This document describes the packet handling sequence inside of PAN-OS devices. The ingress and forwarding/egress stages handle network functions and make packetforwarding decisions on a per-packet basis. The remaining stages are session-based security modules highlighted by App-ID and Content-ID. This decoupling offers stateful security functions at the application layer, and the resiliency of per-packet forwarding and flexibility of deployment topologies.

For more information and in-depth technical articles, visit our Palo Alto Networks Firewall Section.