>
    Strata Copilot
    Dynamic Autoscaling for Non-Mesh Firewalls
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AIRS VM Firewall
    5. Dynamic Autoscaling for Non-Mesh Firewalls
    Download PDF
    Prisma AIRS

    Dynamic Autoscaling for Non-Mesh Firewalls

    Table of Contents

    Dynamic Autoscaling for Non-Mesh Firewalls

    Automatically scale your Prisma AIRS firewall fleet up or down in response to real-time traffic load — without manual intervention — by defining performance thresholds on key firewall metrics that Strata Cloud Manager translates into cloud-native autoscaling policies.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS
    • AWS
    • Azure
    • GCP
    • Prisma AIRS license
    • Access to Strata Cloud Manager
    • A cloud account (AWS, Azure, or GCP) connected to Strata Cloud Manager
    • Available VNet/VPC and subnets in the target region
    • Valid AIRS firewall Auth Code and SSH key pair
    Dynamic autoscaling for non-mesh firewalls enables your Prisma AIRS firewall fleet to automatically expand or contract in response to real-time traffic loads. By establishing custom performance thresholds within Strata Cloud Manager, the platform translates your target utilization settings into cloud-native scaling policies — using AWS Auto Scaling Groups, Azure Virtual Machine Scale Sets, or GCP Managed Instance Groups. This ensures consistent security enforcement and application performance during unexpected traffic bursts while optimizing cloud infrastructure costs during low-demand periods.
    Dynamic autoscaling is supported for both Auto-Deploy and Manual non-mesh workflows across AWS, Azure, and GCP.
    Transitioning an existing deployment between Static and Dynamic scaling modes is not supported. Choose your scaling approach before initial deployment.
    Scale-out and scale-in cooldown periods are set as product defaults in the Terraform templates generated by Strata Cloud Manager and are not configurable through the Strata Cloud Manager UI. To change these values, edit them directly in the cloud provider's console (AWS Console, Azure Portal, or GCP Console) or in the Terraform variables in the generated template for a manual scenario.

    Autoscaling Metrics

    Configure one or more of the following firewall metrics as autoscaling triggers. You set the scale-out threshold; the platform automatically computes the scale-in threshold.
    Supported Autoscaling Metrics
    MetricDescription
    CPU UtilizationDataplane CPU utilization percentage
    Session UtilizationSession table utilization percentage
    Session ThroughputTotal session throughput in kilobits per second
    Active SessionsTotal number of active sessions
    Connections Per SecondNew connections established per second
    Packet Buffer UtilizationDataplane packet buffer utilization percentage
    SSL Proxy UtilizationSSL decryption session utilization percentage
    GlobalProtect Active TunnelsGlobalProtect gateway active tunnel count
    GlobalProtect Tunnel UtilizationGlobalProtect gateway tunnel utilization percentage
    By default, each firewall instance emits the above metrics to the cloud monitoring service at the configured Update Interval. Only the metrics you explicitly configure in Strata Cloud Manager are used to trigger scaling actions.

    Configuration Parameters Reference

    Autoscaling Configuration Parameters
    ParameterDescription
    Min InstancesMinimum number of firewall instances to maintain at all times (scale-in floor).
    Max InstancesMaximum number of instances the autoscaler may launch (scale-out ceiling).
    Update IntervalHow often (in minutes) each firewall publishes metrics to the cloud monitoring service.
    Metric ThresholdThe scale-out trigger value per metric. The scale-in threshold is automatically computed by the platform — you do not need to configure it.

