[![Palo Alto Networks Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/igw/ngfw-for-aws-azure/images/panw-logo.svg)](https://www.paloaltonetworks.com/) # Software NGFW Credit Estimator FedRAMP Moderate ⬇PDF all estimatesPreview Estimate VM Flex Credits and monthly cost for Cloud NGFW (AWS/Azure), Virtual Firewalls, and Prisma AIRS deployments. Add multiple estimates and export a combined PDF. Support tier \*\*Premium 18%\*\*\*\*Platinum 25%\*\*\*\*Premier Partner 18%\*\*\*\*US Gov Premium 24%\*\***US Gov Partner 24%** *** ** * ** *** EstimatesClear all ### Support tier not compatible with all estimates You have AI Firewall or Prisma AIRS estimates that are not supported under . Those estimates will remain in your list but cannot be activated with this support tier. Switch tierCancel ### Clear all estimates? This will permanently delete all estimates and start fresh. This cannot be undone. Clear allCancel Deployment type **Cloud NGFW****Cloud NGFW****Virtual Firewalls****Virtual Firewalls****Prisma AIRS\*\*\*\*Prisma AIRS** Prisma AIRS, AIRS VM, and Managed AIRS are not available with Premier Partner, US Gov Premium, or US Gov Premium Partner support tiers. Cloud NGFW (Legacy) credits apply to Cloud NGFW only. Virtual Firewalls and Prisma AIRS require VM Flex credits. ## Cloud NGFW Credit Estimator Estimator updated October 2026 1Cloud Platform **AWS****AWS****Azure\*\*\*\*Azure** 2Credit Type i Close **VM Flex** --- Software NGFW VM-Flex Credits. The recommended credit type for new deployments. Covers firewall, subscriptions, management, and support as a unified credit pool that can flex across your VM-Series footprint. **Cloud NGFW (Legacy)** --- Legacy Cloud NGFW Credits. For existing Cloud NGFW deployments purchased before the VM-Flex transition. If you are starting a new Cloud NGFW deployment, use VM Flex. \*\*VM Flex****VM Flex****Cloud NGFW (Legacy)\*\***Cloud NGFW (Legacy)** 3SKU Tier i Close Our AWS offerings utilize structured SKUs to seamlessly handle scale-heavy security topologies and support next-generation defenses: **Standard vs. Base SKUs:** Both feature the same pricing. We recommend Standard for greater flexibility and support for new capabilities. **Premium SKU:** Designed for enhanced capacity for the most demanding throughput requirements and complex security architectures. **Optimized for Advanced AI Defenses:** Standard and Premium tiers are purpose-built for Advanced WildFire (Precision AI zero-day malware blocking) and Advanced DNS Security. Cloud NGFW for Azure offers two streamlined SKUs to accommodate different deployment sizes: **Standard Instance:** Foundational tier for cloud-native environments requiring standard policy sets, with autoscaling up to 100 Gbps. **Premium Instance:** Ideal for highly sensitive applications requiring larger policy sets, with faster ramp-up for peak traffic up to 200 Gbps. 4NGFW Resources i Close The number of NGFW Resources depends on how many AWS regions you will deploy in and the deployment model (centralized or distributed). [Supported Regions](https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/getting-started-with-cloud-ngfw-for-aws/supported-regions-and-zones)[Deployment Models](https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/getting-started-with-cloud-ngfw-for-aws/supported-cloud-ngfw-deployments) Cloud NGFW uses zone-affinity and auto-scaling to place and scale VM-Series nodes per Availability Zone. Each resource maps to one zone. As traffic grows in a zone, NGFW scales nodes accordingly. The number of NGFW Resources depends on how many Azure regions in which you will deploy and the deployment model (centralized or distributed). [Supported Regions](https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure/getting-started-with-cngfw-for-azure/supported-regions-and-zones)[Deployment Models](https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure/getting-started-with-cngfw-for-azure/deploy-cloud-ngfw-for-azure) Enter number of NGFW resources to continue 5Security Services i Close [Cloud-delivered security services](https://www.paloaltonetworks.com/network-security/cloud-delivered-security-services): Consistent, scaled prevention without added infrastructure. |-----------|------------------------------------------------------------------------------------------------------------| | **ATP** | [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) | | **A-URL** | [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) | | **AWF** | [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) | | **ADNS** | [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) | | **DLP** | [Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) | 6Traffic Secured / Month (GB) 7Additional Options i Close Usage of security services and centralized management are billed using the Add-Ons dimension. |---------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [Panorama](https://www.paloaltonetworks.com/network-security/panorama) | Centralized