VM-Series Plugin and Panorama

Plugins

What is the difference between the VM-Series Plugin and various plugins for Panorama?
The VM-Series Plugin is for the VM-Series firewalls, and is a single plugin that enables integration with public cloud
environments such as Google Cloud Platform (GCP), Azure and AWS, and private cloud hypervisors such as KVM,
ESXi and others. When you deploy the firewall, the built-in plugin automatically detects the virtual environment on
which the firewall is deployed and loads up the plugin components that enable you to manage interactions with that
cloud environment. For example, when you deploy the VM-Series firewall on GCP, the VM-Series firewall loads the
plugin components that enable the integration with GCP. You can then use the VM-Series plugin to configure the
VM-Series firewall on GCP to publish metrics to Google Stackdriver Monitoring. Similarly, the VM-Series plugin on
the VM-Series firewall on Azure enables you to configure the firewall to publish metrics Azure Application Insights
or set up the details that the firewalls need to function as an HA pair. The VM-Series Plugin is pre-installed on the
VM-Series firewall, and you can upgrade or downgrade but cannot delete it. On Panorama the VM-Series plugin is
available but it is not pre-installed. If you choose to use Panorama to manage the integrations on your firewalls, install
the VM-Series plugin on Panorama to establish communication with the VM-Series plugin on your firewalls.
The Panorama plugins are for both hardware-based firewalls and the VM-Series firewalls. Since Panorama plugins are
optional, you can add, remove, reinstall, or upgrade them on Panorama. The Panorama plugin is not built-in, and you
must install the plugin to enable communication with the managing the environment you need. For example, you use
the Cloud Services plugin on Panorama to enable the set up between the Panorama/firewalls and the Cortex Data
Lake. The GCP plugin on Panorama enables communication between Panorama and your GCP deployment so that
you can secure traffic entering or exiting a service deployed in a Google Kubernetes Engine (GKE) cluster.