ESXi compatibility questions with regards to Palo Alto firewall implementation

Products

• VMware vSphere ESXi

Issue/Introduction

Would placing a Palo Alto firewall in Virtual Wire (Transparent L2) mode, inline between hosts & the network core affect Nutanix CVM or VMware communication, assuming we start with an allow-all rule?

To answer this question please follow up with Palo Alto.  VMware communication would still be forwarded the same way based upon configuration.  

Are any Nutanix/VMware services sensitive to inspection delay, or packet reordering?

To address the Nutanix portion of this please follow up with Nutanix.  VMware services are sensitive to packet inspection, particularly due to the impact on performance, visibility challenges with encrypted traffic, and recent changes to the NSX platform under Broadcom. While packet inspection can be used for security purposes, it must be implemented carefully to avoid unintended consequences. 

Would IPS/IDS affect Nutanix or ESXI?

Yes, ESXi can be sensitive to IDS/IPS and deploying these security tools in a virtualized environment requires careful planning to avoid performance issues and potential network disruption.

Resolution

For vendor specific questions please follow up with the appropriate vendor.  ESXi is compatible with Palo Alto firewalls, but performance sensitivity is something that must be taken into consideration when implementing different features.