[](https://www.paloaltonetworks.com/?ts=markdown)

* Sign In
  
  * Customer
  * Partner
  * Employee
  * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown)
  * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown)

* EN
  
  * [USA (ENGLISH)](https://www.paloaltonetworks.com)
  * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au)
  * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br)
  * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca)
  * [CHINA (简体中文)](https://www.paloaltonetworks.cn)
  * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr)
  * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de)
  * [INDIA (ENGLISH)](https://www.paloaltonetworks.in)
  * [ITALY (ITALIANO)](https://www.paloaltonetworks.it)
  * [JAPAN (日本語)](https://www.paloaltonetworks.jp)
  * [KOREA (한국어)](https://www.paloaltonetworks.co.kr)
  * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat)
  * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx)
  * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg)
  * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es)
  * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw)
  * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk)

* ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)

* [What's New](https://www.paloaltonetworks.com/resources?ts=markdown)

* [Get Support](https://support.paloaltonetworks.com/SupportAccount/MyAccount)

* [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html)
  ![x close icon to close mobile navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg) [![Palo Alto Networks logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)](https://www.paloaltonetworks.com/?ts=markdown) ![magnifying glass search icon to open search field](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg)

* [](https://www.paloaltonetworks.com/?ts=markdown)

* Products  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Products  
  [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)
  
  * [AI Security](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)
  
  * [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
  
  * [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)
  
  * [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)
  
  * [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
  
  * [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)
  
  * [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)
  
  * [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
  
  * [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
  
  * [Enterprise Device Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)
  
  * [Medical Device Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)
  
  * [OT Device Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown)
  
  * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)
  
  * [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)
  
  * [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)
  
  * [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
  
  * [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)
  
  * [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)
  
  * [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)
  
  * [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)
  
  * [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)
  
  * [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)
  
  * [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)
  
  * [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)
  
  * [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)
  
  * [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)
  
  * [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)
  
  * [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)
  
  * [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)
  
  * [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)  
    [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)
  
  * [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
  
  * [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)
  
  * [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)
  
  * [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)
  
  * [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)
  
  * [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)
  
  * [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)
  
  * [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)
  
  * [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)
  
  * [Cortex AgentiX](https://www.paloaltonetworks.com/cortex/agentix?ts=markdown)
  
  * [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)
  
  * [Cortex Exposure Management](https://www.paloaltonetworks.com/cortex/exposure-management?ts=markdown)
  
  * [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)
  
  * [Cortex Advanced Email Security](https://www.paloaltonetworks.com/cortex/advanced-email-security?ts=markdown)
  
  * [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
  
  * [Unit 42 Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* Solutions  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Solutions  
  Secure AI by Design
  
  * [Secure AI Ecosystem](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)
  * [Secure GenAI Usage](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)  
    Network Security
  * [Cloud Network Security](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)
  * [Data Center Security](https://www.paloaltonetworks.com/network-security/data-center?ts=markdown)
  * [DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)
  * [Intrusion Detection and Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)
  * [Device Security](https://www.paloaltonetworks.com/network-security/device-security?ts=markdown)
  * [OT Security](https://www.paloaltonetworks.com/network-security/ot-device-security?ts=markdown)
  * [5G Security](https://www.paloaltonetworks.com/network-security/5g-security?ts=markdown)
  * [Secure All Apps, Users and Locations](https://www.paloaltonetworks.com/sase/secure-users-data-apps-devices?ts=markdown)
  * [Secure Branch Transformation](https://www.paloaltonetworks.com/sase/secure-branch-transformation?ts=markdown)
  * [Secure Work on Any Device](https://www.paloaltonetworks.com/sase/secure-work-on-any-device?ts=markdown)
  * [VPN Replacement](https://www.paloaltonetworks.com/sase/vpn-replacement-for-secure-remote-access?ts=markdown)
  * [Web \& Phishing Security](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)  
    Cloud Security
  * [Application Security Posture Management (ASPM)](https://www.paloaltonetworks.com/cortex/cloud/application-security-posture-management?ts=markdown)
  * [Software Supply Chain Security](https://www.paloaltonetworks.com/cortex/cloud/software-supply-chain-security?ts=markdown)
  * [Code Security](https://www.paloaltonetworks.com/cortex/cloud/code-security?ts=markdown)
  * [Cloud Security Posture Management (CSPM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-security-posture-management?ts=markdown)
  * [Cloud Infrastructure Entitlement Management (CIEM)](https://www.paloaltonetworks.com/cortex/cloud/cloud-infrastructure-entitlement-management?ts=markdown)
  * [Data Security Posture Management (DSPM)](https://www.paloaltonetworks.com/cortex/cloud/data-security-posture-management?ts=markdown)
  * [AI Security Posture Management (AI-SPM)](https://www.paloaltonetworks.com/cortex/cloud/ai-security-posture-management?ts=markdown)
  * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
  * [Cloud Workload Protection (CWP)](https://www.paloaltonetworks.com/cortex/cloud/cloud-workload-protection?ts=markdown)
  * [Web Application \& API Security (WAAS)](https://www.paloaltonetworks.com/cortex/cloud/web-app-api-security?ts=markdown)  
    Security Operations
  * [Cloud Detection \& Response](https://www.paloaltonetworks.com/cortex/cloud-detection-and-response?ts=markdown)
  * [Security Information and Event Management](https://www.paloaltonetworks.com/cortex/modernize-siem?ts=markdown)
  * [Network Security Automation](https://www.paloaltonetworks.com/cortex/network-security-automation?ts=markdown)
  * [Incident Case Management](https://www.paloaltonetworks.com/cortex/incident-case-management?ts=markdown)
  * [SOC Automation](https://www.paloaltonetworks.com/cortex/security-operations-automation?ts=markdown)
  * [Threat Intel Management](https://www.paloaltonetworks.com/cortex/threat-intel-management?ts=markdown)
  * [Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)
  * [Attack Surface Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/attack-surface-management?ts=markdown)
  * [Compliance Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/compliance-management?ts=markdown)
  * [Internet Operations Management](https://www.paloaltonetworks.com/cortex/cortex-xpanse/internet-operations-management?ts=markdown)
  * [Extended Data Lake (XDL)](https://www.paloaltonetworks.com/cortex/cortex-xdl?ts=markdown)
  * [Agentic Assistant](https://www.paloaltonetworks.com/cortex/cortex-agentic-assistant?ts=markdown)  
    Endpoint Security
  * [Endpoint Protection](https://www.paloaltonetworks.com/cortex/endpoint-protection?ts=markdown)
  * [Extended Detection \& Response](https://www.paloaltonetworks.com/cortex/detection-and-response?ts=markdown)
  * [Ransomware Protection](https://www.paloaltonetworks.com/cortex/ransomware-protection?ts=markdown)
  * [Digital Forensics](https://www.paloaltonetworks.com/cortex/digital-forensics?ts=markdown)  
    [Industries](https://www.paloaltonetworks.com/industry?ts=markdown)
  * [Public Sector](https://www.paloaltonetworks.com/industry/public-sector?ts=markdown)
  * [Financial Services](https://www.paloaltonetworks.com/industry/financial-services?ts=markdown)
  * [Manufacturing](https://www.paloaltonetworks.com/industry/manufacturing?ts=markdown)
  * [Healthcare](https://www.paloaltonetworks.com/industry/healthcare?ts=markdown)
  * [Small \& Medium Business Solutions](https://www.paloaltonetworks.com/industry/small-medium-business-portfolio?ts=markdown)

