Cloud infrastructure expects seamless scaling, but the reality for security appliances has often been more complex. Whether you’re managing a sudden traffic surge or recovering from an unexpected instance failure, the speed at which your firewall can join or leave the network is critical to maintaining both application availability and budget efficiency.
To address these challenges, we are introducing two significant updates to the VM-Series on AWS: native Warm Pool integration and the Panorama Delicensing Manager. Together, these features streamline the lifecycle of your software firewalls from initial boot to final decommissioning.
The Challenge: The "Scale Gap"
Historically, autoscaling firewalls has involved two primary operational hurdles:
- The Boot Time Penalty: Traditional firewall initialization can often take over 15 minutes. To compensate for this delay, customers are often forced to set scaling thresholds lower to ensure capacity is available before a surge peaks, leading to over-provisioning.
- License Entitlement Lag: When an instance scales in or fails, reclaiming the FW FLEX license has often required manual intervention or waiting for sporadic timeouts. This "stuck" license ties up credits that could be used elsewhere in the environment.
The Solution: Closing the Lifecycle Loop
1. Faster Scale-Out with AWS Warm Pools
By integrating with AWS Warm Pools, VM-Series instances can now reside in a "pre-initialized" state. This effectively moves the heavy lifting of the boot process out of the critical path of a scaling event.
- 90-Second Readiness: New instances can now be ready to inspect traffic within 90 seconds of a scale-out trigger if using “warm running” state
- Optimized Credit Use: Instances sitting in a Warm Pool are marked as "Allocated" but not "Consumed." Credits are only fully applied once the instance is pulled into active service.
2. Automated Cleanup with the Delicensing Manager
Reclaiming credits is now handled by the Delicensing Manager (DM), a new configuration object within Panorama that synchronizes your license pool with your AWS Auto Scaling Groups (ASGs).
- 15-30-Minute Recovery: The DM monitors AWS lifecycle events. When an ASG terminates an instance or an instance fails a health probe, the DM reclaims the license and returns the credits to your pool within 30 minutes.
- Resilient Failure Recovery: Because the DM communicates directly with AWS APIs, it can de-license a firewall even if the instance has suffered a kernel-level failure that would otherwise prevent the firewall from communicating its status.
- Management Hygiene: The DM can be configured to automatically remove terminated firewalls from Panorama Device Groups and Template Stacks, reducing the manual effort required to keep your security console up to date.
