New Features - Cloud NGFW for Azure - October 2025

Cloud NGFW on Azure implements a billing change effective October 2025 to align peering costs with Microsoft Azure's standard rates for hub-spoke architectures. When you deploy Cloud NGFW in a hub vNET with spoke vNET peering to redirect traffic for inspection, Azure incurs standard peering charges that Palo Alto Networks temporarily absorbed since launch. Effective October 2025, the $0.01 per GB peering charge, which reflects Microsoft Azure's standard peering rate, will now be billed directly to your Marketplace billing account as a Pay-As-You-Go (PAYG) charge, even if you are on a credit consumption plan.

This change brings transparency to the actual cost of hub-spoke architectures and aligns with standard Azure networking pricing models. You can continue to use hub-spoke deployments with the same security capabilities, but with clearer visibility into all associated costs. The peering charges apply to traffic flowing between your spoke vNETs and the hub vNET where Cloud NGFW resides, ensuring you have complete visibility into your cloud security spending.

For more information, see Cloud NGFW Azure Pricing.