Autoscale (manually created VM-SERIES) on AWS

[Cdchamberlin]

two firewalls behind an NLB. 

what approach would you take to spin up additional firewalls if a certain threshold is hit (what threshold would you trigger on)? 

i've looked at the templates provided by palo alto but this would be adding additional firewalls in already established VPCs. 

also use panorama

[jperry1 · Accepted solution]

That would vary based on your environment and the type of traffic you inspect. You may want to look at a sample size of your data to find the value better suited for your app mix. For example,  if you have high session count traffic then you may want to trigger based on session utilization table. If you have traffic that depleted dataplane cpu then you may want to look at the processor utilization. It all depends on the type of traffic you have. Our Auto Scale templates support this and you can set your ASG to have 2 FW by default. But if manually scale is what you want you will have to manually monitor this or write a script to check either metric. 

[jperry1]

Also, for AWS auto scale 2.1, it supports deployment into an existing application environment. 

https://docs.paloaltonetworks.com/vm-series/9-0/vm-series-deployment/set-up-the-vm-series-firewall-o...