1.1 Platform Selection & Sizing: Hardware, VM-Series, and Cloud NGFW Form Factors

1.1 Platform Selection & Sizing: Hardware, VM-Series, and Cloud NGFW Form Factors

Selecting the correct Palo Alto Networks Next-Generation Firewall (NGFW) form factor is a foundational architectural decision when designing enterprise security infrastructure. Palo Alto Networks provides three primary deployment form factors: physical hardware appliances, virtualized VM-Series appliances, and cloud-native Cloud NGFW services. While each form factor targets specific operational environments, all three run the PAN-OS operating system and utilize Palo Alto Networks' proprietary Single-Pass Parallel Processing (SP3) architecture to deliver uniform threat protection.

---

Hardware Appliance Portfolio Overview

Palo Alto Networks physical appliances are engineered with dedicated hardware acceleration to handle enterprise network demands ranging from small branch offices to massive data centers and carrier environments.

PA-400 Series (Small Office / Branch / Distributed Enterprise)

• Form Factor: Compact desktop form factor (optional rack-mount kit), fanless silent design on lower models (PA-410).
• Models: PA-410, PA-440, PA-450, PA-460.
• Use Cases: Remote branch locations, retail outlets, distributed enterprise sites, and small office deployments.
• Key Features: High performance in a small footprint, Power over Ethernet (PoE) options, zero-touch provisioning (ZTP), and cost-effective security for branch offices.

PA-1400 Series (Enterprise Branch & Campus Outposts)

• Form Factor: 1U rack-mount appliance.
• Models: PA-1410, PA-1420.
• Use Cases: Mid-sized enterprise branches, regional campus locations, and industrial environments.
• Key Features: Flexible Fiber and Copper port combinations, Power over Ethernet (PoE) support, redundant power supplies, and high session density.

PA-3400 Series (Large Campus & Enterprise Internet Edge)

• Form Factor: 1U rack-mount appliance.
• Models: PA-3410, PA-3420, PA-3430, PA-3440.
• Use Cases: Enterprise perimeter boundaries, campus cores, high-density distribution layers, and hybrid cloud gateways.
• Key Features: High-density 10GbE, 25GbE, and 100GbE interfaces, hardware-accelerated SSL/TLS decryption, and dedicated management processing power.

PA-5400 Series (Data Center & High-Speed Perimeter Core)

• Form Factor: Modular 2U and 3U chassis-based platforms.
• Models: PA-5410, PA-5420, PA-5430, PA-5440, PA-5445.
• Use Cases: Large enterprise data centers, service provider environments, core campus backbones, and high-velocity internet edges.
• Key Features: Scalable Network Processing Cards (NPC), dedicated Switch Management Cards (SMC), multi-hundred-gigabit Threat Prevention throughput, and deep session capacity.

---

Hardware Form Factor Comparison

---

VM-Series Virtualized Firewalls & Licensing Models

The VM-Series virtual firewall delivers PAN-OS threat prevention in virtualized and cloud environments, including VMware ESXi, KVM, Microsoft Hyper-V, AWS, Microsoft Azure, Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI).

VM-Series Licensing Options

1. VM-Flex Licensing (Flexible Credit-Based Licensing):
   • Replaced rigid legacy fixed-capacity models (such as fixed VM-100 or VM-300 instances).
   • Allows administrators to dynamically allocate vCPU cores (from 2 vCPUs up to 32+ vCPUs) and RAM to meet target throughput workloads.
   • Consumes Software Credits from an Enterprise Licensing Agreement (ELA) or credit pool based on the exact vCPU count, memory, and security subscriptions enabled (such as Advanced Threat Prevention, Advanced URL Filtering, WildFire, and GlobalProtect).
2. Fixed-Capacity Models & PAYG:
   • Pay-As-You-Go (PAYG): Billed hourly or annually directly through cloud provider marketplaces (AWS, Azure, GCP).
   • Bring Your Own License (BYOL): Traditional perpetual or subscription licenses bound to specific instance capacities.

