Which action is only taken during slow path in the NGFW policy?

The Palo Alto Networks NGFW processes network traffic using two primary paths: the slow path and the fast path. The slow path (or control plane) is used exclusively for the first packet of a new session. Its purpose is to perform all necessary lookups to classify the session and create a session entry. This includes the security policy lookup to determine if the traffic is allowed and what security profiles apply. Once the session is established, all subsequent packets for that session are processed on the fast path (or data plane), which uses hardware acceleration. The fast path performs a session lookup and applies the actions determined during the slow path setup, but it does not perform another security policy lookup. Therefore, the security policy lookup is an action taken only during the slow path.

A. Session lookup: This action occurs on both the slow path (where it results in a "miss" and triggers session creation) and the fast path (where it results in a "hit" for an existing session).
B. Layer 2—Layer 4 firewall processing: Initial L2-L4 state and session creation occur on the slow path. However, subsequent packets on the fast path are still checked against this state (e.g., TCP sequence numbers).
C. SSL/TLS decryption: The decision to decrypt and the initial TLS handshake setup are slow path functions. However, the actual bulk decryption of the data stream is performed on subsequent packets, which are processed in the data plane (fast path).

1. Palo Alto Networks, "PAN-OS® Administrator’s Guide 10.2"

Section: Networking > Packet Flow and Session Management

Content: The guide explicitly details the packet flow. It states, "For the first packet of a new session...the firewall creates a session on the management plane (the slow path). The slow path processing includes a policy lookup... For all subsequent packets that match an existing session, the firewall processes the packets in the data plane (the fast path)." This confirms that policy lookup is a slow-path-only function.

2. Palo Alto Networks, "Day in the Life of a Packet" White Paper

Section: Packet Flow

Content: This document provides a detailed diagram and explanation of the packet flow. It clearly shows "Security Policy Lookup" as a step within the "Slow Path / First Packet" processing flow. The "Fast Path / Subsequent Packet" flow shows a direct session match that bypasses the policy lookup stage, instead applying the treatment already decided for the session.

3. Palo Alto Networks Education Services, "Firewall 10.1 Essentials: Configuration and Management (EDU-210)" Courseware

Module: The Single-Pass Architecture

Content: The courseware describes the SP3 architecture, distinguishing between the control plane (slow path) and data plane (fast path). It consistently identifies policy evaluation and route lookups as control plane functions for new sessions, while packet forwarding and enforcement for existing sessions are data plane functions. The decryption process itself spans both: setup in the control plane and execution in the data plane.