management system for network-wide traffic insight, configuration, and log management across managed devices. | | [SCM Pro](https://docs.paloaltonetworks.com/strata-cloud-manager/activation-and-onboarding/strata-cloud-manager-licenses-and-support) | Cloud NGFW is supported with SCM Pro licensing. SCM Pro includes SLS (so SLS is not added as a separate selection). Includes AI Ops, ADEM, CIE, Cloud/Config Management. | Premium Support is available from Palo Alto Networks customer support **at no additional cost** . Customers must register at the [PANW Support Portal](https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/legal/palo-alto-networks-global-customer-support-services-terms-and-conditions-eusa.pdf) through the Cloud NGFW service. Centralized Management (Panorama) Centralized Management (Strata Cloud Manager) Additional Availability ZonesSelect Additional Availability Zones3 + 1 additional3 + 2 additional3 + 3 additional Egress NAT Select AWS RegionUS East (N. Virginia)US East (Ohio)US West (N. California)US West (Oregon)Canada (Central)Europe (Ireland)Europe (London)Europe (Paris)Europe (Frankfurt)Europe (Stockholm)Europe (Milan)Asia Pacific (Tokyo)Asia Pacific (Seoul)Asia Pacific (Osaka)Asia Pacific (Singapore)Asia Pacific (Sydney)Asia Pacific (Mumbai)Asia Pacific (Hong Kong)South America (Sao Paulo)Middle East (Bahrain)Africa (Cape Town) Bring Your Own IPCloud NGFW Managed AWS EIPs [](https://docs.paloaltonetworks.com/cloud-ngfw/azure/cloud-ngfw-for-azure/getting-started-with-cngfw-for-azure/pricing)[](https://docs.paloaltonetworks.com/cloud-ngfw/aws/cloud-ngfw-on-aws/getting-started-with-cloud-ngfw-for-aws/cloud-ngfw-pricing) Pricing Summary Pay-as-you-go / Month$0 Show Calculation Credits Summary Deployment0 Security Services0 Management0 Egress0 Support0 Show Calculation Cloud NGFW Credits (Legacy)0 Show Calculation Total Credits to Purchase 0 includes support Save this configuration as PDF Save this configuration as PDF Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ## Virtual Firewalls Credit Estimator Estimator updated October 2026 1Select VM-Series or AI Runtime Security **AI Runtime Security****AI Runtime Security****VM-Series\*\*\*\*VM-Series** 2Deployment Type i Close **Hyperscale Security Fabric (HSF)** --- Built-in load balancer mode. Deploys a cluster of AIRS nodes fronted by an elastic load balancer for high-throughput, horizontally scalable inspection. **Standalone** --- Single-node deployment without a built-in load balancer. Suitable for lower-traffic or dev/test environments. **HSF****HSF****Standalone\*\*\*\*Standalone** 3Sizing Method **Suggested****Suggested****Manual\*\*\*\*Manual** 4Desired Cluster Performance Select throughput...5 Gbps10 Gbps15 Gbps20 Gbps25 Gbps30 Gbps40 Gbps50 Gbps60 Gbps70 Gbps80 Gbps90 Gbps100 Gbps150 Gbps200 Gbps300 Gbps 4Node Configuration | Firewall Node | # Firewalls | # vCPUs Per Node (Max 64) | \*Total Throughput of All Nodes | |-----------------|-------------|---------------------------|---------------------------------| | Persistent-Node | | | 0 Gbps | | Scale Node | | | 0 Gbps | \*Total throughput is based on max availability per node. iNote: To enable Hyperscale Security Fabric, a minimum of 4 vCPUs per firewall is required. 3Number of Instances Enter number of instances to continue 4vCPUs per Instance Minimum is 2 vCPUs for VM-Series ⓘ Note: To enable the AI profile for inspection, you need a minimum of 4 vCPU per Firewall. 5Security Use Cases Custom▼ Custom *** ** * ** *** Optional: select one or more use cases to pre-load subscriptions. Pre-loaded subscriptions are locked; you can still add others below. 6Security Subscriptions i Close [Cloud-delivered security services](https://www.paloaltonetworks.com/network-security/cloud-delivered-security-services): Consistent, scaled prevention without added infrastructure. Click on the links below to learn more. |---------------------|------------------------------------------------------------------------------------------------------------------------------------------------------| | **ATP** | [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) | | **A-URL** | [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering) | | **ADNS** | [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security) | | **AWF** | [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire) | | **AIPD** | [Advanced IP Defense](https://www.paloaltonetworks.com/network-security/advanced-ip-defense) | | **DLP** | [Data Loss Protection](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention) | | **GP** | [Global Protect](https://www.paloaltonetworks.com/sase/globalprotect) | | **ITO** | [Intelligent Traffic Offload](https://www.paloaltonetworks.com/resources/datasheets/intelligent-traffic-offload-service-for-vm-series-virtual-ngfws) | | **SaaS Inline** | [SaaS Security Inline](https://docs.paloaltonetworks.com/saas-security/saas-security-inline/view-data) | | **Advanced