>
    Strata Copilot
    Modify Autoscaling: Existing Deployment
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AI Runtime Security VM Firewall
    5. Dynamic Autoscaling for Non-Mesh Firewalls
    6. Modify Autoscaling: Existing Deployment
    Download PDF
    Prisma AIRS

    Modify Autoscaling: Existing Deployment

    Table of Contents

    Modify Autoscaling: Existing Deployment

    Update autoscaling parameters — including instance bounds, metric thresholds, and Update Interval — on an existing Auto-Deploy non-mesh Prisma AIRS firewall on AWS, Azure, or GCP.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS
    • AWS
    • Azure
    • GCP
    • Prisma AIRS license
    • Access to Strata Cloud Manager
    • An existing non-mesh AIRS firewall deployed with dynamic autoscaling enabled
    Following are the steps to update autoscaling parameters on an existing Auto-Deploy non-mesh AIRS firewall on AWS, Azure, or GCP. Scaling mode cannot be changed.
    You Can Change Min/Max instance bounds, metric Update Interval, add new scaling metrics, edit thresholds on existing metrics, and remove metrics.
    • If you have disconnected firewalls in your deployment folder in Strata Cloud Manager Device Management page, you will see a failure in the folder push step in the existing firewall update workflow for autoscaling enabled non mesh firewalls.
    • If you have firewalls which are connected to Strata Cloud Manager but still have not completed bootstrapping, wait for it to complete. Only then trigger a brownfield update. Otherwise expect a failure in folder push during brownfield update.
    1. In your Strata Cloud Manager console, go to InsightsDiscover & Assess.
    2. In the Select Firewall placement page, select the existing auto-deployed firewall.
    3. Select Auto-Execute Workflow.
    4. In the autoscaling section, make your changes: adjust Min/Max bounds, change Update Interval, add/edit/remove scaling metrics.
    5. Proceed to the review page and verify the updated payload reflects all changes.
    6. Click Save & Auto-Execute.
    7. Monitor progress in Cloud Task Logs — an Update Firewall Configuration task will be triggered.

    GCP Manual Deployment Workflow

    GCP supports autoscaling for manually deployed non-mesh AIRS firewalls. This workflow requires running Terraform directly in your GCP security project.
    1. In your Strata Cloud Manager console, go to InsightsDiscover & AssessDeployAdd New Deployment.
    2. In the Firewall Deployments page, select GCP as your cloud provider, Subscription/Project, and Region.
    3. Select Download Terraform template and execute on your own option.
    4. Fill in all firewall configuration parameters including Min/Max instances, Update Interval, and scaling metrics.
    5. Enter a Terraform template name, then click Create Template. If the folder was previously used, you may see an “Object already exists” error. For more information, see Platform-Specific Reference.
    6. Download the generated Terraform template.
    7. In the GCP Console, go to your security project and run terraform apply.
    8. Verify the deployment: In the GCP Console, confirm that security infrastructures are created (firewalls, MIG, security vpcs — trust, untrust, and management).
    9. Navigate to VM Instances in the GCP Console to confirm your firewall instances are running.
    10. In your Strata Cloud Manager, ensure the GCP_VM_DEFAULT snippet is associated with your target folder.
    11. Verify snippet variables: confirm Trust Subnet Gateway address and Frontend ILB address values are correctly populated, along with all other required variable values.
    12. Perform a folder push from Strata Cloud Manager to apply configuration to the folder.
    13. Execute manual route stitching to complete the network setup.
    14. Verify firewall instances appear in Strata Cloud Manager Device Management and confirm serial numbers are licensed in the customer support portal.
    Tag Collector MIG: After a GCP Manual deployment, you will see two Managed Instance Groups in the GCP Console: one for the autoscaling firewall group and one for the tag collector. The autoscaling MIG is named [alias]-firewall-autoscale-common. You can safely disregard the tag collector MIG — it is not part of this feature.

    Decommissioning a GCP Manual Deployment

    Run terraform destroy from your GCP security project environment. This removes all associated cloud resources (MIG, VPCs, firewall instances). No additional cleanup is required in Strata Cloud Manager — the folder and device entries are removed automatically once the instances terminate.
    All autoscaling-triggered tasks are visible in Strata Cloud Manager under Cloud Task Logs. Key tasks to monitor:
    • Sync Firewall Instances with Template — runs on every scale-out or scale-in event
    • Update Firewall Configuration — runs after an existing autoscaling update
    • Deregister Firewall — runs when a scaled-in instance is removed

    © 2026 Palo Alto Networks, Inc. All rights reserved.