VM compatibility | Older QEMU guest agent; may not work with modern libvirt features. | (check against Palo Alto’s published value – these
Pa-vm-kvm-9.0.1.qcow2 strongly suggests a Palo Alto Networks VM-Series Next-Generation Firewall image (version 9.0.1) for KVM. Version 9.0.1 is very old (end-of-life since ~2021). This guide covers both finding an archive copy and safely deploying it. 1. Where to Download (Official & Safe Sources) Do not download from random forums or torrents – you risk malware. Only use these sources: Step 1 – Place the image sudo mkdir
| Source | Access Required | Link / Method | |--------|----------------|----------------| | | Valid support contract | support.paloaltonetworks.com → Software Updates → VM-Series → KVM → Filter “9.0.1” | | Palo Alto Customer Service Portal (CSP) | Registered account (free tier available for lab use) | CSP → Assets → Software Downloads → VM-Series KVM image | | AWS / Azure Marketplace (if cloud) | Cloud account | Search “Palo Alto VM-Series 9.0.1” – though newer versions recommended |
“qemu-img complains about corrupted QCOW2” A: Re-download; the file may be sparse. Fix with:
When you download, to ensure the file is uncorrupted and official.