* Services  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Services  
  [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)
  
  * [Assess](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)
  
  * [AI Security Assessment](https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment?ts=markdown)
  
  * [Attack Surface Assessment](https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment?ts=markdown)
  
  * [Breach Readiness Review](https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review?ts=markdown)
  
  * [BEC Readiness Assessment](https://www.paloaltonetworks.com/bec-readiness-assessment?ts=markdown)
  
  * [Cloud Security Assessment](https://www.paloaltonetworks.com/unit42/assess/cloud-security-assessment?ts=markdown)
  
  * [Compromise Assessment](https://www.paloaltonetworks.com/unit42/assess/compromise-assessment?ts=markdown)
  
  * [Cyber Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment?ts=markdown)
  
  * [M\&A Cyber Due Diligence](https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-diligence?ts=markdown)
  
  * [Penetration Testing](https://www.paloaltonetworks.com/unit42/assess/penetration-testing?ts=markdown)
  
  * [Purple Team Exercises](https://www.paloaltonetworks.com/unit42/assess/purple-teaming?ts=markdown)
  
  * [Ransomware Readiness Assessment](https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment?ts=markdown)
  
  * [SOC Assessment](https://www.paloaltonetworks.com/unit42/assess/soc-assessment?ts=markdown)
  
  * [Supply Chain Risk Assessment](https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment?ts=markdown)
  
  * [Tabletop Exercises](https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise?ts=markdown)
  
  * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)
  
  * [Respond](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)
  
  * [Cloud Incident Response](https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response?ts=markdown)
  
  * [Digital Forensics](https://www.paloaltonetworks.com/unit42/respond/digital-forensics?ts=markdown)
  
  * [Incident Response](https://www.paloaltonetworks.com/unit42/respond/incident-response?ts=markdown)
  
  * [Managed Detection and Response](https://www.paloaltonetworks.com/unit42/respond/managed-detection-response?ts=markdown)
  
  * [Managed Threat Hunting](https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting?ts=markdown)
  
  * [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)
  
  * [Unit 42 Retainer](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)
  
  * [Transform](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)
  
  * [IR Plan Development and Review](https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review?ts=markdown)
  
  * [Security Program Design](https://www.paloaltonetworks.com/unit42/transform/security-program-design?ts=markdown)
  
  * [Virtual CISO](https://www.paloaltonetworks.com/unit42/transform/vciso?ts=markdown)
  
  * [Zero Trust Advisory](https://www.paloaltonetworks.com/unit42/transform/zero-trust-advisory?ts=markdown)  
    [Global Customer Services](https://www.paloaltonetworks.com/services?ts=markdown)
  
  * [Education \& Training](https://www.paloaltonetworks.com/services/education?ts=markdown)
  
  * [Professional Services](https://www.paloaltonetworks.com/services/consulting?ts=markdown)
  
  * [Success Tools](https://www.paloaltonetworks.com/services/customer-success-tools?ts=markdown)
  
  * [Support Services](https://www.paloaltonetworks.com/services/solution-assurance?ts=markdown)
  
  * [Customer Success](https://www.paloaltonetworks.com/services/customer-success?ts=markdown)  
    [![](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-unit-42.svg)  
    UNIT 42 RETAINER
    Custom-built to fit your organization's needs, you can choose to allocate your retainer hours to any of our offerings, including proactive cyber risk management services. Learn how you can put the world-class Unit 42 Incident Response team on speed dial.
    Learn more](https://www.paloaltonetworks.com/unit42/retainer?ts=markdown)

* Partners  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Partners  
  NextWave Partners
  
