>
    Strata Copilot
    Configure Dynamic Autoscaling for a New Non-Mesh Firewall Deployment
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AIRS VM Firewall
    5. Dynamic Autoscaling for Non-Mesh Firewalls
    6. Configure Dynamic Autoscaling for a New Non-Mesh Firewall Deployment
    Download PDF
    Prisma AIRS

    Configure Dynamic Autoscaling for a New Non-Mesh Firewall Deployment

    Table of Contents

    Configure Dynamic Autoscaling for a New Non-Mesh Firewall Deployment

    Enable dynamic autoscaling when deploying a new non-mesh Prisma AIRS firewall on AWS, Azure, or GCP using the Auto-Deploy (Auto-Execute) workflow in Strata Cloud Manager.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS
    • AWS
    • Azure
    • GCP
    • Prisma AIRS license
    • Access to Strata Cloud Manager
    • A cloud account (AWS, Azure, or GCP) connected to Strata Cloud Manager
    • Available VNet/VPC and subnets in the target region
    • Valid AIRS firewall Auth Code and SSH key pair
    Use this procedure to enable dynamic autoscaling as part of a new non-mesh AIRS firewall deployment using the Auto-Execute workflow. Dynamic autoscaling lets Strata Cloud Manager automatically adjust your firewall fleet size based on real-time traffic metrics — so you maintain security enforcement during traffic spikes without over-provisioning for steady-state load.
    Transitioning an existing deployment between Static and Dynamic scaling modes is not supported. Choose your scaling approach before initial deployment.
    1. In Strata Cloud Manager, go to InsightsDiscover & AssessDeployAdd Firewall Deployment.
    2. On the Select Cloud Service Provider page, select your Cloud Provider (AWS, Google Cloud Platform, or Azure) and select the Traffic Streams to Inspect.
    3. On the Select Firewall Placement page, select New under Firewalls and select the Auto-Execute execution type.
      For GCP, if you prefer to manage the Terraform deployment yourself, select Download Terraform templates and execute on my own instead. See Configure Dynamic Autoscaling for a GCP Manual Deployment.
    4. Select your Account, Region, Applications, and VPC to protect.
    5. On the Deployment Parameters page, under Firewall Scaling, select Dynamic.
    6. Set Min Instances and Max Instances to define capacity boundaries.
    7. Set the Update Interval (for example, 5 minutes) to define how often metrics are published to the cloud monitoring service.
    8. Enable one or more Auto Scaling Metrics and configure their scale-out thresholds.
      The platform automatically computes the scale-in threshold for each metric you configure. For details on available metrics, see Dynamic Autoscaling for Non-Mesh Firewalls.
    9. Complete the remaining standard parameters: Software Version, Auth Code PIN, SSH Key, and Target Folder.
    10. Review the generated configuration payload. Verify that dynamic_scaling: true, the Update Interval, metric thresholds, and Min/Max values are all correctly reflected before proceeding.
    11. Click Save & Auto-Execute to deploy.
    Strata Cloud Manager deploys your non-mesh firewall fleet with dynamic autoscaling enabled. You can monitor deployment progress under Cloud Task Logs.

    © 2026 Palo Alto Networks, Inc. All rights reserved.