Virtual systems provide logical separation in a single physical firewall, allowing different customers (or tenants) to have isolated control and security policies.
Virtual systems enable service providers to offer logically separated, independent environments on a single firewall. Each virtual system can have its own security policies, interfaces, and administrators.
This ensures secure, tenant-specific segmentation within multi-tenant environments.

A decryption policy allows the firewall to inspect encrypted traffic and apply security controls to Post- quantum Cryptography (PQC) usage, as PQC algorithms are typically implemented within encrypted sessions.
Decryption policies enable the firewall to see and control encrypted traffic. This visibility and control extend to new cryptographic algorithms, including PQC, to ensure that security measures are applied consistently.
By decrypting sessions, you ensure that even PQC traffic can be inspected, logged, and subject to security profiles for visibility and policy enforcement.

When migrating from a perpetual VM-Series firewall license to a flexible VM licensing model, two critical steps are needed:
Allocate same number of vCPUs ?This ensures that the VM-Series capacity remains consistent and avoids resource bottlenecks.
When migrating perpetual VM-Series licenses to flexible VM licensing, allocate the same vCPU and memory resources to ensure equivalent performance.
Limit to same security services ?Flexible licensing requires maintaining the same security services to preserve licensing compliance.
Ensure that you allow only the same security services on the flexible VM instance as were licensed on the perpetual VM.

When implementing SSL Forward Proxy decryption for outbound traffic, two key challenges that must be evaluated are:
Incomplete certificate chains: This occurs when the firewall cannot validate the entire certificate chain for a site, which may cause decryption failures.
Certificate pinning: Applications like banking apps may use certificate pinning to prevent MITM (man-in-the-middle) attacks, and these applications will break if SSL Forward Proxy is used.
When decrypting outbound SSL traffic, you must consider incomplete certificate chains, which can cause decryption to fail if the firewall cannot validate the entire chain. Also, be aware of certificate pinning in applications that prevents decryption by rejecting forged certificates.

Advanced DNS Security uses a signature policy to sinkhole malicious DNS queries and prevent them from resolving.
The DNS Security service integrates with Anti-Spyware profiles, and you must configure signature policy settings to sinkhole malicious queries. This proactively stops traffic to known malicious domains.
Sinkholing ensures that DNS queries to malicious FQDNs are redirected to a safe IP, preventing compromise.