A packet that is already associated with a current session arrives at the firewall. What is the flow of the packet after the firewall determines that it is matched with an existing session?

When a packet matches an existing session, it bypasses the session setup process (slow path) and is processed in the hardware-accelerated fast path. The Palo Alto Networks Single-Pass Parallel Processing (SP3) architecture ensures that if the traffic is subject to content inspection, it passes through a single, stream-based engine. This engine concurrently inspects the packet for threats, applications, and content in one pass, maximizing throughput and minimizing latency.

B. The slow path is used for session setup (the first packet of a flow), not for subsequent packets of an established session.
C. The architecture uses a single stream-based engine for content inspection, not multiple engines, to maintain performance and efficiency.
D. This is incorrect because established sessions use the fast path, and content inspection is performed by a single engine, not multiple.

1. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "Packet Flow Sequence in PAN-OS". The guide details the distinction between the slow path (session setup) and the fast path (session-offload for existing flows).

2. Palo Alto Networks. (n.d.). Single-Pass Parallel Processing Architecture. White Paper. This document explains the core architecture, stating, "The Single-Pass software... performs its operations once per packet... As the packet is processed, networking, policy lookup, application identification and decoding, and signature matching for all threats and content are performed just once."

3. Palo Alto Networks. (2023). PAN-OS® Administrator’s Guide, Version 11.0. "The Single-Pass Architecture". This section explicitly states, "The single-pass architecture processes packets for networking, policy, application identification, and threat inspection in one pass."