Running a firewall in a virtualized environment often introduces bottlenecks regarding I/O. The pa-vm-kvm image relies heavily on VirtIO drivers.
After the VM boots, you will likely encounter a login prompt or a "Network Configuration" wizard. pa-vm-kvm-10.1.0.qcow2
While Palo Alto has moved on to PAN-OS 11.0 and 11.1, version 10.1.0 reached its End-of-Life (EoL) on October 31, 2024 for standard support. That said, many organizations continue using 10.1.0 in air-gapped labs, legacy environments, or while planning upgrades. Running a firewall in a virtualized environment often
Warning: Do not use 10.1.0 for new internet-facing production deployments. Use 11.1.x or later for current security updates. After the VM boots, you will likely encounter
The image boots with a trial license. To use it beyond the limited capacity (e.g., 1 Mbps throughput), you must license it. Options include:
Apply a license under Device > Licenses in the web UI.
The second NIC (data port) is usually set to NIC: 0.0.0.0/0 or Accept All. Do not plug this into a switch with DHCP unless you want a broadcast storm. Connect it directly to a SPAN/mirror port or leave it disconnected initially.