  * [NextWave Partner Community](https://www.paloaltonetworks.com/partners?ts=markdown)
  * [Cloud Service Providers](https://www.paloaltonetworks.com/partners/nextwave-for-csp?ts=markdown)
  * [Global Systems Integrators](https://www.paloaltonetworks.com/partners/nextwave-for-gsi?ts=markdown)
  * [Technology Partners](https://www.paloaltonetworks.com/partners/technology-partners?ts=markdown)
  * [Service Providers](https://www.paloaltonetworks.com/partners/service-providers?ts=markdown)
  * [Solution Providers](https://www.paloaltonetworks.com/partners/nextwave-solution-providers?ts=markdown)
  * [Managed Security Service Providers](https://www.paloaltonetworks.com/partners/managed-security-service-providers?ts=markdown)
  * [XMDR Partners](https://www.paloaltonetworks.com/partners/managed-security-service-providers/xmdr?ts=markdown)  
    Take Action
  * [Portal Login](https://www.paloaltonetworks.com/partners/nextwave-partner-portal?ts=markdown)
  * [Managed Services Program](https://www.paloaltonetworks.com/partners/managed-security-services-provider-program?ts=markdown)
  * [Become a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=becomepartner)
  * [Request Access](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerregistration?type=requestaccess)
  * [Find a Partner](https://paloaltonetworks.my.site.com/NextWavePartnerProgram/s/partnerlocator)  
    [CYBERFORCE
    CYBERFORCE represents the top 1% of partner engineers trusted for their security expertise.
    Learn more](https://www.paloaltonetworks.com/cyberforce?ts=markdown)

* Company  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Company  
  Palo Alto Networks
  
  * [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
  * [Management Team](https://www.paloaltonetworks.com/about-us/management?ts=markdown)
  * [Investor Relations](https://investors.paloaltonetworks.com)
  * [Locations](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
  * [Ethics \& Compliance](https://www.paloaltonetworks.com/company/ethics-and-compliance?ts=markdown)
  * [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
  * [Military \& Veterans](https://jobs.paloaltonetworks.com/military)  
    [Why Palo Alto Networks?](https://www.paloaltonetworks.com/why-paloaltonetworks?ts=markdown)
  * [Precision AI Security](https://www.paloaltonetworks.com/precision-ai-security?ts=markdown)
  * [Our Platform Approach](https://www.paloaltonetworks.com/why-paloaltonetworks/platformization?ts=markdown)
  * [Accelerate Your Cybersecurity Transformation](https://www.paloaltonetworks.com/why-paloaltonetworks/nam-cxo-portfolio?ts=markdown)
  * [Awards \& Recognition](https://www.paloaltonetworks.com/about-us/awards?ts=markdown)
  * [Customer Stories](https://www.paloaltonetworks.com/customers?ts=markdown)
  * [Global Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
  * [Trust 360 Program](https://www.paloaltonetworks.com/resources/whitepapers/trust-360?ts=markdown)  
    Careers
  * [Overview](https://jobs.paloaltonetworks.com/)
  * [Culture \& Benefits](https://jobs.paloaltonetworks.com/en/culture/)  
    [A Newsweek Most Loved Workplace
    "Businesses that do right by their employees"
    Read more](https://www.paloaltonetworks.com/company/press/2021/palo-alto-networks-secures-top-ranking-on-newsweek-s-most-loved-workplaces-list-for-2021?ts=markdown)

* More  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) More  
  Resources
  
  * [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
  * [Unit 42 Threat Research](https://unit42.paloaltonetworks.com/)
  * [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
  * [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
  * [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
  * [Tech Insider](https://techinsider.paloaltonetworks.com/)
  * [Knowledge Base](https://knowledgebase.paloaltonetworks.com/)
  * [Palo Alto Networks TV](https://tv.paloaltonetworks.com/)
  * [Perspectives of Leaders](https://www.paloaltonetworks.com/perspectives/?ts=markdown)
  * [Cyber Perspectives Magazine](https://www.paloaltonetworks.com/cybersecurity-perspectives/cyber-perspectives-magazine?ts=markdown)
  * [Regional Cloud Locations](https://www.paloaltonetworks.com/products/regional-cloud-locations?ts=markdown)
  * [Tech Docs](https://docs.paloaltonetworks.com/)
  * [Security Posture Assessment](https://www.paloaltonetworks.com/security-posture-assessment?ts=markdown)
  * [Threat Vector Podcast](https://unit42.paloaltonetworks.com/unit-42-threat-vector-podcast/)
  * [Packet Pushers Podcasts](https://www.paloaltonetworks.com/podcasts/packet-pusher?ts=markdown)  
    Connect
  * [LIVE community](https://live.paloaltonetworks.com/)
  * [Events](https://events.paloaltonetworks.com/)
  * [Executive Briefing Center](https://www.paloaltonetworks.com/about-us/executive-briefing-program?ts=markdown)
  * [Demos](https://www.paloaltonetworks.com/demos?ts=markdown)
  * [Contact us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)  
    [Blog
    Stay up-to-date on industry trends and the latest innovations from the world's largest cybersecurity
    Learn more](https://www.paloaltonetworks.com/blog/)

* Sign In  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Sign In
  
  * Customer
  * Partner
  * Employee
  * [Login to download](https://www.paloaltonetworks.com/login?ts=markdown)
  * [Join us to become a member](https://www.paloaltonetworks.com/login?screenToRender=traditionalRegistration&ts=markdown)

* EN  
  ![black arrow pointing left to go back to main navigation](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg) Language
  
  * [USA (ENGLISH)](https://www.paloaltonetworks.com)
  * [AUSTRALIA (ENGLISH)](https://www.paloaltonetworks.com.au)
  * [BRAZIL (PORTUGUÉS)](https://www.paloaltonetworks.com.br)
  * [CANADA (ENGLISH)](https://www.paloaltonetworks.ca)
  * [CHINA (简体中文)](https://www.paloaltonetworks.cn)
  * [FRANCE (FRANÇAIS)](https://www.paloaltonetworks.fr)
  * [GERMANY (DEUTSCH)](https://www.paloaltonetworks.de)
  * [INDIA (ENGLISH)](https://www.paloaltonetworks.in)
  * [ITALY (ITALIANO)](https://www.paloaltonetworks.it)
  * [JAPAN (日本語)](https://www.paloaltonetworks.jp)
  * [KOREA (한국어)](https://www.paloaltonetworks.co.kr)
  * [LATIN AMERICA (ESPAÑOL)](https://www.paloaltonetworks.lat)
  * [MEXICO (ESPAÑOL)](https://www.paloaltonetworks.com.mx)
  * [SINGAPORE (ENGLISH)](https://www.paloaltonetworks.sg)
  * [SPAIN (ESPAÑOL)](https://www.paloaltonetworks.es)
  * [TAIWAN (繁體中文)](https://www.paloaltonetworks.tw)
  * [UK (ENGLISH)](https://www.paloaltonetworks.co.uk)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)

* [What's New](https://www.paloaltonetworks.com/resources?ts=markdown)

* [Get support](https://support.paloaltonetworks.com/SupportAccount/MyAccount)

* [Under Attack?](https://start.paloaltonetworks.com/contact-unit42.html)

* [Demos and Trials](https://www.paloaltonetworks.com/get-started?ts=markdown)  
  Search  
  All

* [Tech Docs](https://docs.paloaltonetworks.com/search)  
  Close search modal
  [Deploy Bravely --- Secure your AI transformation with Prisma AIRS](https://www.deploybravely.com)  
  [](https://www.paloaltonetworks.com/?ts=markdown)

1. [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
2. [Cloud Security](https://www.paloaltonetworks.com/cyberpedia/cloud-security?ts=markdown)
3. [What Is the Role of a Firewall in SD-WAN Architecture?](https://www.paloaltonetworks.com/cyberpedia/how-are-firewalls-and-sd-wan-related?ts=markdown)  
   Table of contents

* [The distinct functions of firewalls and SD-WAN](#the-distinct-functions-of-firewalls-and-sd-wan)
* [How firewalls and SD-WAN evolved to overlap](#how-firewalls-and-sd-wan-evolved-to-overlap)
* [How does a firewall actually work within SD-WAN?](#how-does-a-firewall-actually-work-within-sd-wan)
* [Where does inspection occur in the SD-WAN data path?](#where-does-inspection-occur-in-the-sd-wan-data-path)
* [What are the main deployment models for firewalling in SD-WAN?](#what-are-the-main-deployment-models-for-firewalling-in-sd-wan)
* [How centralized management ties firewall and SD-WAN policies together](#how-centralized-management-ties-firewall-and-sd-wan-policies-together)
* [When is a standalone firewall still needed?](#when-is-a-standalone-firewall-still-needed)
* [How SD-WAN and firewall convergence lays the groundwork for SASE](#how-sd-wan-and-firewall-convergence-lays-the-groundwork-for-sase)
* [SD-WAN firewall FAQs](#sd-wan-firewall-faqs)

# What Is the Role of a Firewall in SD-WAN Architecture?

6 min. read  
Table of contents

* [The distinct functions of firewalls and SD-WAN](#the-distinct-functions-of-firewalls-and-sd-wan)
* [How firewalls and SD-WAN evolved to overlap](#how-firewalls-and-sd-wan-evolved-to-overlap)
* [How does a firewall actually work within SD-WAN?](#how-does-a-firewall-actually-work-within-sd-wan)
* [Where does inspection occur in the SD-WAN data path?](#where-does-inspection-occur-in-the-sd-wan-data-path)
* [What are the main deployment models for firewalling in SD-WAN?](#what-are-the-main-deployment-models-for-firewalling-in-sd-wan)
* [How centralized management ties firewall and SD-WAN policies together](#how-centralized-management-ties-firewall-and-sd-wan-policies-together)
* [When is a standalone firewall still needed?](#when-is-a-standalone-firewall-still-needed)
* [How SD-WAN and firewall convergence lays the groundwork for SASE](#how-sd-wan-and-firewall-convergence-lays-the-groundwork-for-sase)
* [SD-WAN firewall FAQs](#sd-wan-firewall-faqs)

1. The distinct functions of firewalls and SD-WAN

* [1. The distinct functions of firewalls and SD-WAN](#the-distinct-functions-of-firewalls-and-sd-wan)
* [2. How firewalls and SD-WAN evolved to overlap](#how-firewalls-and-sd-wan-evolved-to-overlap)
* [3. How does a firewall actually work within SD-WAN?](#how-does-a-firewall-actually-work-within-sd-wan)
* [4. Where does inspection occur in the SD-WAN data path?](#where-does-inspection-occur-in-the-sd-wan-data-path)
* [5. What are the main deployment models for firewalling in SD-WAN?](#what-are-the-main-deployment-models-for-firewalling-in-sd-wan)
* [6. How centralized management ties firewall and SD-WAN policies together](#how-centralized-management-ties-firewall-and-sd-wan-policies-together)
* [7. When is a standalone firewall still needed?](#when-is-a-standalone-firewall-still-needed)
* [8. How SD-WAN and firewall convergence lays the groundwork for SASE](#how-sd-wan-and-firewall-convergence-lays-the-groundwork-for-sase)
* [9. SD-WAN firewall FAQs](#sd-wan-firewall-faqs)  
  ![How Are Firewalls and SD-WAN Related?](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/video-thumbnail-how-are-firewalls-and-sd-wan-related.png)  
  close

The role of a firewall in SD-WAN architecture is to inspect and control network traffic that passes through the SD-WAN fabric according to defined security policies.

It identifies applications, users, and content to enforce segmentation and prevent unauthorized access.

