I'm designing an Azure hub-and-spoke environment that uses Palo Alto VM-Series appliances and a public load balancer for inbound traffic. I need to identify which security controls are provided by the network virtual appliances and which controls are still missing, especially for internet-facing applications.
My concern is that the NVAs primarily address network-layer traffic, while public HTTP applications also need Layer 7 protection, threat intelligence, TLS inspection, and application-aware traffic inspection. Would placing a WAF behind or in front of the NVAs provide sufficient protection? What security controls and traffic flows should I evaluate to avoid gaps in the design?
I understand that no design eliminates every risk, but I want to make sure there are no obvious deficiencies in coverage. The answer should also consider inbound, outbound, east-west, non-HTTP traffic, scalability, performance, and operational overhead.
4 Answers
TLS decryption on the NVAs can add substantial CPU, licensing, certificate-management, and operational overhead. A dedicated, cloud-integrated WAF is often more scalable and cost-effective for Layer 7 inspection. Depending on the trust model, the WAF can sit in front of the firewalls, with the original client address preserved through the appropriate forwarding headers, or the WAF can be placed in the application landing zone while the NVAs handle egress and east-west traffic. Do not forget that a WAF only protects supported web protocols; other exposed services need separate controls.
For a typical design, use a dedicated WAF or application gateway for inbound web traffic, and use the Palo Alto appliances mainly for outbound filtering and east-west segmentation. Apply network security groups and strong application authentication around the workloads as well. This is usually cleaner than forcing the NVA to perform every function, especially when the applications are HTTP-based. Confirm the expected traffic volume and inspect the scaling limits before choosing the placement.
Start with security requirements rather than assuming that a particular appliance provides every control. Document the applications, protocols, trust boundaries, required inspection, TLS termination and re-encryption, logging, threat intelligence, denial-of-service protection, authentication, and response procedures. A product name alone does not define the controls; the exact model, licenses, inspection profiles, and deployment mode matter. Also make sure the teams understand that a WAF is not simply a URL filter or a Layer 4 firewall.
A WAF is generally expected for publicly exposed HTTP or HTTPS applications because it provides application-layer protection that a conventional firewall does not. Use the OWASP Top 10 as a starting point for identifying the threats that need coverage. The WAF and firewall solve different problems, so the right placement depends on the application and traffic flows. A common pattern is WAF or application gateway at the edge, followed by the application tier and then firewall controls where needed.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures