NetSec Spotlight: Cloud NGFW
Cloud adoption has fundamentally changed how network security needs to be delivered. Traditional firewall models, built around fixed perimeters and static network boundaries, don't translate cleanly into environments where workloads are ephemeral, distributed, and even span multiple cloud providers.
In cloud environments:
- Workloads can be dynamic and short-lived
- East-west traffic exceeds north-south traffic
- Identity and metadata are more reliable than IP addressing
- Security boundaries are defined in software, not physical topology
However, there is a gap between cloud-native network constructs (VPCs, VNets, security groups, access control lists) and the depth of inspection and control required for enterprise security.
Cloud NGFW addresses this gap by bringing consistent and context-aware security controls into cloud environments, without legacy assumptions about network location or trusted zones.
Platform Capabilities
Cloud NGFW is a cloud-native firewall service fully managed by Palo Alto Networks and deeply integrated into the fabric of the cloud provider's infrastructure, enabling:
- Layer 7 application visibility and control
- Identity-aware policy enforcement
- Decryption and content inspection
- Malware and threat prevention
- Segmentation across and within VPCs or VNets
- Consistent policy across hybrid and multi-cloud environments
The service extends familiar NGFW security with Cloud-Delivered Security Services (CDSS), and management with Strata Cloud Manager (SCM).
CDSS capabilities, such as Advanced Threat Prevention and Advanced WildFire, are available natively, using the same Single Pass Parallel Processing (SP3) architecture previously covered. Traffic is decrypted and inspected once, and evaluated against multiple security controls in parallel, regardless of whether enforcement happens on a hardware NGFW, Prisma Access, or Cloud NGFW.
Cloud NGFW provides full content and threat inspection depth in a cloud-native form factor. Importantly, it does so within the context of cloud-native constructs and APIs.
This includes:
- Route table manipulation and traffic steering
- Integration with Identity Providers
- Use of cloud metadata (tags, labels, instance attributes)
- API-driven policy updates and automation
Due to the first-party nature of the service, cloud teams are able to include the resource in their existing cloud-native processes and controls for automation, deployment, logging, and billing.
Since the Cloud NGFW is delivered as a service, the operational overhead of infrastructure and lifecycle management is removed. Traditional sizing exercises and manually designed high-availability deployments are no longer needed:
- Security instances scale for throughput automatically
- Availability zone resilience and affinity is configured automatically
- Upgrades and planned maintenance are carried out automatically
- Outages and unplanned maintenance are handled automatically
Operational Scenario
The default cloud-provider firewalls and tooling can detect and sometimes partially restrict malicious activity. Cloud NGFW closes the gap with context and application-aware inline enforcement.
For example, an attacker exploits a vulnerable application on an EC2 instance that has outbound internet access. Malware is used to initiate a Command-and-Control (C2) beacon within normal encrypted outbound application traffic.
With standard cloud-provider controls:
- Security groups and NACLs only have network-level visibility and allow the outbound HTTPS connection
- Traffic is not decrypted for full payload inspection by native controls, so remains encrypted and outside effective inspection
- Attacker now has an active presence with C2
- Attacker moves on to credential theft, privilege escalation, lateral movement, and data exfiltration or destruction
In the same scenario when Cloud NGFW is part of the cloud network architecture:
- Traffic is decrypted and inspected inline
- Malicious traffic or C2 behaviour is detected through a combination of decryption, threat intelligence, and behavioural analysis
- Session is blocked in real time and the potential breach is contained at an early stage
- Alert and optional automated response is triggered
Cloud Architecture
Cloud NGFW extends platform capabilities into AWS and Azure public clouds. In both cases, the service introduces some new terminology:
Cloud NGFW tenant: a logical management container per customer and per cloud-provider. The tenant can be linked to Strata Cloud Manager (SCM) for centralised management, policy, and visibility.
Cloud NGFW resource: the data plane that carries out traffic inspection and firewall capabilities. The resource is a regional service with built-in resilience and is dedicated per tenant to ensure traffic processing is kept separate from other customers.
The Cloud NGFW resource runs in a Palo Alto managed environment, with some nuances in the way the back end service is built and traffic is steered:
AWS: uses a VPC Endpoint service (branded as a NGFW Endpoint) in the customer VPC, which connects to a Gateway Load Balancer in the Palo Alto VPC. Behind this, Cloud NGFW resources use Auto Scaling Groups across Availability Zones.
Azure: relies on user defined routes in the customer environment to send traffic to a Palo Alto managed Azure Load Balancer. Behind this, Cloud NGFW resources use Virtual Machine Scale Sets across Availability Zones.
In both cases, the routes are defined by the customer, and the cloud-provider private backbone network is used for connectivity.
There are 2 main deployment topologies for the Cloud NGFW:
Centralised: where a hub and spoke network design is in place (such as a Transit Gateway or VWAN/VNet hub), a centralised security VPC or VNet makes the connection to the Cloud NGFW resource. This approach simplifies connectivity and scales well.
Distributed: in a distributed topology each VPC or VNet requiring inspection creates a direct connection to the Cloud NGFW resource. This approach is useful for smaller or isolated environments and certain use cases.
Reference architectures for both topologies can be found in the Palo Alto Live Community pages below:
In summary, Cloud NGFW represents a shift from network-centric security to application and context-driven enforcement within public cloud.
In practice, this results in:
- Consistent policy across environments
- Reduced operational overhead
- Improved visibility into application and workload behaviour
- Greater threat protection and security posture
- Stronger alignment with Zero Trust principles