By integrating these functions into the SD-WAN data plane, the firewall ensures secure, consistent traffic handling across branches, data centers, and cloud connections.

## The distinct functions of firewalls and SD-WAN

[SD-WAN](https://www.paloaltonetworks.com/cyberpedia/what-is-sd-wan) and [firewalls](https://www.paloaltonetworks.com/cyberpedia/what-is-a-firewall) both manage traffic. They just do it in different ways.

SD-WAN uses software to decide how data moves across the network.  
![Diagram labeled 'SD-WAN architecture' showing six branch office icons, three on each side, connected to a central data center box at the bottom. The branches and data center also connect upward to a box labeled 'Internet' that contains cloud service logos including AWS, Azure, Google Cloud, Dropbox, Salesforce, and Workday. Green lines represent MPLS, purple lines represent cellular, and blue lines represent broadband, all shown in the key at the bottom.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/how-are-firewalls-and-sd-wan-related/SD-WAN-architecture.png)

It builds virtual overlays that sit on top of physical connections---like [MPLS](https://www.paloaltonetworks.com/cyberpedia/mpls-what-is-multiprotocol-label-switching), broadband, or LTE---and steers traffic based on application type, performance, or policy. In other words, it controls where data goes and how it gets there.  
![Diagram titled 'SD-WAN dynamic path selection and traffic steering' showing a branch office at the top connected to two pathways. On the left, application thresholds lead to SD-WAN traffic steering, which includes session load distribution, path quality profile, and traffic distribution profile. These link to a VPN virtual interface labeled IPSec interfaces in red, with arrows pointing through a private network to headquarters. On the right, a DIA virtual interface labeled Ethernet interfaces in blue connects through a private network and the public internet to Internet/SaaS. Labels note metrics such as path latency, jitter, and packet loss, with top down priority indicated in the flow.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/how-are-firewalls-and-sd-wan-related/Dynamic-path-selection-and-traffic-steering.png)

The goal is simple: maintain speed, reliability, and efficiency across every branch and cloud path.

A firewall focuses on what moves through those paths.

It inspects packets at multiple layers, from basic network information to the application itself. It checks identities, matches sessions to policies, and blocks anything that violates rules or appears unsafe. That includes enforcing [segmentation](https://www.paloaltonetworks.com/cyberpedia/what-is-network-segmentation) so users and systems only access what they should.  
![Diagram titled 'How firewall rules evaluate traffic' shows a flowchart beginning with an incoming packet entering a firewall. The first decision point is 'Check IP address rules.' If there is no match, the packet is blocked and a security event is logged. If there is a match, the process continues to 'Check port rules.' Again, if there is no match, the packet is blocked and a security event is logged. If there is a match, the packet moves to 'Check protocol rules.' If this also matches, the packet is allowed and logged as allowed traffic. Red arrows indicate blocked traffic paths and are labeled 'No match' with actions to 'Block packet' and 'Log security event.' Green arrows indicate matched traffic paths with actions to 'Allow traffic' and 'Log allowed traffic.' Each step is visually represented by icons: document icons for rule checks, an 'X' icon for blocked packets, and a checkmark icon for allowed traffic.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/how-are-firewalls-and-sd-wan-related/How-firewall-rules-evaluate-traffic.png "Diagram titled 'How firewall rules evaluate traffic' shows a flowchart beginning with an incoming packet entering a firewall. The first decision point is 'Check IP address rules.' If there is no match, the packet is blocked and a security event is logged. If there is a match, the process continues to 'Check port rules.' Again, if there is no match, the packet is blocked and a security event is logged. If there is a match, the packet moves to 'Check protocol rules.' If this also matches, the packet is allowed and logged as allowed traffic. Red arrows indicate blocked traffic paths and are labeled 'No match' with actions to 'Block packet' and 'Log security event.' Green arrows indicate matched traffic paths with actions to 'Allow traffic' and 'Log allowed traffic.' Each step is visually represented by icons: document icons for rule checks, an 'X' icon for blocked packets, and a checkmark icon for allowed traffic.")

When these functions meet inside one architecture, SD-WAN provides intelligent routing while the firewall enforces security within each path. Together, they create a network that's both optimized and protected---where traffic decisions and security policies operate in sync rather than in isolation.  
| ***Further reading:** [What Is SD-WAN Architecture? Components, Types, \& Impacts](https://www.paloaltonetworks.com/cyberpedia/sd-wan-architecture)*

## How firewalls and SD-WAN evolved to overlap

Not long ago, routing and security lived on different planes.

A router decided how to reach a destination. A firewall decided whether that destination was allowed. Both were critical. But both operated in isolation.

In the traditional WAN era, this made sense.

Traffic flowed through centralized [data centers](https://www.paloaltonetworks.com/cyberpedia/what-is-a-data-center). Firewalls sat at the perimeter inspecting every packet that entered or left the network. This model worked when applications and users stayed on-premises. But it couldn't keep up with distributed users, cloud services, and direct internet access.

That shift drove the first stage of convergence.

As organizations adopted SD-WAN, edge devices began handling not just routing but also basic security. Early SD-WAN appliances added simple [next-generation firewall](https://www.paloaltonetworks.com/cyberpedia/what-is-a-next-generation-firewall-ngfw) capabilities---like stateful inspection and [URL filtering](https://www.paloaltonetworks.com/cyberpedia/what-is-url-filtering)---to reduce the need for separate branch firewalls. The goal was to secure new direct-to-internet connections without backhauling traffic to the data center.

Modern architectures take that further.

Today's platforms merge routing and security into one system. The SD-WAN control plane manages path selection and policy distribution, while the data plane runs embedded firewalls that inspect sessions in real time. These firewalls perform deep inspection, segmentation, and [threat prevention](https://www.paloaltonetworks.com/cyberpedia/what-is-threat-prevention) using on-box or containerized engines.

