Slide 1: Cloud NGFW for Azure Onboarding with Strata Cloud Manager
Cloud NGFW for Azure Onboarding with Strata Cloud Manager Fuel session Ahmad Alkhatib/Jose Manzano Date June 2nd
Slide 2: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 2 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 3: Traditional NGFW in cloud
Traditional NGFW in cloud Problem Traditional NGFW deployments in the cloud require manually provisioning VMs, managing load balancers, and handling lifecycle scaling. 3 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 4: Cloud NGFW Solution
Cloud NGFW Solution Cloud NGFW is an Azure Native ISV Service. It delivers core Palo Alto Networks capabilities as a fully managed, cloud-native resource: ● App-ID ● Advanced URL Filtering ● Threat Prevention Key Takeaway Automated deployment and scaling (up to 100 Gbps) without managing the underly
Slide 5: Azure Native Advantage
Azure Native Advantage 5 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 6: Firewall As A Service (FWaaS)
Firewall As A Service (FWaaS) Palo Alto Networks manages the underlying infrastructure, scaling, and updates; the customer focuses exclusively on security policy. 6 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 7: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 7 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 8: Architecture synthesis
Architecture synthesis 8 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 9: Deployment architecture: Two deployment models
Deployment architecture: Two deployment models 9 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 10: Deployment architecture: Hub-and-spoke Vnet
Deployment architecture: Hub-and-spoke Vnet 10 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 11: Deployment architecture: Azure Virtual WAN
Deployment architecture: Azure Virtual WAN Azure Native-Blueprints 11 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 12: Deployment architecture: Comparison matrix
Deployment architecture: Comparison matrix Azure Native-Blueprints 12 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 13: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 13 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 14: Consumption model comparison
Consumption model comparison 14 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 15: The Anatomy of Cloud NGFW billing
The Anatomy of Cloud NGFW billing Support Warning: There is no per-rule billing. If ANY rule has a CDSS profile attached, all traffic flowing through the entire NGFW incurs the CDSS add-on charge. Azure Networking Charges (egress/peering) are billed directly by Microsoft and are separate from PANW b
Slide 16: The credit Activation Sequence
The credit Activation Sequence 16 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 17: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 17 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 18: Pre-deployment prerequisites
Pre-deployment prerequisites 18 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 19: Subscription Association with the CSP
Subscription Association with the CSP 19 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 20: Network configuration requirements
Network configuration requirements VNet deployments 20 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 21: Network configuration requirements
Network configuration requirements Virtual Wan deployments 21 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 22: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 22 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 23: Azure Portal Workflow
Azure Portal Workflow 23 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 24: Azure Portal Workflow
Azure Portal Workflow 24 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 25: Cloud NGFW creation wizard
Cloud NGFW creation wizard Basics 25 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 26: Cloud NGFW creation wizard
Cloud NGFW creation wizard Network configuration (VNET) Select the Hub or designated VNETs Assign at least /26 subnet Define private/public delegated subnet. Assign existing or create new Public IPs during the provisioning 26 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 27: Cloud NGFW creation wizard
Cloud NGFW creation wizard Network configuration (Virtual WAN) Select the Hub or designated VNETs Assign existing or create new Public IPs during the provisioning 27 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 28: Cloud NGFW creation wizard
Cloud NGFW creation wizard Security Policies Select the Cloud NGFW management, SCM for our demo Assign the SCM Tenant Fuel-SCM-demo (11XXXXXX) 28 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 29: Cloud NGFW creation wizard
Cloud NGFW creation wizard Terms Accept the Terms of use 29 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 30: Cloud NGFW creation wizard
Cloud NGFW creation wizard Security Policies You Your email address Your phone number Check the summary and click on create Fuel-SCM-demo (11XXXXXX) 30 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 31: Post-Deployment verification
Post-Deployment verification Health status Public and private addresses Provisioning status Network type VWAN/VNet What managed the firewall 31 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 32: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 32 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 33: Management Split
Management Split 33 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 34: Azure Portal
fuel-demo-session fuel-demo-session fuel-demo-session Azure Portal Add Public IP/Prefix in Private (East-West traffic) fuel-demo-session Public Source NAT behaviour or/and add more Public IP addresses (Outbound traffic) Configure DNAT for Public IPs (Inbound traffic) Source NAT for Private addresses
Slide 35: Centralized Security Rules
Centralized Security Rules ● Use SCM to globally apply security rules, including App-ID, URL Filtering, IPS and Antivirus ● Rules are often divided into Pre-Rules (global mandates) and Post-Rules 35 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 36: Device Management
Device Management Located linked firewalls automatically in the SCM console under System settings> Device management > Cloud NGFWs 36 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 37: Folder Management
Folder Management ● Create Folders in SCM to logically group firewalls for simplified, inherited policy management ● Use nested folders for organizing complex environments. 37 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 38: Configuration Sync
Configuration Sync ● Monitor the “Config sync status” ● The status will initially appears as “Out of Sync” until the first manual “Push” operation is performed from SCM 38 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 39: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency 39 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 40: The abstraction Layer
The abstraction Layer ● Cloud NGFW is a stateless service ● Palo Alto Networks manages the underlying infrastructure via Virtual Machine Scale Sets (VMSS), which are invisible to the user 40 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 41: Health Probity & Availability Zones
Health Probity & Availability Zones ● Azure Internal Load Balancers (ALB) perform continuous health checks on firewall instances ● Instances are automatically distributed across Azure Availability Zones (AZ) for regional resiliency and high availability 41 | © 2026 Palo Alto Networks, Inc. All right
Slide 42: Automatic Scaling
Automatic Scaling Scaling is automatic, based on: Metric O1 y a Metric 03 Dataplane CPU an > Throyatiput® based <©_ Session-based scaling tric O <— Metric 05 SSL Proxy session L_@ Used SNAT Port Aggressive scale Conservative scale-in
Slide 43: Performance Metrics
Performance Metrics ● Azure Monitor should be used to visualize key performance indicators ● Metrics to track include Throughput, Session count and bandwidth during auto scaling operations 43 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 44: Agenda
Agenda ● Overview ● Introduction to Cloud NGFW for Azure ● Licensing and Credit Management ● Pre-Deployment Prerequisites ● Deployment Cloud NGFW in Azure ● Policy and Security Management ● Instance Auto-scaling process & Resiliency ● Demo 44 | © 2026 Palo Alto Networks, Inc. All rights reserved.
Slide 45: Questions?
Questions?
Slide 46: Thank you
Thank you www.paloaltonetworks.com