>
    Strata Copilot
    Dynamic Autoscaling for Non-Mesh Firewalls
    Focus
    Download PDF
    Focus
    1. Home
    2. Prisma AIRS
    3. AI Runtime Security
    4. AI Runtime Security VM Firewall
    5. Dynamic Autoscaling for Non-Mesh Firewalls
    Download PDF
    Prisma AIRS

    Dynamic Autoscaling for Non-Mesh Firewalls

    Table of Contents

    Dynamic Autoscaling for Non-Mesh Firewalls

    Automatically scale your Prisma AIRS firewall fleet up or down in response to real-time traffic load — without manual intervention — by defining performance thresholds on key firewall metrics that Strata Cloud Manager translates into cloud-native autoscaling policies.
    Where Can I Use This?What Do I Need?
    • Prisma AIRS
    • AWS
    • Azure
    • GCP
    • Prisma AIRS license
    • Access to Strata Cloud Manager
    • A cloud account (AWS, Azure, or GCP) connected to Strata Cloud Manager
    • Available VNet/VPC and subnets in the target region
    • Valid AIRS firewall Auth Code and SSH key pair
    Dynamic Autoscaling for non-mesh firewalls enables your Prisma® AIRS™ firewall fleet to automatically expand or contract in response to real-time traffic loads. By establishing custom performance thresholds within Strata Cloud Manager, the platform seamlessly translates your target utilization settings into cloud-native scaling policies utilizing AWS Auto Scaling Groups, Azure Virtual Machine Scale Sets, or GCP Managed Instance Groups. This capability ensures consistent security enforcement and application performance during unexpected traffic bursts while optimizing cloud infrastructure costs during low-demand periods. Dynamic autoscaling is supported for both Auto-Deploy and Manual non-mesh workflows across AWS, Azure, and GCP cloud environments.
    Transitioning an existing deployment between Static and Dynamic scaling modes is not supported. Choose your scaling approach before initial deployment.
    Scale-out and scale-in cooldown periods are set as product defaults in the Terraform templates generated by Strata Cloud Manager. They are not configurable through the Strata Cloud Manager UI. If you need to change these values, you can do so directly in the cloud provider's console (AWS Console, Azure Portal, or GCP Console) or by editing the Terraform variables in the generated template for a manual scenario.

    Configure Autoscaling: New Deployment

    Following are the steps to enable dynamic autoscaling when deploying a new non-mesh AIRS firewall on AWS, Azure, or GCP (Auto-Deploy):
    1. In your Strata Cloud Manager console, go to InsightsDiscover & AssessDeployAdd Firewall Deployment.
    2. In the Firewall Deployments page, select your Cloud Provider and Traffic Streams to inspect.
    3. Select Auto Execute option.
    4. Select Account, Region, Applications, and VPC to protect.
    5. Under Firewall Configuration, set Scaling Type to Dynamic.
    6. Set Min Instances and Max Instances to define capacity boundaries.
    7. Set the Update Interval (e.g., 5 minutes) — how often metrics are published to the cloud monitoring service.
    8. Enable one or more scaling metrics and configure their scale-out thresholds.
    9. Complete standard parameters: Software Version, Auth Code PIN, SSH Key, Target Folder.
    10. Review the generated configuration payload. Verify that dynamic_scaling: true, the Update Interval, metric thresholds, and Min/Max values are all correctly reflected before proceeding.
    11. Click Save & Auto-Execute to deploy.

    © 2026 Palo Alto Networks, Inc. All rights reserved.