Appearance
Palo Alto Firewall Overview
Purpose
This document describes the Palo Alto VM-Series firewall deployment across all three infrastructure environments. The firewalls provide network traffic inspection, zone-based access control, and advanced threat prevention for production, customer-facing, and DR environments.
Deployment Overview
Four Palo Alto VM-Series firewalls are deployed across three isolated network boundaries, each with a dedicated Panorama instance for centralized management.
| Environment | Platform | Repository | Panorama Status |
|---|---|---|---|
| Primary production | Azure (azure-infra) | azure-infra | No Panorama — managed via local GUI and Terraform |
| Azure dashboard | Azure (azure-infra) | azure-infra | No Panorama — managed via local GUI and Terraform |
| Customer AVD (DDE) | Azure (azure-dde-infra) | azure-dde-infra | ✅ Rebuilt (PAN-OS 12.1.2) — firewall reconnection pending reboot |
| Disaster recovery | AWS | aws-infra | ✅ Rebuilt (PAN-OS 12.1.2) — firewall connected and active |
Zone Architecture
All firewalls use a consistent three-zone model across every environment. Traffic between zones is denied by default and must be explicitly permitted by policy.
| Zone | Purpose |
|---|---|
untrust | External / internet-facing traffic, inbound customer connections |
trust | Internal production workloads, session hosts, application servers |
mgmt | Firewall management and infrastructure administration |
Zone Traffic Rules
- untrust → trust: Denied by default. Explicit allow rules required for each permitted flow.
- trust → untrust: Permitted for outbound traffic per policy. All outbound flows are inspected.
- mgmt: Strictly restricted to authorized admin sources only. No production traffic traverses the management zone.
Features in Use
App-ID Policies
Palo Alto's App-ID identifies applications based on traffic behavior rather than port and protocol alone. Security policies are written against application identities, not just port numbers. This prevents applications from bypassing controls by running on non-standard ports.
User-ID
User-ID maps network traffic to specific user identities, allowing security policies to be applied per user or group rather than just per IP address. This is particularly relevant in the DDE environment where AVD session traffic can be attributed to individual customer users.
Threat Prevention / IPS
Intrusion Prevention System (IPS) profiles are applied to inspect traffic for known exploits, vulnerability attempts, and malicious payloads. Threat signatures are updated regularly via Palo Alto's threat intelligence feeds.
URL Filtering
URL filtering enforces acceptable use policies and blocks access to known malicious, phishing, and inappropriate content categories. Applied to outbound traffic in the trust zone.
SSL Decryption
SSL/TLS decryption is configured to allow inspection of encrypted traffic. Without decryption, threat prevention and URL filtering cannot inspect HTTPS traffic. Decryption policies define which traffic categories are decrypted and inspected.
DNS Security
DNS Security inspects DNS queries and blocks requests to known malicious domains. This provides an additional layer of protection against command-and-control traffic, malware callbacks, and DNS-based data exfiltration.
Panorama — Current State
AWS Panorama (Operational)
Rebuilt March 2026 following disk space exhaustion on the previous instance. Lessons from the failure are applied to the new deployment.
| Configuration | Value |
|---|---|
| PAN-OS Version | 12.1.2 (Marketplace AMI) |
| System disk | 81 GB |
| Log disk | 100 GB (separate EBS volume, auto-detected) |
| max-num-images | 2 |
| max-num-config-backups | 10 |
| Termination protection | ✅ Enabled |
| Log forwarding | S3 archive shipping configured |
The AWS DR firewall has been re-onboarded and is actively connected to this Panorama instance. Syslog forwarding is configured for all log types (traffic, threat, auth, system, config, HIP match).
Known issue: FQDN object cortex-xdr.paloaltonetworks.com resolves correctly in Azure but not in AWS, causing Cortex XDR traffic to hit the Containment deny rule. Root cause is a DNS gap following departure from Cisco Umbrella. Fix: configure VPC resolver 10.99.0.2 as the DNS server via Panorama device template. Resolution in progress.
DDE Panorama (Rebuilt — Reconnection Pending)
Rebuilt March 2026 with the same lessons applied as the AWS instance.
| Configuration | Value |
|---|---|
| PAN-OS Version | 12.1.2 (Marketplace AMI) |
| Encryption at host | ✅ Enabled |
| Termination protection | ⚠️ Not set in Terraform — verify in Azure portal |
| Log disk | Separate volume, aggressive local retention |
| Disk space alert | 80% threshold configured |
| Log forwarding | S3/Azure Storage archive configured |
Outstanding: The DDE firewall is not yet reconnected to this Panorama instance. A reboot of the firewall is required to restore the Panorama connection. Scheduled for next available maintenance window.
Azure Production Panorama (Planned)
No Panorama instance exists for the Azure production environment. Both Azure production and dashboard firewalls are managed directly via local GUI and Terraform.
