You can now deploy the Palo Alto Networks Container Native Firewalls (CN-Series) as a Container Network Function (CNF) to protect containerized as well as non-containerized workloads. This is a new deployment mode for the CN-Series firewall that augments the previously released CN-Series-as-a-daemonset and CN-Series-as-a-kubernetes service deployment modes, limited to protecting only container workloads.

Deploying the CN-Series-as-a-Kubernetes-CNF allows customers to run CN-Series in Layer-3 mode. This enables customers to steer the traffic to CN-Series from even non containerized sources. You can build resilient network security by deploying CN-Series in an HA pair. In the CNF mode of deployment, you can take advantage of I/O acceleration techniques such as DPDK and SR-IOV to boost the firewall performance.

You can now deploy the CN-Series as a kubernetes CNF in High Availability (HA) mode. This deployment mode currently supports active/passive HA with session and configuration synchronization.

The Kubernetes CNF mode of CN-Series now supports Data Plane Development Kit (DPDK) and allows the application pods to use DPDK. DPDK provides a simple framework for fast packet processing in dataplane applications.

You can set up DPDK on on-premises worker nodes and AWS EKS cluster.

Starting with PAN-10.2, the VM-Series and CN-Series firewalls support a maximum of 47 dataplane cores; an increase from the previous maximum of 31.