And now, the boundary is disappearing altogether.

Unified SD-WAN platforms use single-pass inspection and shared management to deliver both networking and security functions seamlessly. At the same time, cloud-delivered services extend those same capabilities through [secure access service edge (SASE)](https://www.paloaltonetworks.com/cyberpedia/what-is-sase) and [firewall-as-a-service (FWaaS)](https://www.paloaltonetworks.com/cyberpedia/what-is-firewall-as-a-service) models.

Ultimately, what began as separate tools has become a unified framework. One that connects users efficiently while enforcing security everywhere they connect.  
| ***Further reading:** [What Is an SD-WAN Appliance? | SD-WAN Hardware \& Equipment](https://www.paloaltonetworks.com/cyberpedia/what-is-an-sdwan-appliance)*

## How does a firewall actually work within SD-WAN?

Firewalls are not just attached to SD-WAN anymore. They're built into it.

To understand how that works, it helps to look at the two planes that define SD-WAN architecture: the control plane and the data plane.  
![Diagram titled 'SD-WAN control plane and data plane' with two labeled sections. On the left under 'Data plane' are four stacked boxes labeled Cloud, DC, Campus, and Branch, each with a blue router icon. These connect through edge routers to three central ovals labeled MPLS, Internet, and 4G/5G. Lines extend from these ovals through green icons labeled 'Smart controllers' to three orange boxes on the right under 'Control plane' labeled Orchestration, Analytics, and Automation.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/how-are-firewalls-and-sd-wan-related/control-plane-and-data-plane.png "Diagram titled 'SD-WAN control plane and data plane' with two labeled sections. On the left under 'Data plane' are four stacked boxes labeled Cloud, DC, Campus, and Branch, each with a blue router icon. These connect through edge routers to three central ovals labeled MPLS, Internet, and 4G/5G. Lines extend from these ovals through green icons labeled 'Smart controllers' to three orange boxes on the right under 'Control plane' labeled Orchestration, Analytics, and Automation.")

The control plane is where routing and policy decisions are made. It tells the network how to steer traffic, manage tunnels, and apply rules. The data plane is where packets actually move. It carries traffic through encrypted tunnels, applies quality of service, and enforces security policies.

Within the data plane, the firewall is responsible for inspecting and controlling each session:

* When traffic enters an SD-WAN edge device, it's decrypted if it arrives through an IPSec or SSL tunnel.
  
  The system identifies the application, user, and session context. It then applies next-generation firewall policies, checking for compliance with access rules, intrusion signatures, and threat indicators.

* If the session is permitted, the data is classified, filtered, and re-encrypted for its next hop.
  
  This ensures that inspection happens before the packet reenters the overlay network. In other words, security is enforced locally at the branch instead of being backhauled through a central gateway.

* Segmentation adds another layer of control.
  
  Traffic is grouped into logical zones or virtual routing and forwarding (VRF) instances, so each business function or user group stays isolated. The firewall enforces policies within and between these segments, preventing lateral movement and maintaining compliance boundaries.

It's worth noting that inspection placement does depend on network design.

Some organizations perform it locally on each edge device for immediate enforcement. Others centralize inspection at regional hubs. And cloud-based models extend those same controls to remote users through firewall-as-a-service or SASE platforms.

The result is consistent policy enforcement across every connection---branch, data center, or cloud---without disrupting how SD-WAN optimizes traffic flow.  
| ***Further reading:** [What Is SD-WAN Security? | SD-WAN Security Considerations](https://www.paloaltonetworks.com/cyberpedia/what-is-sd-wan-security)*

## Where does inspection occur in the SD-WAN data path?

Inspection happens everywhere traffic crosses a boundary.

But understanding where that inspection takes place---and in what order---makes all the difference in how secure and efficient the network really is.

In most SD-WAN architectures, traffic is inspected before encryption.

When packets enter the SD-WAN edge, they're decrypted if necessary, then inspected by the firewall before being re-encapsulated into the overlay tunnel. This allows the firewall to view full packet contents, apply policies, and block threats before data is hidden by [encryption](https://www.paloaltonetworks.com/cyberpedia/data-encryption).

If inspection happened only after encryption, the system couldn't analyze payloads or enforce application-level controls.

Here's why order matters.

Encrypted traffic that skips local inspection must be sent elsewhere---often to a central hub or cloud security service---for decryption and analysis. And that introduces latency. Which means decentralized inspection, closer to the user or branch, generally delivers faster performance while maintaining protection.

Topology plays a role too.

In **hub-and-spoke** designs, inspection often happens at the hub, where all branch traffic converges. In **full mesh** topologies, each branch can inspect and secure its own traffic locally. **Hybrid** models combine both, inspecting sensitive traffic at the hub while allowing direct, secure connections between trusted sites.

Cloud-delivered models take this one step further.

Firewall-as-a-service and SASE platforms extend inspection into the cloud itself. In this model, encrypted traffic is sent to the nearest service edge, decrypted, inspected, and re-encrypted before continuing to its destination. It unifies local and remote inspection under consistent policy enforcement.

The takeaway:

Inspection placement defines how quickly and thoroughly threats are detected. Placing it before encryption---and as close to the user as possible---keeps SD-WAN secure without sacrificing performance.  
| ***Further reading:** [Types of SD-WAN Deployment Models: A Complete Guide](https://www.paloaltonetworks.com/cyberpedia/sd-wan-deployment-models)*

## What are the main deployment models for firewalling in SD-WAN?

Firewalls can be deployed in several ways within an SD-WAN. Each approach defines where traffic is inspected and how policies are enforced.