    Platform-Specific Autoscaling Behavior

    Scaling behavior, monitoring resources, and cooldown periods vary by cloud provider. Review the relevant section for your environment before deploying.
    AWS (Auto-Deploy)
    PropertyDetail
    Scaling MechanismAuto Scaling Group (ASG) via Target Tracking Policy in Terraform
    Monitoring and MetricsCloudWatch — a unique namespace is created per deployment, named after the firewall alias. A high alarm (scale-out trigger) and an auto-computed low alarm (scale-in trigger) are created for each configured metric.
    Scale-Out BehaviorComputes required capacity in one step (for example, 2 to 4 instances simultaneously). AWS uses Target Tracking Policy to calculate exactly how many instances are needed and provisions them all at once. This behavior is not configurable from the Strata Cloud Manager UI.
    Scale-In BehaviorScale-in threshold is auto-computed. Requires the metric to remain below the threshold for 15 consecutive data points within 15 minutes before triggering scale-in. Scale-out checks only 3 data points, making scale-in intentionally more conservative. For AWS, you can only configure the scale-out target; scale-in is managed automatically by AWS target-tracking.
    Scale-Out CooldownAWS target-tracking policy defaults apply automatically.
    Scale-In CooldownAWS target-tracking policy defaults apply automatically.
    DecommissioningDecommissioning terminates all security infrastructure (firewalls, Auto Scaling Group, security VPCs, subnets, and so on). CloudWatch metrics expire based on retention schedules. Once data publishing stops, metrics drop out of the console list after 14 days of inactivity and are completely removed after 15 months.
    Azure (Auto-Deploy)
    PropertyDetail
    Scaling MechanismVirtual Machine Scale Sets (VMSS) via Terraform
    Monitoring and MetricsApplication Insights — one dedicated resource per deployment, named [alias]-common-VMSS-AI, aggregates custom firewall metrics.
    Scale-Out BehaviorIncreases one instance at a time. Scale-out threshold is user-configured.
    Scale-In BehaviorThe scale-in threshold is controlled by Terraform and automatically set to 20% of the scale-out threshold, with a minimum value of 20. For example: scale-out 200 → scale-in 40; scale-out 80 → scale-in 20.
    Scale-Out Cooldown30 minutes (product default, configured in generated Terraform). Adjustable via Azure Portal or Terraform — not via Strata Cloud Manager UI.
    Scale-In Cooldown1 hour (product default, configured in generated Terraform). After one instance is terminated, the next scale-in can occur no sooner than 1 hour later. Adjustable via Azure Portal or Terraform — not via Strata Cloud Manager UI.
    DecommissioningAll VMSS, scaling rules, Application Insights resources, and auto-created management subfolders are automatically deleted.
    GCP (Auto-Deploy and Manual)
    PropertyDetail
    Scaling MechanismManaged Instance Groups (MIG) via Cloud Monitoring metrics. MIG is named [alias]-firewall-autoscale-common.
    Monitoring and MetricsGoogle Cloud Monitoring — metrics are emitted by each firewall instance and aggregated across the group.
    Scale-Out BehaviorThe autoscaler adds instances to maintain average group metrics at or below the configured target utilization. Depending on traffic load, it may provision multiple instances simultaneously. Metrics from newly created instances are ignored during their initial 8-minute boot phase.
    Scale-In BehaviorAverage load must remain below the target for approximately 10 minutes (GCP autoscaler stabilization period) before scale-in triggers. Once triggered, scale-in controls limit removal to a maximum of 1 instance per rolling 30-minute window.
    Scale-Out CooldownNew instances undergo an 8-minute initialization period (cooldown_period = 480s in Terraform), during which their metrics are excluded from autoscaling calculations.
    Scale-In CooldownRestricted to removing at most 1 instance per rolling 30-minute window via Terraform scale-in controls. Not configurable on Strata Cloud Manager UI.
    Decommissioning (Auto-Deploy)Automated removal wipes all security infrastructure (firewalls, MIG, security VPCs — trust, untrust, management).
    Decommissioning (Manual)Run terraform destroy from your GCP security project environment to remove all security infrastructure. No additional cleanup is required in Strata Cloud Manager — folder and device entries are removed automatically once instances terminate.

    Monitor Autoscaling Activity in Cloud Task Logs

    All autoscaling-triggered tasks are visible in Strata Cloud Manager under Cloud Task Logs. Key tasks to monitor:
    • Sync Firewall Instances with Template — runs on every scale-out or scale-in event
    • Update Firewall Configuration — runs after an existing autoscaling update
    • Deregister Firewall — runs when a scaled-in instance is removed

    © 2026 Palo Alto Networks, Inc. All rights reserved.