Palo Alto Networks, Inc. · NASDAQ:PANW

Palo Alto Networks — Technical Presentation (March 2026)

43 slides from Palo Alto Networks's technical presentation, Mar 17, 2026

  1. Slide 1: TAC Workshop Flow Logic

    TAC Workshop Flow Logic 17th Mar 2026 © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  2. Slide 2: Agenda

    Agenda ● Flow Logic: ○ Key terms ○ High-level view ○ Data flows per processing stage © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  3. Slide 3: Session-based Processing

    Session-based Processing ● How TCP connections are set up and managed ● How UDP-based conversations can be managed in sessions ● How a Palo Alto Networks firewall tracks sessions ● The relationship between session state and: ○ Packet flow Is that true? ○ Security policy To which session do you belong?

  4. Slide 4: Why Review the Concept of a Session?

    Why Review the Concept of a Session? All packet flow through the firewall is session-based: ● User-ID and App-ID function as session metadata. ● Security policy results may be triggered by individual packets, but results are logged back to the session tables. ● Session-management overhead affects throu

  5. Slide 5: What Is a Palo Alto Networks Firewall Session?

    What Is a Palo Alto Networks Firewall Session? A session is a set of two flow keys (plus session metadata). ● Each flow key is a hash of: ❶ ❷ ❸ ❹ ❺ IP Protocol Src. IP Address Dest. IP Address Src. Port Dest. Port > > Payload > > ○ Five packet-header fields ❻ + initiator-ingress-zone ○ The ingress-zone

  6. Slide 6: Basic Session Information

    Basic Session Information Session 52975 c2s flow: IP Protocol Src. IP Address Dest. IP Address Src. Port Dest. Port > > Payload > > + initiator-ingress-zone source: ❸ 10.1.10.21 [int-network] ❻ dst: ❷ 198.51.100.15 proto: ❶ 6 sport: ❹ 49327 dport: ❺ 80 s2c flow: IP Protocol Src. IP Address Dest. IP

  7. Slide 7: Session creation for ICMP

    Session creation for ICMP ● How is the session created for ICMP? ● What parameters are used for creating the session? © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  8. Slide 8: Session creation for ICMP

    Session creation for ICMP © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  9. Slide 9: Session creation for ICMP

    Session creation for ICMP © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  10. Slide 10: Session creation for ICMP

    Session creation for ICMP ● Does not reflect in traffic logs. Only seen in session details. © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  11. Slide 11: Session Creation for IPSEC traffic terminated on firewall

    Session Creation for IPSEC traffic terminated on firewall © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  12. Slide 12: Session Creation for IPSEC traffic terminated on firewall

    Session Creation for IPSEC traffic terminated on firewall > show vpn flow > show vpn flow tunnel-id <ID> © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  13. Slide 13: Session Creation for IPSEC traffic terminated on firewall

    Session Creation for IPSEC traffic terminated on firewall © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  14. Slide 14: Session Creation for IPSEC traffic PASSTHROUGH on the firewall

    Session Creation for IPSEC traffic PASSTHROUGH on the firewall © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  15. Slide 15: Session Creation for IPSEC traffic PASSTHROUGH on the firewall

    Session Creation for IPSEC traffic PASSTHROUGH on the firewall ● In case of pass-through IPSec traffic, where the Palo Alto Networks firewall is just an intermediate device between two IPSec peers, it is practically impossible to create a session based on negotiated SPI values since IKE phase 2 is encrypt

  16. Slide 16: Session Creation for IPSEC traffic PASSTHROUGH on the firewall

    Session Creation for IPSEC traffic PASSTHROUGH on the firewall © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  17. Slide 17: GRE tunnel traffic

    GRE tunnel traffic ● Protocol number? ● Source and Destination ports? ● Terminating and Transit tunnel? © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  18. Slide 18: GRE tunnel traffic

    GRE tunnel traffic © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  19. Slide 19: show session info Command

    show session info Command admin@fw-a> show session info target-dp: *.dp0 -------------------------------------------------------------------------------- Number of sessions supported: 65000 Number of allocated sessions: 5 Number of [... TCP, UDP, ICMP sessions ...] Maximum number of sessions for the

  20. Slide 20: Session States

    Session States = Stable states = Transient states OPENING INIT ACTIVE DISCARD FREE CLOSING CLOSED © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  21. Slide 21: Session Browser

    Session Browser Monitor > Session Browser admin@firewall-a> show session all -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport]/Zone/Proto (translated IP[Port]) Vsys Dst[Dport]/Zone (translated IP[Port]) ------------------------

  22. Slide 22: show session all Command

    show session all Command > show session all -------------------------------------------------------------------------------- ID Application State Type Flag Src[Sport] /Zone /Proto (translated IP[Port]) Vsys Dst[Dport] /Zone (translated IP[Port]) ------------------------------------------------------

  23. Slide 23: show session id <number> Command

    show session id <number> Command admin@fw-a> show session id 24030 Session 24030 c2s flow: source: 192.168.1.20 [inside] c2s source/destination IP and port. dst: 206.188.192.215 proto: 6 This is the initiator of the session. sport: 25877 dport: 80 state: ACTIVE type: FLOW src user: unknown dst user:

  24. Slide 24: Traffic Log: Session Details

    Traffic Log: Session Details Session End Reason: For UDP end usually is “aged-out.” © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  25. Slide 25: Session End Reasons

    Session End Reasons Reason Explanation threat A threat was detected and the rule action was “reset,” “drop,” or “block.” policy-deny The session matched a rule with the action set to “deny” or “drop.” decrypt-cert-validation The certificate was expired, untrusted, status unknown or otherwise “bad.”

