SSL decryption is a resource-intensive, session-oriented process that is performed directly by the Data Plane. The data plane handles all packet processing, security policy enforcement, and content inspection, including the cryptographic operations required for SSL/TLS decryption and re-encryption.

In Azure, for a virtual appliance like the VM-Series to receive traffic destined for IP addresses other than its own (i.e., to act as a router or firewall), IP Forwarding must be explicitly enabled on each network interface within the Azure NIC configuration. This is a platform-level setting distinct from the firewall’s own routing table.

Implementing an Auto Scaling group with a VM-Series High Availability (HA) cluster is the recommended strategy. This allows new firewall instances to automatically launch during traffic bursts and seamlessly join the HA pair. The HA state synchronization ensures that session and forwarding table states are shared, preventing disruption to existing connections during the scale-out event.

The management plane (mp0) handles non-forwarding tasks such as logging, configuration management, and communication with Panorama. If the management plane experiences a temporary issue or restart, it can interrupt logging and management functions while the separate data plane (dp0) continues to forward traffic based on its last known stateful tables and policies.

Using an AWS Transit Gateway (TGW) is the scalable and efficient modern practice. The TGW becomes the central network hub. You attach the Web VPC, Database VPC, and a dedicated Security VPC (hosting the VM-Series) to the TGW. Routing in the TGW route tables is then configured to send inter-VPC traffic through the Security VPC attachment for inspection, simplifying management compared to complex VPC peering and ENI configurations.

For BYOL models, the license is not tied to the Azure Marketplace image. You must first generate an authorization code from your Palo Alto Networks customer support portal account. Then, you log into the firewall’s web interface (or CLI) and navigate to Device > Setup > Operations, where you enter this code. This process registers the firewall’s serial number with your license entitlements on Palo Alto’s backend.

For Panorama bootstrap, the two critical pieces of information are: 1) The IP address or hostname of the Panorama server(s), and 2) A device authentication key. This key is generated within Panorama (under Panorama > Managed Devices) and uniquely ties the new firewall to your Panorama instance. When provided via cloud-init or user-data during VM launch, the firewall contacts Panorama, authenticates with this key, and downloads its initial configuration and policy.

Enabling TCP State Bypass (also known as FastPath) for specific, trusted high-volume flows (e.g., internal backup traffic or known-safe replication) is a valid optimization. This feature allows matching traffic to bypass the stateful inspection engine, significantly reducing per-packet CPU overhead. The other options either reduce visibility (disabling logs), reduce security (changing profiles), or are unlikely to impact sustained CPU load from high packet rates.

In GCP, routing is controlled by VPC network routes. For the VM-Series to perform source NAT for instances in a private subnet, a custom route must exist in the VPC’s route table. This route must define the default gateway (0.0.0.0/0) or specific external ranges, with the next-hop set to the internal interface IP of the VM-Series firewall. Without this route, the source instances’ outbound packets will not be directed to the firewall for NAT processing.

SSL decryption is a resource-intensive, session-oriented process that is performed directly by the Data Plane. The data plane handles all packet processing, security policy enforcement, and content inspection, including the cryptographic operations required for SSL/TLS decryption and re-encryption.0