Palo Alto Networks Portfolio and Architecture
Planes and the single-pass engine
PAN-OS separates functions across planes. The management plane hosts the web UI, CLI administration, logging/reporting configuration, and Panorama connectivity. The data plane processes every packet: session setup, App-ID classification, security policy enforcement, NAT, decryption, and Content-ID scanning. The control plane handles routing protocols, HA state machines, and management services. A favourite trap asks which component enforces a security rule; the answer is the data plane, never the management plane. Panorama is management only; traffic never transits it.
Single-pass parallel processing
Each packet is inspected once. The firewall identifies the application (App-ID), then applies User-ID (who) and Content-ID (threat, URL, file, DNS, SaaS) in the same pass rather than rebuilding the packet through separate engines. Hardware platforms offload established sessions where possible. This explains why App-ID needs the first few packets, why unknown-tcp appears, and why decryption changes what you can see.
Portfolio mapping
- PA-400/1400: branch; PA-3400/5400/7000: campus and data centre; VM-Series: public/private cloud and virtualised data centre; CN-Series: Kubernetes; Cloud NGFW and Prisma Access: managed and SASE; WildFire: sandboxing; Panorama: centralised management and log aggregation; Cortex XDR/XSOAR: detection and response.
Trap: matching a requirement to the wrong product. Prisma Access is delivered as a service, so you do not size hardware; WildFire analyses files but enforces nothing by itself.
Rule of thumb: if a question asks who handles packets, answer data plane; if it asks who configures or aggregates logs, answer management plane or Panorama.