[UPDATE 1] Palo Alto VM-Series Software Firewall Keeps Shutting Down in Ubuntu Desktop 24.04.2 LTS KVM

Subject: [UPDATE 1] Palo Alto VM-Series Software Firewall Keeps Shutting Down in Ubuntu Desktop 24.04.2 LTS KVM


Good day from Singapore,


I have asked ChatGPT Artificial Intelligence (AI) for assistance in installing and setting up Palo Alto VM-Series Software Firewall 

PA-VM-KVM-10.2.5.vm_eval.qcow2 in Ubuntu Desktop 24.04.2 LTS KVM.


Below are the instructions provided by ChatGPT.


I have started installing Palo Alto software firewall on 25 Mar 2025 Tue at 9.00 PM and went to sleep at 2.00 AM on 26 Mar 2025 Wed.


Download and install Ubuntu Desktop 24.04.2 LTS on a physical machine with 3 or 4 network interface cards.


Ubuntu installer keeps crashing in the normal mode. When I switch over to Safe Graphics mode, Ubuntu installer stops crashing and installs 

successfully.


Install SSH Server on Ubuntu

=============================


sudo apt install openssh-server


Start SSH Server

=================


sudo systemctl enable --now ssh


Install KVM and Dependencies

===============================


Run the following command to install KVM, Virt-Manager, and dependencies:


sudo apt update && sudo apt upgrade -y


sudo apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virt-manager


Verify if KVM is installed:


sudo kvm-ok


INFO: /dev/kvm exists

KVM acceleration can be used


Start and enable the libvirt service:


sudo systemctl enable --now libvirtd


Download and Prepare the QCOW2 Image

========================================


Download the Palo Alto VM-Series firewall QCOW2 image from Palo Alto Networks.


The filename of my image is PA-VM-KVM-10.2.5.vm_eval.qcow2. Rename it to panos.qcow2.


Move the image to the KVM images directory:


sudo mv panos.qcow2 /var/lib/libvirt/images/


Adjust file permissions:


sudo chown libvirt-qemu:kvm /var/lib/libvirt/images/panos.qcow2


sudo chmod 644 /var/lib/libvirt/images/panos.qcow2


Create a Virtual Machine Using Virt-Manager (GUI)

=====================================================


Open Virt-Manager:


virt-manager


Click Create a new virtual machine.


Select "Import existing disk image".


Browse and select panos.qcow2.


Set the following VM specs:


CPU: 4 (minimum)


RAM: 8GB


Disk: 60GB (qcow2 pre-configured)


Virtual Machine Name: PaloAlto-VM


Network: Bridge or NAT


Click Finish and start the VM.


To configure multiple interfaces for the Palo Alto VM-Series firewall on Ubuntu KVM, follow these steps:


Identify Network Interfaces

================================


First, determine the network interfaces available on your KVM host using:


ip link show


You'll need at least:


    1 interface for management


    1 or more interfaces for data traffic (inside, outside, DMZ, etc.)

    

Create Network Bridges (Optional)

=====================================


If you want Palo Alto to be on different networks, create Linux bridges.


Install bridge utilities:


sudo apt install bridge-utils


Configure bridges in Netplan (/etc/netplan/01-netcfg.yaml):


My netplan configuration:


network:

  version: 2

  renderer: networkd

  ethernets:

    enp5s0:

      dhcp4: no

    enp3s0:

      dhcp4: no

    enp6s0:

      dhcp4: no

  bridges:

    br0:

      interfaces: [enp5s0]

      dhcp4: yes

    br1:

      interfaces: [enp3s0]

      dhcp4: yes

    br2:

      interfaces: [enp6s0]

      dhcp4: yes

      

cd /etc/netplan


sudo mv 01-network-manager-all.yaml 01-network-manager-all.yaml.bak


sudo mv 50-cloud-init.yaml 50-cloud-init.yaml.bak

      

Apply changes:


sudo netplan apply


Add Multiple Interfaces to the VM

======================================


You can add interfaces via virsh (CLI).


List networks:


sudo virsh net-list --all


Attach interfaces:


sudo virsh attach-interface --domain PaloAlto-VM --type bridge --source br0 --model e1000 --persistent


sudo virsh attach-interface --domain PaloAlto-VM --type bridge --source br1 --model e1000 --persistent


sudo virsh attach-interface --domain PaloAlto-VM --type bridge --source br2 --model e1000 --persistent


Check the changes:


sudo virsh dumpxml PaloAlto-VM | grep -i interface -A 10


Verify Interfaces Inside PAN-OS

==================================


Start the VM:


sudo virsh start PaloAlto-VM


Access the console:


sudo virsh console PaloAlto-VM


Login with:


Username: admin

Password: admin


Login will FAIL with the default username and default password.


