>
    Strata Copilot
    Configure Frontier Virtual Patching
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced Threat Prevention Powered by Precision AI®
    3. Configure Advanced Threat Prevention
    4. Configure Frontier Virtual Patching
    Download PDF
    Advanced Threat Prevention Powered by Precision AI®

    Configure Frontier Virtual Patching

    Table of Contents

    Configure Frontier Virtual Patching

    Enable Frontier Virtual Patching in your Vulnerability Protection profile and set actions by severity to protect against predisclosure vulnerabilities.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Strata Cloud Manager)
    • NGFW (Managed by PAN-OS or Panorama)
    • Advanced Threat Prevention Plus license
    You configure Frontier Virtual Patching as a module within your existing Vulnerability Protection profile. The module appears as a Frontier Virtual Patching tab alongside the existing Inline Cloud Analysis tab. Enabling Frontier Virtual Patching is independent of your Inline Cloud Analysis settings — you can enable or disable either service without affecting the other.
    After you enable Frontier Virtual Patching, the firewall downloads a pre-filter from the Frontier Virtual Patching cloud and begins pre-filtering traffic. No additional configuration is required to start receiving protections.

    Severity-Based Actions

    Frontier Virtual Patching organizes signatures into three severity categories: Critical, High, and Medium. You set an action for each severity category independently, allowing you to enforce different levels of response based on threat severity. For example, you might block Critical severity signatures while alerting on Medium severity signatures to gain visibility before enforcing.
    The available actions are:
    • alert—Log the detection but allow the traffic to pass. This is the default action when you first enable Frontier Virtual Patching.
    • allow—The firewall bypasses Frontier Virtual Patching cloud inspection for signatures in this category.
    • default—Use the Palo Alto Networks recommended action defined in the cloud.
    • reset-both—Send a TCP RST to both the client and server and drop the session.
    • reset-client—Send a TCP RST to the client and drop the session.
    • reset-server—Send a TCP RST to the server and drop the session.

    Default Profile Behavior

    Frontier Virtual Patching behavior depends on the profile type:
    • Default profile—Frontier Virtual Patching is not enabled. All severity actions are set to alert.
    • Default Strict profile—Frontier Virtual Patching is not enabled. All severity actions are set to default (uses the Palo Alto Networks recommended action per signature).
    • New custom profiles (created after ATP+ license activation)—Frontier Virtual Patching is enabled. All severity actions are set to alert.
    For brownfield deployments (upgrading to a PAN-OS version that supports Frontier Virtual Patching), existing profiles retain their current configuration — Frontier Virtual Patching is not automatically enabled on existing profiles to preserve your current traffic behavior.

    Forwarding Mode

    The action you configure determines how the firewall forwards traffic to the Frontier Virtual Patching cloud:
    • Block-type actions (reset-client, reset-server, reset-both, or default)—The firewall uses forwarding (hold) mode, holding the session until the cloud returns a verdict before allowing traffic to proceed.
    • Alert—The firewall uses mirror mode, sending a copy of the traffic to the cloud for inspection while allowing the original session to proceed without delay.
    • Allow—The firewall bypasses the session entirely without forwarding or mirroring.
    Frontier Virtual Patching shares the same forwarding mode behavior and maximum latency settings as Inline Cloud Analysis. The same setting controls both services. Frontier Virtual Patching uses Advanced Forwarding to establish high-performance TLS connections from the data plane to cloud service addresses. Advanced Forwarding is enabled by default on PAN-OS 12.2.2 and later. Verify that Advanced Forwarding is active on each firewall before enabling Frontier Virtual Patching.
    Frontier Virtual Patching requires outbound HTTPS access (TCP 443) from your firewalls to the following domains:
    • cds.fvp.tpcloud.paloaltonetworks.com—Frontier Virtual Patching cloud detection service
    • storage.googleapis.com—Signature and pre-filter delivery
    If your environment restricts outbound traffic through a firewall, proxy, or other network security device, add these domains to your network allow list.

    Strata Cloud Manager

    Enable and configure Frontier Virtual Patching in the Vulnerability Protection profile in Strata Cloud Manager.
    Enable Frontier Virtual Patching in a Vulnerability Protection profile to activate cloud-based predisclosure detection for traffic matched by this profile. The Frontier Virtual Patching tab displays a note that Frontier Virtual Patching is available with an active Advanced Threat Prevention Plus license and PAN-OS 12.2.4 or later.
    1. Select ConfigurationNGFW and Prisma AccessSecurity ServicesVulnerability Protection.
    2. Click Add Profile to create a new profile or select an existing profile to modify.
    3. Select the Frontier Virtual Patching tab.
    4. Enable the Enable Pre-emptive Protections with Frontier Virtual Patching checkbox.
      The detection table displays three severity categories (Critical, High, and Medium) with their default actions.
    5. For each severity category, choose the action to apply when a predisclosure signature of that severity matches traffic.
      The default action for all severity categories is alert. You can set a different action for each severity level independently.
    6. (Optional) Configure overrides for individual Frontier Virtual Patching signatures.
      You can exclude specific signatures from enforcement or change the action for individual Threat IDs. For details, see Frontier Virtual Patching Exceptions.
    7. Click Save to save the profile.
    8. Push your changes to the managed firewalls.
      After the push completes, the firewalls begin downloading the pre-filter and pre-filtering traffic. You can review Frontier Virtual Patching detections in the threat log (available on both the firewall and in Strata Cloud Manager).

    PAN-OS & Panorama

    Enable and configure Frontier Virtual Patching in the Vulnerability Protection profile on PAN-OS or Panorama.
    Enable Frontier Virtual Patching in a Vulnerability Protection profile to activate cloud-based predisclosure detection for traffic matched by this profile.
    1. Update the content release version to 9157-10279 or later.
    2. Verify that Advanced Forwarding is active on the firewall.
      Advanced Forwarding is enabled by default on PAN-OS 12.2.2 and later. You can validate the Advanced Forwarding configuration through the CLI.
      If you manage firewalls through Panorama, you can also verify the status from the Panorama management server:
      • Web interface—Select PanoramaManaged DevicesSummary and check the Advanced Forwarding Mode column for each firewall.
      • CLI—Run the following command: 
        admin@Panorama> show devices connected | match "Advanced Forwarding mode:"
  Advanced Forwarding mode: yes
      If Advanced Forwarding is not active, configure Advanced Forwarding settings on the managed firewalls.
    3. Select ObjectsSecurity ProfilesVulnerability Protection.
    4. Click Add to create a new profile or select an existing profile to modify.
    5. Select the Frontier Virtual Patching tab.
    6. Enable the Enable Frontier Virtual Patching checkbox.
      The detection table displays three severity categories (Critical, High, and Medium) with their current actions.
    7. For each severity category, choose the action to apply when a predisclosure signature of that severity matches traffic.
      The default action for all severity categories is alert. You can set a different action for each severity level independently.
    8. Click OK to save the profile.
    9. Commit your changes.
      After you commit, the firewall begins downloading the pre-filter and pre-filtering traffic. You can review Frontier Virtual Patching detections in the threat log.
    10. (Optional) Create exceptions for individual Frontier Virtual Patching signatures.
      You can change the action for individual Threat IDs or exclude specific signatures from enforcement. For details, see Frontier Virtual Patching Exceptions.

    © 2026 Palo Alto Networks, Inc. All rights reserved.