In practice, most networks use a combination of three models: local, centralized, and cloud enforcement. Each has a clear role and distinct trade-offs.

Let's take a closer look at each:

### Local enforcement

Local enforcement means the firewall runs directly on the SD-WAN edge device. It could be a built-in function, a virtualized container, or an NGFW.

When traffic enters or leaves a branch, it's decrypted, inspected, and re-encrypted right there on-site. This keeps decisions close to the user, minimizing latency and maintaining session context.

It's ideal for sites that need real-time performance or handle sensitive applications locally.

The trade-off is potential operational complexity.

Distributed inspection requires consistent policy management across multiple devices. That's why centralized orchestration is key. So every branch enforces the same standards without manual upkeep.  
***Note:***  
*Local enforcement is best for organizations that prioritize low latency and complete on-site control. It's common in manufacturing, healthcare, and retail environments where uptime and immediate policy enforcement are critical at the branch.*

### Centralized enforcement

In centralized models, inspection happens at a data center or regional hub. All branch traffic flows through these aggregation points for decryption, inspection, and policy control.

This setup simplifies operations. Security teams can manage fewer inspection points and maintain tighter policy oversight. It also works well for traffic that must pass through core systems or comply with regulatory inspection requirements.

However, backhauling traffic adds latency and increases dependency on hub availability. It's effective for some workloads but less efficient for high-volume, latency-sensitive traffic such as SaaS or video.  
***Note:***  
*Centralized enforcement fits enterprises with strong data center dependencies or strict compliance oversight. It's effective when traffic must pass through predefined control points for auditing, logging, or regulatory reasons.*

### Cloud enforcement

Cloud-based enforcement moves inspection into a distributed security service. Traffic is routed to the nearest service edge, where FWaaS or SASE applies the same inspection as an on-prem firewall.

This model scales easily.

It extends consistent policy enforcement to remote users, unmanaged devices, and branch sites without deploying hardware. And it's especially useful for organizations shifting to direct internet access and cloud-hosted applications.

The main consideration is dependency on provider proximity and bandwidth. Performance varies based on where the nearest inspection point resides.  
***Note:***  
*Cloud enforcement is ideal for distributed workforces and cloud-first architectures. It delivers consistent policy coverage for remote users and branch offices while simplifying management through provider-hosted inspection.*

In short:

* Local enforcement favors performance.
* Centralized enforcement favors control.
* Cloud enforcement favors scalability.

Choosing the right mix ensures SD-WAN remains secure, consistent, and efficient wherever traffic originates.

## How centralized management ties firewall and SD-WAN policies together

Modern SD-WAN depends on centralized management. It's what allows routing and security to operate as one system instead of two separate layers.

In practice, centralized management platforms form the shared control plane for the entire network. They distribute routing rules, enforce firewall policies, and provide unified visibility into traffic flows.  
![The diagram illustrates centralized management in SD-WAN. It shows an SD-WAN controller at the center, managing data flows between the MPLS network, the internet, and cloud services. On the left, a branch office connects to the SD-WAN controller through traditional WAN routers. The middle section displays various types of connectivity, including fiber, dedicated internet access, MPLS, and 4G, all managed by the SD-WAN controller. On the right, the HQ/DC/DR is also connected via traditional WAN routers. Control plane data paths are indicated by yellow dashed lines, while data plane paths are shown as solid red lines.](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/what-is-cyber-physical-systems-security-cpssec/SD-WAN-centralized-management.png)

Administrators use these platforms to define intent---like how applications should route, or what types of traffic should be inspected---and then push those configurations across all devices at once.

This is where routing and security truly converge.

Instead of managing them through different interfaces, both functions live in the same policy framework. Routing policies decide the best path based on performance metrics, while firewall policies determine whether that traffic is allowed or blocked.

Because they're coordinated through the same control plane, the SD-WAN can steer and secure traffic in a single, consistent process.

The benefits are significant:

* Policy consistency reduces the risk of misconfiguration, one of the most common causes of network vulnerabilities.
* It also simplifies compliance since all enforcement points follow identical security baselines.
* And when routing and firewall policies are visible in one dashboard, operations teams can diagnose performance and security events together instead of switching between tools.
* Centralized management also makes scale practical. A new branch or user can inherit existing policies immediately without manual configuration. Updates roll out network-wide with version control and audit tracking, keeping governance intact.
* Automation extends this even further, applying policies dynamically as network conditions change.

Essentially centralized management turns SD-WAN from a set of distributed nodes into a unified system of control. It ensures that routing, security, and visibility evolve together, reducing risk while maintaining performance and agility.  
| ***Further reading:** [How Does SD-WAN Automation Simplify Network Operations?](https://www.paloaltonetworks.com/cyberpedia/how-does-sd-wan-automation-simplify-network-operations)*

## When is a standalone firewall still needed?

Even as SD-WAN integrates advanced security, standalone firewalls still play a critical role. They provide capabilities that extend beyond what's practical, or efficient, to embed directly into the SD-WAN edge.

For example, high-throughput data centers rely on dedicated firewalls to handle massive session volumes and specialized traffic inspection. These environments often need more granular control and hardware acceleration than a distributed SD-WAN appliance can deliver.

The same applies to large-scale cloud interconnects or carrier-grade deployments where throughput and resiliency take precedence over edge simplicity.

In regulated industries, segmentation requirements can also drive the need for separate firewalls. Financial, healthcare, and government networks often maintain physically distinct security zones to meet compliance frameworks such as PCI DSS or HIPAA. In those cases, an independent firewall remains the authoritative enforcement point between zones or enclaves.

Standalone firewalls are also necessary for assets that fall outside SD-WAN coverage. That includes legacy infrastructure, industrial systems, or third-party services that connect through different transport methods. These environments depend on traditional perimeter or virtualized firewalls to maintain visibility and policy control.