Now you must follow the following guide.


Thread: Default password not working admin / admin

Link: https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/default-password-not-working-admin-admin/td-p/516560


Follow the instructions of Spiterman. This is very important.


Start the VM:


sudo virsh start PaloAlto-VM


Access the console:


sudo virsh console PaloAlto-VM


Login with:


Username: admin

Password: admin


PA-VM keeps shutting down.


Delete the virtual machine from virt-manager without deleting the qcow2 image.


Guide: KVM - List OS Variants

Link: https://wiki.sharewiz.net/doku.php?id=kvm:list_os_variants


Create the VM from the terminal:


sudo virt-install \

  --name PaloAlto-VM \

  --vcpus 4 \

  --memory 8192 \

  --disk path=/var/lib/libvirt/images/panos.qcow2,format=qcow2,bus=virtio \

  --os-variant centos8 \

  --network bridge=br0,model=virtio \

  --network bridge=br1,model=virtio \

  --network bridge=br2,model=virtio \

  --graphics none \

  --import

  

  Palo Alto software firewall virtual machine (PA-VM) keeps shutting down. After PA-VM boots up and I can see the web login page, it shuts down again

  after a while.

  

  Referring to the Compatibility Matrix for Palo Alto VM-Series Software Firewall Hypervisor Support

  

  Link: https://docs.paloaltonetworks.com/compatibility-matrix/reference/vm-series-firewalls/vms-series-hypervisor-support

  

  Do I need to downgrade my Ubuntu Desktop 24.04.2 LTS to Ubuntu Desktop 22.04?

  

  I am afraid only Ubuntu Desktop 22.04 is supported. I am afraid the latest version of Ubuntu Linux is not supported.

  

  I am looking forward to your advice and reply.

  

  Thank you.

  

  Regards,

  

  Mr. Turritopsis Dohrnii Teo En Ming

  Singapore





REFERENCES

==============


[1] https://lists.ubuntu.com/archives/ubuntu-users/2025-March/314184.html


[2] https://marc.info/?l=ubuntu-users&m=174295734329928&w=2


[3] https://live.paloaltonetworks.com/t5/vm-series-in-the-private-cloud/palo-alto-vm-series-software-firewall-keeps-shutting-down-in/td-p/1224746#M326


Comments

Post a Comment

Popular posts from this blog

How the Singapore Government cheated my family of a HDB flat (Draft 22 Aug 2023)

Subject: How the Singapore Government cheated my family of a HDB flat (Draft 22 Aug 2023) It is a Well-Known Fact that government(s) invented mental illness to punish and torture people (and their families) who criticise the government or say bad things about the government. The Singapore Government rewarded my mother with a mental illness (schizophrenia). By leveraging mind control technology, the Singapore Government is able to make my mother hear voices in her head and trick her into believing that her neighbors are scolding her and targeting her everyday. Yes, the Singapore Government resorted to using this trickery. My mother firmly believes that her neighbors are scolding her and targeting her everyday. So we sold off our 1st HDB flat at Bedok North Street 3 and purchased another HDB flat at Yishun without careful consideration, planning and advice. When we moved to the HDB flat at Yishun, my mother still firmly believes that her neighbors are scolding her and targeting her every...
Read more

[DRAFT 26 SEP 2022] HDB refuses to reduce monthly rental fees of my rental flat despite many appeals

Subject: [DRAFT 26 SEP 2022] HDB refuses to reduce monthly rental fees of my rental flat despite many appeals DRAFT 26 SEP 2022 FOR IMMEDIATE RELEASE My name is Mr. Turritopsis Dohrnii Teo En Ming. I am 44 years old. I am a Targeted Individual (TI) living in Singapore. A Targeted Individual is a person who is persecuted, targeted, marked and blacklisted by the government. After graduation from the National University of Singapore in Dec 2006, I started working in Defense Science and Technology Agency (DSTA) as an IT Engineer. But I offended Singapore Minister Mentor Lee Kuan Yew in the year 2007. When I was having a private conversation with my manager Mr. Loh Choon Fah in his office, I said: "When Lee Kuan Yew is gone, Singapore would be more democratic.". This is how I offended Singapore strongman Lee Kuan Yew. Within a few months, I started hearing threatening and menacing voices from the Singapore government. Hearing voices is also known as schizophrenia (mental illness)....
Read more