Critical: MS Azure Change May Cut Palo Alto Firewall Performance by 50%+

Overview: Microsoft is deploying the new Microsoft Azure Network Adapter (MANA) hardware across existing Azure VM families. PAN-OS version below 12.1.5 will default to a lower performant pairing which can result in 50% or greater reduction in maximum firewall throughput. 

Required Action: Palo has outlined a temporary and permanent recommendation to maintain current performance Levels. 

Temporary: Apply a “LegacyVMNVA” tag to the instance/scale set to delay this conversion until 9/30/2026. Contact us at hello@sayers.com for an example temporary policy definition.

Permanent: Upgrade PAN-OS to 12.1.5 or higher which includes native support for MANA NICs via optimized DPDK drivers. However as of this publication there is no TAC preferred release of 12.1. Furthermore, there are known issues in 12.1.5 which could negatively impact core services such as GlobalProtect on VM-Series firewalls. 

Sayers Recommendation: Sayers is recommending utilizing the temporary tag extension until a TAC preferred release of 12.1 is available. 

Palo Alto Networks released this customary advisory on 3/18/2026 affecting all Azure hosted VM-Series and AIRS Instances. Microsoft is upgrading to the new Microsoft Azure Network Adapter (MANA) on hardware across Azure VM sizes. MANA was introduced in February 2025 with the Intel v6 family of sizes as part of Azure Boost. In the long-term MANA will enhance performance but will come with short term ramifications. VM-Series instances paired with MANA NICs will default to the MMAP Synthetic Path instead of the high-performance DPDK driver. This shift in driver behavior can be triggered automatically whenever a VM is stop-deallocated and subsequently restarted or redeployed. When this pairing occurs, it can lead to a 50% or greater reduction in maximum firewall throughput. 

Contact us at hello@sayers.com for an example temporary policy definition and assistance.