Cloud NGFW is a cloud-native Next-Generation Firewall fully managed by Palo Alto Networks. Starting August 2026, Palo Alto Networks customers can use Software NGFW (VM-Flex) credits to fund Cloud NGFW for AWS and Azure resources. This feature establishes a single, unified currency for both Software NGFW and Cloud NGFW services, offering unmatched financial flexibility and simplifying procurement across your hybrid and multi-cloud environments.
Previously, customers managed separate credit pools or pay-as-you-go subscriptions for self-managed instances and PAN-managed Cloud NGFW resources, leading to fragmented tracking and procurement cycles. With the single, unified credit model introduced by Credit Unification, you can now seamlessly allocate your existing Software NGFW credits to secure your cloud-native applications. This flexibility lets you dynamically shift security investments between on-premises environments and the public cloud as your architectural needs evolve, without new purchase orders or multi-month procurement cycles, leading to lower overall TCO.
To further support your elastic cloud environments, this release includes a smart credit buffer. This helps to prevent your Cloud NGFW resources from incurring AWS/Azure Marketplace overage charges via pay-as-you-go (PAYG). The smart credit buffer acts as a credit reserve, comprised of unallocated credits in your credit pool. If your credit consumption requirements exceed the number of credits you have allocated to Cloud NGFW resources via your deployment profile, Cloud NGFW will first use any reserve credits present in the smart credit buffer to absorb the spike in consumption. AWS/Azure Marketplace PAYG overage billing will be triggered only if consumption exceeds both the allocated credits in your deployment profile and the available unallocated credits in your smart credit buffer. This provides peace of mind by ensuring you use all purchased credits and the true cost-effective elasticity required for modern cloud-native applications.
Cloud NGFW Credit Unification is now generally available for all new deployments. You can manage credit allocation, configure deployment profiles, and monitor usage directly through the Customer Support Portal and the enhanced Credit Management System (CMS) Hub application.
General & Capability Questions
Q: What is Cloud NGFW Credit Unification?
Credit Unification allows you to use standard Software NGFW (VM-Flex) credits to fund Cloud NGFW for AWS and Azure consumption. It replaces past siloed credit pools with a single, fungible security currency.
Q: Can I use my existing Software NGFW credits to deploy Cloud NGFW today?
Yes. You can instantly allocate existing Software NGFW credits to your Cloud NGFW tenants via the Customer Support Portal.
Q: Does this change affect pay-as-you-go (PAYG) deployments?
No. Customers who prefer the PAYG subscription model through the AWS or Azure Marketplaces can continue using it without disruption.
Technical & Process Questions
Q: Will I risk traffic disruption if I enable the unified credit model on my existing deployment?
No. Transitioning to the unified credit model happens at the billing and management layer within the Customer Support Portal. It does not alter your firewall routing, security policies, or live traffic flows.
Q: How do I track my credit consumption?
You can track all usage within the Credit Management System (CMS) Hub application. The dashboard provides granular, per-firewall insights and allows you to establish Deployment Profiles to allocate specific credit limits to your AWS and Azure environments. You can view a chart or table view of credit allocation, consumption, smart credit usage, overages incurred and a breakdown of usage across Cloud-Delivered Security Services (CDSS) subscriptions.
Q: What happens if I exceed my allocated credits during a traffic burst?
To further support your elastic cloud environments, this release includes a smart credit buffer. The smart credit buffer prevents pay-as-you-go (PAYG) overage charges by automatically using your pool's unallocated credits as a reserve to absorb unexpected consumption spikes. You will only incur AWS or Azure Marketplace overage billing if your usage exceeds both the credits assigned to your deployment profile and the available reserve.
Q: Is there any change to how I configure and manage Cloud NGFW policies?
There is no change. You would continue using the same method/approach you use today.
Q: Can I use Software NGFW credits for enabling advanced security services like URL Filtering or Threat Prevention on Cloud NGFW?
Yes. You can allocate your unified credits to fund the base Cloud NGFW resource, traffic volume, and all Cloud-Delivered Security Services (CDSS) subscriptions and Centralized Management (Panorama, SCM).
Learn More
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
| Subject | Likes |
|---|---|
| 6 Likes | |
| 3 Likes | |
| 2 Likes | |
| 2 Likes | |
| 1 Like |
| User | Likes Count |
|---|---|
| 7 | |
| 3 | |
| 3 | |
| 2 | |
| 1 |