Roadmap:
- Phase 2: Deploy new Azure prod Panorama (Target: June/July 2026)
- Phase 3: Terraform manages Panorama via panos provider (Target: July/August 2026)
- Migrate Azure firewall configs into Panorama device groups and template stacks
Root cause of original Panorama failures: log storage filled disk with no log rotation or external forwarding configured. All rebuilt instances include separate log disks, aggressive local retention settings, and external log forwarding to prevent recurrence.
Syslog Infrastructure
Each environment has a dedicated syslog receiver VM that collects firewall logs and ships them to S3 archive storage.
| Environment | Syslog VM | Status | S3 Archive |
|---|---|---|---|
| Azure production | syslogazp (firewall subnet) | ✅ Operational | ✅ Shipping |
| AWS DR | syslogawp (Ubuntu 22.04, t3.small) | ✅ Operational | ✅ Shipping |
| DDE | syslogdde (private subnet) | ✅ Operational | ✅ Shipping |
syslogawp configuration: Ubuntu 22.04 LTS, t3.small, syslog-ng, IAM instance profile for S3 writes, IMDSv2 enforced, termination protection enabled.
Logging Status Per Firewall
| Firewall | Syslog | Arctic Wolf SIEM | VLC | Archive Forwarding |
|---|---|---|---|---|
| Azure production | ✅ Active | ✅ Active (VLC) | ✅ Active | ✅ Via syslog VM |
| Azure dashboard | ✅ Active | ✅ Active (VLC) | ✅ Active | ✅ Via syslog VM |
| DDE customer-facing | ✅ Active | ✅ Active (VLC) | ✅ Active | ✅ Via syslog VM |
| AWS DR | ✅ Active | ✅ Active (VLC) | ✅ Active | ✅ Via syslog VM → S3 |
All four VLCs confirmed showing active ingestion in Arctic Wolf portal as of March 2026.
Automated Config Backup (Operational)
Daily automated config backups are operational across all four firewalls. See Palo Alto Config Backup & Audit for full architecture.
- Azure Function (azure-infra) and Lambda (aws-infra) deployed in management subnets
- PAN-OS XML API export running on daily cron
- Configs stored in
firewall-configs/path inpalo-alto-configsrepo paths-ignoreapplied in CI/CD triggers to prevent deployment loops- Change detection alerts via SES operational
Change Management
Firewall policy changes follow the formal change request procedure documented in Firewall Change Request Procedure.
For Panorama-managed firewalls: changes are made in Panorama and pushed to managed devices. For locally-managed firewalls (Azure prod and dashboard): changes are made via local GUI and documented in the relevant Terraform repository.
All significant policy changes trigger a config backup diff alert via the automated backup pipeline, providing an automatic audit trail.
Compliance Relevance
| Requirement | How Firewalls Address It |
|---|---|
| HIPAA §164.312(e) — Transmission Security | Encrypted traffic inspection via SSL decryption, enforced zone policies |
| HIPAA §164.312(a) — Access Control | Zone-based policies restricting access to ePHI systems |
| HIPAA §164.308(a)(1) — Risk Management | Threat prevention and IPS reducing attack surface |
| SOC2 CC6.6 — Logical Access | Zone enforcement preventing unauthorized lateral movement |
| SOC2 CC6.7 — Data Transmission | Traffic inspection ensuring data flows through approved paths |
Known Operational Issues
| Issue | Environment | Status | Resolution |
|---|---|---|---|
| DDE firewall not connected to DDE Panorama | DDE | ⚠️ Open | Firewall reboot required; scheduled for next maintenance window |
AWS FQDN cortex-xdr.paloaltonetworks.com not resolving | AWS DR | ⚠️ Open | Configure VPC resolver 10.99.0.2 as DNS server via Panorama device template |
| Azure production Panorama not deployed | Azure PROD | 📋 Planned | Target June/July 2026 — deploy Panorama and migrate configs from local GUI |
| DDE Panorama termination protection not set in Terraform | DDE | ⚠️ Open | Verify and enable in Azure portal; add to Terraform if missing |
Upgrade Procedures
For Panorama and PAN-OS upgrade procedures, see Panorama Operations Guide.
Key lessons from 2026 rebuilds applied to all instances:
- Always provision a separate log disk (100 GB+) — system disk exhaustion caused both failures
- Set aggressive local log retention limits (
max-num-images 2,max-num-config-backups 10) - Enable external log forwarding before going live
- Enable termination protection immediately after deployment
Document History
| Date | Change | Author |
|---|---|---|
| April 2026 | Added explicit syslog VM names (syslogazp/syslogdde/syslogawp); added Known Operational Issues section; added DDE Panorama termination protection gap; added Upgrade Procedures section | Kobe |
| March 2026 | Updated Panorama status to reflect AWS rebuild (PAN-OS 12.1.2, 100GB log disk, termination protection) and DDE rebuild (reconnection pending); added syslog VM infrastructure table; updated all logging status to reflect VLC coverage complete; updated config backup status to Operational; added AWS FQDN known issue | Rory |
| March 2, 2026 | Updated management table to show actual local-only status, added logging status table per firewall | Rory |
| March 2026 | Added Panorama current state subsection with 4-firewall deployment status and remediation plan | Rory |
| February 2026 | Initial draft | Rory |