I'm working with several MSP clients who are standardizing on Palo Alto NGFWs for their managed security services. A common challenge we're trying to solve is policy structure for a true multi-tenant firewall, where a single physical or virtual appliance serves multiple distinct customers.
The goal is to maintain strict traffic isolation, enable clear reporting per tenant, and simplify ongoing management without creating a policy sprawl nightmare. I've seen a few different approaches in the wild:
* Using Virtual Systems (Vsys) for each tenant.
* Using Security Profile Groups and Address Groups with meticulous naming conventions within a single Vsys.
* A combination of Virtual Routers and Zones within a single Vsys.
From a process and design perspective, what has proven to be the most sustainable structure? I'm particularly interested in real-world trade-offs.
Key considerations for our use case include:
* Each tenant must have no visibility or access to another tenant's policies or objects.
* We need to generate per-tenant compliance and traffic reports.
* Some tenants require custom App-IDs or Threat signatures, while others use a standard MSP profile set.
* Operational overhead for adding a new tenant should be minimal and templated.
I'm leaning towards a dedicated Vsys per tenant for the hard isolation, but I'm concerned about hitting scalability limits on the maximum number of Vsys and the management complexity on Panorama. Are those concerns valid with modern PAN-OS versions?
What best practices have you implemented for policy naming, shared service management (like DNS/AD access for the MSP itself), and template stacks in Panorama for this scenario?