SD-WAN** | [Advanced SD-WAN](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) | | **TP** | [Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention) | | **SD-WAN** | [SD-WAN](https://www.paloaltonetworks.com/network-security/sd-wan-subscription) | | **WF** | [WildFire](https://www.paloaltonetworks.com/network-security/wildfire) | Device Security 7Centralized Management i Close |------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | [Panorama Management](https://www.paloaltonetworks.com/network-security/panorama) | Easy-to-implement centralized management system for network-wide traffic insight. Use Panorama for the configurations of managed devices and log management. | | Panorama Log Collection | Dedicated Panoramas running in log collector mode to collect and manage logs from managed devices. | | Strata Cloud Manager Pro | Strata Cloud Manager Pro includes AI Ops, ADEM, SLS, CIE, Cloud/Config Management. | | [Strata Cloud Manager](https://www.paloaltonetworks.com/sase/strata-cloud-manager) | With Strata Cloud Manager (The New AI-powered, Unified Management Platform), you can easily manage and monitor your network security infrastructure --- your NGFWs, and SASE environment --- from a single, streamlined user interface. | Credits Summary Firewall0 Subscriptions0 Management0 Support0 FedRAMP +15%0 Show Calculation Subscription Incentives Description Incentive 100% of FW credits 12\.5% off sub credits 120% of FW credits 20% off sub credits 140% of FW credits 25% off sub credits Total Credits to Purchase 0 includes support Save this configuration as PDF Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ## AI Runtime Security Credit Estimator Estimator updated October 2026 Assess AI Model Security Enterprise flat license 1,304 Credits/yr AI Red Teaming Automated adversarial testing Tier StarterStandardProfessionalAdvancedEnterprise StarterStandardProfessionalAdvancedEnterprise Enterprise add-on blocks (+145 Credits each) Protect AI Runtime (API) Security 182\.61 Credits/B tokens per month · linear Total traffic (billions of tokens / month) Does a caching gateway sit in front of this traffic? No caching gateway Yes --- AI Gateway (ours) Yes --- external / BYO gateway Cache hit rate: 0% Is there direct (non-gateway) traffic too? Yes --- I have bypass / direct traffic Direct traffic (billions of tokens / month) AI Gateway Cascade tiers · $/M tokens converted to Credits annually Billions of tokens per month Agent Identity Security Base 100 agents --- 688 Credits; add-on 25-agent blocks --- 115 Credits each AI Gateway must be enabled to use Agent Identity Security. Number of agents (base 100 + blocks of 25) Cortex Integrations Agentic Endpoint Security 0\.34 Credits/endpoint/yr · minimum 200 Number of endpoints (minimum 200) Annual Credit Estimate No products selected Contract Credits0 Support (Premium 18%)0 Total Flex Credits 0 annually, includes support Save this configuration as PDF Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/igw/ngfw-for-aws-azure/images/panw-logo.svg) # Software NGFW Credit Estimate ## All Deployments Summary Deployments Deployment Type Total Credits GRAND TOTAL CREDITS TO PURCHASE 0 Credits (sum of all deployments) Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/igw/ngfw-for-aws-azure/images/panw-logo.svg) # Cloud NGFW Credit Estimator ## (For Cloud NGFW for AWS) Configuration Summary Cloud Provider AWS Credit Type Software NGFW SKU Tier Base Number of NGFW Resources 0 Availability Zones 3 Traffic Secured (GB/month) 0 Security Services Management Egress NAT Region --- Egress Traffic (GB/month) 0 IP Option BYOIP Managed EIPs 0 Pricing Summary (PAY-AS-YOU-GO) $0 Monthly PRODUCT CREDITS 0 Credits (for estimate) Support Tier: Premium (18%) TOTAL CREDITS TO PURCHASE 0 Credits (product credits + support) CLOUD NGFW CREDITS (LEGACY) 0 Credits Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/igw/ngfw-for-aws-azure/images/panw-logo.svg) # Virtual Firewalls Credit Estimator ## (Software NGFW VM-Flex Credits) Configuration Summary Security Use Cases None Use Cases --- VM-Series Instances 0 vCPUs per Instance 0 Security Subscriptions Centralized Management Included Features VM-Flex Credits Summary FIREWALL CREDITS 0 Credits SUBSCRIPTION CREDITS 0 Credits MANAGEMENT CREDITS 0 Credits SUPPORT CREDITS 0 Credits Support Tier: Premium TOTAL CREDITS TO PURCHASE 0 Credits (product credits + support) Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/igw/ngfw-for-aws-azure/images/panw-logo.svg) # AI Runtime Security Credit Estimate ## (Flex Credits · Effective Oct 2026) Products Selected Credits Summary CONTRACT CREDITS 0 Credits (annual product total before support) SUPPORT CREDITS 0 Credits Support Tier: Premium (18%) TOTAL FLEX CREDITS TO PURCHASE 0 Credits (contract + support) Disclaimer: This estimate is for planning purposes only. Your actual costs may vary. Estimate Preview Review your line items × Close