The key is integration, not replacement.

Secure SD-WAN connects seamlessly with perimeter and cloud-based firewalls, extending policy and telemetry across both. This layered approach preserves centralized management while maintaining the depth of protection large enterprises still require.

Here's the takeaway:

Standalone firewalls remain vital where scale, regulation, or architectural isolation demand them. They complement SD-WAN rather than compete with it, ensuring every layer of the network is secured at the right place and scale.  
| ***Further reading:** [What Is Secure SD-WAN? | What It Is and How It Works](https://www.paloaltonetworks.com/cyberpedia/what-is-secure-sd-wan)*

## How SD-WAN and firewall convergence lays the groundwork for SASE

The convergence of SD-WAN and firewalling is what makes SASE and zero trust possible in practice. By combining distributed networking with built-in security enforcement, the network itself becomes the delivery mechanism for consistent, identity-based control.

Here's how it fits together.

SD-WAN provides the distributed data plane that connects users and locations. Integrated firewalls bring inspection and segmentation directly to those connection points.

When policies follow the user instead of the network segment---and access is continuously verified---the result aligns with the core principles of [zero trust architecture](https://www.paloaltonetworks.com/cyberpedia/what-is-a-zero-trust-architecture).

That model is now being extended through SASE. Centralized policy orchestration pushes identity, application, and threat prevention rules to every edge, whether physical or cloud-delivered.

Traffic is steered and inspected based on who the user is, what device they're on, and what they're trying to access. Not just where they connect.

So: SD-WAN creates the path. The firewall enforces trust.

And together, they form the foundation of a network that's adaptive, policy-driven, and ready for SASE's full vision of cloud-based security.  
| ***Further reading:** [How Zero Trust and SASE Can Work Together](https://www.paloaltonetworks.com/cyberpedia/zero-trust-and-sase)*  
![Icon of a book](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/cyberpedia/how-are-firewalls-and-sd-wan-related/ebook-icon.svg)

## eBook: Why Next-Gen SD-WAN Is the Solution for You Discover how integrated next-gen SD-WAN improves user experience, control, and visibility.

[Download eBook](https://start.paloaltonetworks.com/why-next-gen-sd-wan-is-the-solution-for-you.html)

## SD-WAN firewall FAQs

#### What is an SD-WAN firewall?

An SD-WAN firewall is a next-generation firewall integrated into the SD-WAN data plane. It inspects and controls traffic based on application, user, and content. By enforcing security policies within the SD-WAN fabric, it provides consistent protection across branches, data centers, and cloud environments.

#### Do you need a firewall with SD-WAN?

Yes. SD-WAN optimizes connectivity, while the firewall secures it. Many SD-WAN platforms include built-in firewall capabilities, but standalone or cloud firewalls may still be required for high-throughput, compliance, or non-SD-WAN-connected systems. Together, they provide performance and security as part of one architecture.

#### Can SD-WAN replace a traditional firewall?

Not entirely. SD-WAN integrates advanced firewalling but isn't a full substitute in all environments. Large data centers, regulated zones, or legacy networks may still require standalone firewalls for specialized inspection or segmentation. SD-WAN and firewalls complement each other within a layered security framework.

#### How are SD-WAN and firewall policies managed together?

They're managed through a shared control plane. Centralized orchestration platforms distribute routing, segmentation, and firewall policies across all sites. This unified management ensures consistent enforcement, reduces configuration errors, and simplifies visibility for both network and security operations.

#### How does SD-WAN support zero trust security?

SD-WAN supports zero trust by combining identity-based policies with distributed enforcement. Integrated firewalls verify every session, segment traffic, and apply least-privilege access across users and locations. When centrally managed, these controls align with zero trust architecture principles and form the foundation for SASE.
Related content  
[1 Podcast: Packet Pushers | Why SD-WAN is the Secret to SASE Success
Hear why SD-WAN is the foundational component of a SASE solution.](https://media.blubrry.com/packetpushers/media.blubrry.com/2903570/ins.blubrry.com/2903570/TB_Palo_Alto_0701-SD-WAN.mp3)  
[Podcast: Packet Pushers | Can SD-WAN Solve Latency Issues for Modern Applications?
Get the facts on how application acceleration helps deliver SaaS \& cloud apps with the highest level of performance.](https://media.blubrry.com/packetpushers/media.blubrry.com/2903570/ins.blubrry.com/2903570/TB_0120_PANW.mp3)  
[eBook: Zero Trust Branch with SD-WAN
Learn how SD-WAN architecture extends to branch security and SASE.](https://www.paloaltonetworks.com/resources/ebooks/for-dummies-zero-trust-branch-for-sd-wan)  
[eBook: The Branch of the Future, Today
Find out how to securely enable branch modernization with Prisma SD-WAN.](https://www.paloaltonetworks.com/resources/ebooks/securely-enable-branch-modernization-with-prisma-sd-wan)  
![Share page on facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/facebook-circular-icon.svg) ![Share page on linkedin](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/linkedin-circular-icon.svg) [![Share page by an email](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/resources/email-circular-icon.svg)](mailto:?subject=What%20Is%20the%20Role%20of%20a%20Firewall%20in%20SD-WAN%20Architecture%3F&body=The%20role%20of%20a%20firewall%20in%20SD-WAN%20architecture%20is%20to%20inspect%20and%20control%20network%20traffic%20that%20passes%20through%20the%20SD-WAN%20fabric%20according%20to%20defined%20security%20policies.%20at%20https%3A//www.paloaltonetworks.com/cyberpedia/how-are-firewalls-and-sd-wan-related)  
Back to Top  
{#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2025 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language