  26. Slide 26: Traffic Log

    Traffic Log > show log traffic admin@fw-a> show log traffic direction equal backward Time App From Src Port Source Rule Action To Dst Port Destination Src User Dst User End Reason =============================================================================== 2018/03/17 16:54:01 flash inside 4433 192.

  27. Slide 27: Flow Logic

    Flow Logic © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  28. Slide 28: Flow Logic Discussion Agenda

    Flow Logic Discussion Agenda ● High-level view of data-plane processing and packet flow ● Detailed flows and explanations of major processing phases ○ Ingress ○ Session setup (slowpath) ○ Security processing (fastpath) ○ App-ID engine ○ Content-ID engine ○ Egress ● Summary block diagram © 2024 Palo Al

  29. Slide 29: Data-plane Processing

    Data-plane Processing L1-L2 send/receive Security processing ▪ Interfaces to physical network ▪ Session type, state, and profile ▪ Basis of security zone configuration ▪ Security policy Network processing ▪ Process ownership ▪ Packet parsing Layer 7 content inspection ▪ Session lookup ▪ App-ID ▪ Packe

  30. Slide 30: Data-plane Packet Flow

    Data-plane Packet Flow PHY PHY Packetize signals Network Processor Ingress Parse packets Session Setup Match packets Security to sessions Processor Security Processing Apply policy App-ID Continuously Pattern inspect session Match content Content-ID Network Egress Forward to exit Processor interface

  31. Slide 31: Ingress

    Ingress ♦ Parse L2/L3/L4 headers ♦ Check for errors Receive Packet ♦ Defragment ♦ Look up ingress zone IPsec or SSL Decrypt VPN? Yes No Match to an existing No session? Yes Session Setup (slowpath) Security Processing (fastpath) © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and co

  32. Slide 32: Matching Session

    Session Matching Session 52975 ▪ 1 session = 2 flows c2s flow: source: 10.1.10.21 [int-network] dst: 198.51.100.15 ▪ 6-tuple: proto: 6 sport: 49327 dport: 80 2 - Addresses (IP client and server) state: ACTIVE type: FLOW 2 - Ports (client and server) s2c flow: source: 198.51.100.15 [ext-internet] 1 -

  33. Slide 33: After Initial Packet Parsing…

    After Initial Packet Parsing… Session Setup (slowpath) Security Processing (fastpath) for the first packet of a new session for all packets (that are valid) ● Route lookup to find the egress zone ● L2-L4 processing: ○ Discard packet if session is not active ● NAT lookup ○ Update session lifetime ● Use

  34. Slide 34: Session Setup ("slowpath")

    Session Setup (“slowpath”) From Ingress Zone Protection Profile DoS Protection policy TCP state check Deny Forwarding lookup: Security Policy evaluation Get egress zone with application and URL category ignored Allow D-NAT Source IP = Yes apply? No Destination Yes IP? No Forwarding lookup based on p

  35. Slide 35: Security Processing ("fastpath")

    Security Processing (“fastpath”) Session Setup Ingress Layer 2-4 Processing Apply NAT ♦ Session management ♦ TCP reassembly SSL Forward Proxy App-ID Deny in session table? App-ID Applied No Yes Allow Application Shift L7 inspection Content-ID Applied complete? No Yes Allow Discard Forward/Egress © 2

  36. Slide 36: App-ID Applied

    App-ID Applied From Security Processing Application Pattern-based App-ID ▪ Session App-ID Override? = unknown No Match or “unknown” Match Check Security policy Yes SSL Forward Proxy with new App-ID Change in application Allow Deny detected? Yes Update session table: No App = SSL ▪ L7 processing (ena

  37. Slide 37: Content-ID/Content Inspection Applied

    Content-ID/Content Inspection Applied From Security Processing Protocol parse/decode ▪ Application Override with Signature match custom application = no ▪ L7 processing complete = no Tunneled application detection SSL Forward Proxy No Deny (encrypt) Detect application App-ID Applied No shift? Yes “A

  38. Slide 38: Overlap in App-ID and Content Inspection

    Overlap in App-ID and Content Inspection Two types of Layer 7 data: Metadata and instructions ▪ Signatures identify the application in use. App-ID ▪ Decoders reveal “content” and tunnels. Keys on “content” that per application does not change Content ▪ Parsing exposes URLs, files, and other data. ▪ S

  39. Slide 39: Egress

    Egress Packet forwarding (route/switch/virtual wire) QoS shaping IP fragmentation Egress to VPN tunnel? Encrypt Yes No Transmit packet © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  40. Slide 40: Session Offload (1/2)

    Session Offload (1/2) ● When a session no longer sends packets to the CPU for L7 processing, it is considered offloaded. ● For platforms with hardware offload capability actual performance is higher. Maximum performance is achieved through session offloading. ● Platforms with offload: ○ PA-3050, PA-3060, PA

  41. Slide 41: Session Offload (2/2)

    Session Offload (2/2) ● Conditions under which a session is offloaded ○ If no further need to perform application processing, then session may be offloaded (i.e. encrypted traffic, certain udp streams, etc.) ○ Certain traffic will not offload (i.e. web-browsing, ping) ○ If the traffic flows through a pair of

  42. Slide 42: Q & A

    Q& A © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

  43. Slide 43: Thank You

    Thank You paloaltonetworks.com © 2024 Palo Alto Networks, Inc. All rights reserved. Proprietary and confidential information.

Palo Alto Networks — Technical Presentation (March 2026) on 6ix