You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Cloud NGFW by Palo Alto Networks frequently asked questions
4
+
description: Answers to common questions about using Cloud NGFW by Palo Alto Networks including deployment, management, and configuration.
5
+
ms.topic: faq
6
+
ai-usage: ai-generated
7
+
ms.date: 12/18/2025
8
+
9
+
title: Cloud NGFW by Palo Alto Networks FAQ
10
+
summary: |
11
+
12
+
sections:
13
+
- name: General
14
+
questions:
15
+
- question: What is Cloud NGFW by Palo Alto Networks?
16
+
answer: Cloud NGFW by Palo Alto Networks is a next-generation firewall delivered as an integrated service on Azure. Microsoft and Palo Alto Networks codeveloped and managed it. The product combines the scalability and reliability of Azure with Palo Alto Networks network security expertise. You can find it in Azure Marketplace and manage it through the Azure portal.
17
+
- question: What are the key capabilities of Cloud NGFW?
- Advanced Threat Prevention for protection against known and unknown threats
23
+
- DNS Security for domain filtering
24
+
- Cloud-Delivered Security Services for continuous threat intelligence
25
+
- Destination Network Address Translation (DNAT) for inbound traffic
26
+
- Support for both Virtual Network and Virtual WAN deployments
27
+
- question: How do I subscribe to Cloud NGFW by Palo Alto Networks?
28
+
answer: You can find Cloud NGFW by Palo Alto Networks in Azure Marketplace and subscribe directly through the Azure portal. No separate Palo Alto portal registration is required. Select the **Cloud NGFW by Palo Alto Networks - an Azure Native ISV Service (PAYG)** plan during subscription.
29
+
- question: Where can I learn more about Cloud NGFW?
30
+
answer: Refer to the [Cloud NGFW documentation](https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure) from Palo Alto Networks for comprehensive product information and detailed configuration guidance.
31
+
32
+
- name: Deployment
33
+
questions:
34
+
- question: What deployment options are available for Cloud NGFW?
35
+
answer: Cloud NGFW supports two deployment architectures, which are hub-and-spoke virtual networks and Virtual WAN. For web applications, you can deploy Cloud NGFW behind Azure Application Gateway to combine reverse proxy, load balancing, and web application firewall capabilities with Cloud NGFW network security.
36
+
- question: What is the recommended architecture for securing web applications?
37
+
answer: |
38
+
The recommended architecture uses Application Gateway as a reverse proxy and load balancer with Cloud NGFW for network security inspection. This combination provides:
39
+
- WAF protection at the web application layer
40
+
- HTTP/HTTPS proxying through Application Gateway
41
+
- Network inspection and policy enforcement through Cloud NGFW
42
+
- A single public IP address for web traffic
43
+
- Non-HTTP traffic inspection through Cloud NGFW's public IP address
44
+
- question: How does Cloud NGFW work with Virtual WAN?
45
+
answer: With Virtual WAN, you configure routing intent and routing policy to use Cloud NGFW as a next hop for public or private traffic. All connected spoke virtual networks, VPN gateways, and ExpressRoute gateways receive routing information to send traffic through Cloud NGFW for inspection and security policy enforcement.
46
+
- question: Can I use Cloud NGFW with both Virtual Networks and Virtual WAN?
47
+
answer: Yes, Cloud NGFW can be deployed in either hub-and-spoke virtual networks or Virtual WAN environments. Choose the deployment option that aligns with your network architecture and security requirements.
48
+
49
+
- name: Management and Configuration
50
+
questions:
51
+
- question: How many security policy management options are available?
52
+
answer: Cloud NGFW supports three security policy management options. You can choose to manage policies through Azure Rulestacks (native Azure portal management), Palo Alto Networks Panorama (enterprise policy management), or Palo Alto Networks Strata Cloud Manager.
53
+
- question: What is Azure Rulestack?
54
+
answer: Azure Rulestack is a native Azure policy management solution that allows you to configure security rules and apply security profiles directly in the Azure portal or through APIs. You can manage rules, security services, prefix lists, FQDN lists, and certificates all within the Azure environment.
55
+
- question: What security services can I configure with Azure Rulestack?
56
+
answer: |
57
+
With Azure Rulestack, you can configure and manage:
- Advanced URL Filtering for web access management
60
+
- DNS Security for threat-based domain filtering
61
+
- Encrypted Threat Protection for egress decryption
62
+
- question: Can I manage Cloud NGFW with Palo Alto Networks Panorama?
63
+
answer: Yes. You can manage Cloud NGFW resources using Palo Alto Networks Panorama for centralized policy management. When using Panorama, you configure zone-based policies to treat traffic flows appropriately and apply existing policy constructs like template stacks, zones, and vulnerability profiles.
64
+
- question: What are the main settings I can manage after deployment?
65
+
answer: |
66
+
After deploying Cloud NGFW, you can manage:
67
+
- Networking and NAT (SNAT and DNAT configurations)
68
+
- Security policies and rules
69
+
- Log settings and monitoring
70
+
- DNS Proxy settings
71
+
- Billing plan changes
72
+
- Resource locks and properties
73
+
74
+
- name: Networking and NAT
75
+
questions:
76
+
- question: What does DNAT do in Cloud NGFW?
77
+
answer: Destination Network Address Translation (DNAT) allows Cloud NGFW to accept client connections on public IP addresses and perform address translation and traffic inspection. This approach enables inbound connections to be routed to internal resources while enforcing security policies.
78
+
- question: What is Source NAT (SNAT) in Cloud NGFW?
