Which action is only taken during slow path in the NGFW policy?

The Palo Alto Networks NGFW uses two primary processing paths: the slow path (software-based) and the fast path (hardware-offloaded). The slow path handles the first packet of a new session to perform comprehensive analysis, including policy lookups, application identification (App-ID), and content inspection (Content-ID). SSL/TLS decryption is a resource-intensive component of Content-ID that is exclusively handled by the slow path. Sessions requiring decryption cannot be offloaded to the fast path and remain on the slow path for their entire duration to allow for continuous inspection of the decrypted content.

A. Session lookup: This is performed on every packet to determine if it matches an existing session, which then directs it to either the fast path or slow path.

B. Layer 2—Layer 4 firewall processing: While initial L2-L4 processing occurs on the slow path, subsequent packets of an offloaded session receive stateful L2-L4 inspection on the fast path.

D. Security policy lookup: This is performed on the slow path for the first packet of a session; however, the session can then be offloaded to the fast path.

1. Palo Alto Networks

PAN-OS® Administrator’s Guide 10.2

"Packet Flow Sequence in PAN-OS": The documentation details the packet flow. In the "Slow Path" section

it explicitly lists "SSL proxy (decryption and encryption)" as a function performed. The "Fast Path" section describes handling subsequent packets of an existing session

which bypasses these intensive checks. Sessions requiring services like SSL decryption are noted as ineligible for fast path offloading.

2. Palo Alto Networks

"Day in the Life of a Packet" White Paper: This foundational document illustrates the packet flow. It shows that the first packet goes through the control plane (slow path) for session setup

which includes policy evaluation and Layer 7 inspection such as SSL decryption. It clarifies that once a session is established and if it doesn't require continuous deep inspection

it can be offloaded to the data plane's fast path. Sessions with SSL decryption enabled remain in the slow path.

3. Palo Alto Networks

"Session Offload" Documentation: This resource explains that session offloading (moving a session to the fast path) is possible only for sessions that do not require Layer 7 processing

such as threat inspection or SSL decryption

on each packet. This confirms that SSL decryption is a slow-path-only function.