---

Cloud NGFW for AWS and Azure

For cloud-native deployments where managing firewall infrastructure creates operational overhead, Palo Alto Networks offers Cloud NGFW:

• Fully Managed Service: Palo Alto Networks manages the firewall software updates, infrastructure provisioning, and scaling.
• Native Cloud Integration: Integrates directly into cloud provider routing architectures, such as AWS Transit Gateway (TGW) and Azure Virtual WAN (vWAN).
• Operational Simplicity: Provides PAN-OS security policies managed centrally via Panorama or native cloud management console, combined with cloud marketplace pay-as-you-go consumption models.

---

Single-Pass Parallel Processing (SP3) Architecture

A core differentiator of Palo Alto Networks firewalls is the Single-Pass Parallel Processing (SP3) architecture. SP3 addresses the latency overhead inherent in legacy Unified Threat Management (UTM) firewalls.

Dual-Plane Architecture

• Control Plane (CP): Dedicated CPU and memory responsible for administrative tasks, configuration commits, routing protocol updates (OSPF, BGP), management logging, and user authentication. Control plane processes never contend with dataplane packet processing.
• Data Plane (DP): Dedicated hardware engines (ASICs, FPGAs, multi-core processors) dedicated entirely to packet processing, security inspection, and session forwarding.

Single-Pass Software Engine

Traditional UTM firewalls process packets serially: an initial stateful firewall engine checks Layer 3/4 rules, hands off the packet to an Intrusion Prevention System (IPS) engine, which parses the packet again, and then forwards it to an Antivirus engine for a third pass. This serial re-parsing introduces cumulative latency.

In contrast, the SP3 Single-Pass Software Engine parses packet headers and payload once:

1. Networking & State Lookup: Performs route lookups, NAT, and stateful connection tracking.
2. User-ID Mapping: Associates IP addresses with active Directory users and group memberships.
3. App-ID Classification: Identifies the application traversing the wire regardless of port, protocol, or encryption status.
4. Content-ID Inspection: Simultaneously scans the payload for vulnerability exploits (IPS), malware signatures (Antivirus), malicious URLs, and data loss prevention (DLP) violations using uniform stream-based signature matching.

---

Hardware Offloading Mechanisms

Palo Alto Networks physical appliances utilize custom hardware processing engines to sustain single-pass processing at multi-gigabit speeds:

• Network Processing ASICs (FE100/FE400): Offload packet distribution, flow classification, QoS marking, and Layer 2/Layer 3 forwarding.
• Signature Match Engines (FPGA/ASIC): Perform dedicated hardware-accelerated regex string matching for Content-ID signatures, isolating signature evaluation from the general CPU.
• Crypto Offload Processors: Accelerate hardware-based SSL/TLS decryption and IPsec VPN tunnel encryption/decryption without degrading security inspection pipelines.

---

Firewall Sizing Methodology & Performance Metrics

When sizing an NGFW deployment, relying on raw Layer 3/Layer 4 Firewall Throughput will result in under-provisioned firewalls. Sizing must be evaluated using real-world operational security metrics:

1. Firewall (L3/L4) Throughput: Measures simple stateful packet filtering with no security inspection enabled. Useful only as a baseline.
2. App-ID Throughput: Measures performance with application classification enabled across all traffic streams.
3. Threat Prevention Throughput: Measures performance with App-ID, IPS, Antivirus, and Anti-Spyware actively inspecting traffic. This represents the primary sizing metric for internal perimeter firewalls.
4. SSL/TLS Decryption Throughput: Represents the most computationally demanding metric. Decrypting inbound or outbound HTTPS traffic introduces significant CPU overhead. Sizing models inspecting encrypted traffic must factor in a 30% to 60% performance reduction depending on hardware crypto-offload capabilities.
5. New Sessions Per Second (CPS) vs Concurrent Sessions: High-volume web application environments require high CPS capacity, whereas long-lived database or IoT environments demand high concurrent session table limits.