79
+
answer: Source Network Address Translation (SNAT) allows you to configure how outbound traffic from your virtual network is translated. You can specify public IP addresses for outbound traffic, and Cloud NGFW can replace the source IP with a trusted firewall IP address through Private Source NAT.
80
+
- question: How do I configure traffic routing through Cloud NGFW?
81
+
answer: Create user-defined routes that specify Cloud NGFW's private IP address as the next hop. You can find the private IP address by viewing the resource overview in the Azure portal. Associate these routes with subnets to force traffic through Cloud NGFW for inspection.
82
+
- question: Can I add multiple prefixes to my private traffic range?
83
+
answer: Yes. In the Networking & NAT settings, you can select **Edit**, enable the **Additional Prefixes** checkbox, and add the prefixes you want to include in your private traffic range.
84
+
85
+
- name: Application Gateway Integration
86
+
questions:
87
+
- question: How do I use Cloud NGFW with Application Gateway?
88
+
answer: Deploy Application Gateway in a separate virtual network and peer it with your hub network containing Cloud NGFW. Create user-defined routes in the Application Gateway subnet to direct traffic through Cloud NGFW for inspection. Application Gateway functions as a reverse proxy and WAF, while Cloud NGFW provides network security inspection.
89
+
- question: Should I disable default route propagation when using Application Gateway with Virtual WAN?
90
+
answer: |
91
+
Yes, when connecting the Application Gateway virtual network to a Virtual WAN hub, disable the **Propagate Default Route** option to prevent asymmetric routing. This configuration allows Application Gateway-sourced traffic to break out locally rather than returning through the virtual hub.
92
+
- question: What traffic should go through Cloud NGFW versus Application Gateway?
93
+
answer: HTTP and HTTPS web traffic should be routed through Application Gateway for reverse proxy, load balancing, and WAF protection. Non-HTTP connections should be directed to Cloud NGFW's public IP address for network inspection and policy enforcement.
94
+
95
+
- name: Security Policy Considerations
96
+
questions:
97
+
- question: Is the X-Forwarded-For (XFF) HTTP header supported with Azure Rulestacks?
98
+
answer: Currently, use of the X-Forwarded-For HTTP header field to enforce security policy isn't supported with Azure Rulestacks. This limitation is important to consider when configuring policies for Application Gateway traffic.
99
+
- question: How should I configure zone-based policies when using Panorama?
100
+
answer: |
101
+
When using Panorama with Cloud NGFW, configure two zones: private and public. Traffic flows are:
102
+
- **Inbound**: from public to private
103
+
- **Outbound**: from private to public
104
+
- **East-West**: from private to private
105
+
Apply special considerations to zone-based policies to ensure traffic from Application Gateway private IP source is treated as inbound with appropriate security rules, threat prevention profiles, and inline cloud analysis.
106
+
- question: How do I view and manage security rules in Azure Rulestack?
107
+
answer: In the Cloud NGFW resource's **Security Policies** settings, select your rulestack name to access the rulestack management page. Select **Rules** to view existing rules and add, edit, or delete them. When editing rules, you can configure parameters and validate the configuration before saving.
108
+
109
+
- name: Monitoring and Operations
110
+
questions:
111
+
- question: How can I monitor Cloud NGFW resources?
112
+
answer: You can enable logging through the **Log Settings** option in the Azure portal. The properties page displays essentials like resource ID, name, location, network profile, DNS settings, and plan data.
113
+
- question: What logging options are available?
114
+
answer: Cloud NGFW supports log settings that you can enable in the resource's management pane. Select **Log Settings** under **Settings**, then select **Edit** and enable **Log Settings** to activate logging for your firewall.
115
+
- question: How do I get support for Cloud NGFW?
116
+
answer: |
117
+
Contact [Palo Alto Networks support](https://support.paloaltonetworks.com/Support/Index) for customer support. You can also request support directly from the Azure portal by selecting **Support + Troubleshooting** > **New support request** from the resource overview page, which provides a link to Palo Alto Networks support.
118
+
119
+
- name: Billing and Plans
120
+
questions:
121
+
- question: What billing plan options are available?
122
+
answer: Cloud NGFW is available under a pay-as-you-go billing model. Billing through Azure provides unified invoicing for both infrastructure and software costs in a single line item.
123
+
- question: Can I change my billing plan after deployment?
124
+
answer: Yes. You can change your billing plan by selecting **Change Plan** from the resource overview page in the Azure portal.
125
+
- question: How is Cloud NGFW billed?
126
+
answer: Cloud NGFW appears as a single line item in your Azure bill, which includes both infrastructure and software costs. You're charged based on your PAYG plan selected during resource creation.
127
+
128
+
- name: Management and Maintenance
129
+
questions:
130
+
- question: Can I add resource locks to my Cloud NGFW resource?
131
+
answer: Yes. You can add resource locks through the **Locks** settings in the resource management pane. Select **Add** to create a new lock, then provide a name, type, and optional notes. You can also edit or delete existing locks.
132
+
- question: How do I delete a Cloud NGFW resource?
133
+
answer: The **Delete** button is only available after all connected resources are deleted. Once prerequisites are met, select **Delete** from the resource overview page to remove the Cloud NGFW resource.
134
+
- question: How do I change security policies after deployment?
135
+
answer: The process depends on your policy management option. With Azure Rulestack, navigate to the rulestack management page to modify rules and security services. With Panorama, manage policies through the Panorama console. With Strata Cloud Manager, manage policies through that platform.
136
+
137
+
additionalContent: |
138
+
## Related content
139
+
140
+
To learn more, see [What is Cloud NGFW by Palo Alto Networks?](overview.md)
0 commit comments