Security capacity that scales with event demand.
Application and threat protection, with capacity for event peaks and a smaller everyday baseline.
Australian Grand Prix Corporation
The constraint
AGPC needed to move from a hosted firewall environment to cloud-based inspection while preserving site connectivity, internet access and third-party connections. The design also had to handle event peaks without carrying peak firewall capacity all year.
Our work
Quokka and Sixfold connected AGPC’s sites to application and threat protection in AWS, using Palo Alto Networks VM-Series and Transit Gateway. The design adds inspection capacity for event demand and releases it afterwards, keeping everyday operation separate from event-scale cost.
Palo Alto Networks VM-Series · Capacity model
Everyday operation
Always on · Software NGFW credits
Base capacity across two availability zones.
Scale out with demand
Always on · Software NGFW credits
Warm pair · Software NGFW credits
PAYG pairs · added as demand requires
Activate Burst, then add Burst Plus pairs as needed.
Return to base
Always on · Software NGFW credits
Stop Burst and remove PAYG capacity after the peak.
What changed
Connect the sites through AWS
Bring the existing site network into AWS over Telstra Cloud Connect and AWS Direct Connect. Use Transit Gateway to join site, cloud and VPN connections and steer traffic through the inspection environment.
Scale inspection capacity
The VM-Series inspection pool behind AWS Gateway Load Balancer expands in stages. Base runs continuously across two availability zones. Burst starts the warm credit-licensed pair; Burst Plus adds pay-as-you-go pairs for further demand. Session load, dataplane utilisation and instance health inform capacity decisions.
Scale back after the event
As monitored capacity utilisation fell after Formula 1, the system scaled back to its operating baseline: the two Burst instances stopped and Cloud Connect returned to 1 Gbps, avoiding the ongoing cost of unused event capacity.
The result
The environment supported Formula 1 and MotoGP operations without downtime. During Formula 1, the environment handled over 10,000 new sessions per second, 700,000 packets per second and 200,000 active sessions at peak. After the event, the inspection pool returned from four VM-Series instances to two.
Delivered by Quokka Advisory in joint venture with Sixfold.
Event demand
per second
per second
sessions
Use the headroom when it matters.
The architecture combines AWS Transit Gateway, Gateway Load Balancer and a Palo Alto Networks VM-Series pool. Capacity responds dynamically to monitored utilisation, scaling back after the event to keep ongoing costs tied to normal operations.
“Everything is running very well here. The gates have been open for a while now and the place is packed again. Everything is working as expected and I have even had some positive feedback along the way”
Feedback to the joint Quokka and Sixfold delivery team.
The engineering decisions.
We used Terraform to define and deploy the AWS infrastructure as code, giving the team repeatable builds and a clear view of proposed changes before applying them. ACIS (AWS Centralised Inspection Solution) brought warm-pool readiness, licence lifecycle management and organisation-owned public addressing into the scaling design.
Warm pools for faster Burst activation
The two Burst instances were pre-provisioned and licensed, then held in a stopped warm pool. Starting prepared instances avoids the full provisioning cycle when extra capacity is needed. Before the event, the team started the pair and checked AWS health, Panorama registration, security content, certificates, logging and monitoring. The pair stayed running through the event, ready to carry demand. Afterwards, it returned to the stopped pool for reuse while the two Base instances continued operating.
Licensing, de-licensing and scale-in
Base and Burst use Software NGFW Credits, with bootstrap and Panorama licence management handling instance registration and licence allocation. The lifecycle distinguishes reusable Burst instances, which retain their licences while stopped, from retired credit-licensed instances, which require de-licensing to reclaim credits. Burst Plus uses pay-as-you-go pairs for additional demand. The scale-in sequence removes those PAYG instances first, then stops the warm pair, leaving Base running. Compute, licence allocation and readiness are managed together.
BYOIP and an organisation-owned public ASN
AGPC secured its own public address space and public ASN through APNIC. AWS Bring Your Own IP brings the organisation’s IPv4 prefix into an AWS public IP pool for internet egress. Delivery included prefix ownership verification, address allocation and checks of outbound source addresses and access to third-party services. This gives AGPC control of its public addressing, supports consistent partner allowlists and reduces dependence on the reputation of provider-assigned address ranges.
Routing and health across availability zones
Site traffic reaches AWS through MPLS, Telstra Cloud Connect and Direct Connect. Transit Gateway joins site, cloud and VPN connections; appliance mode preserves traffic symmetry through inspection. Gateway Load Balancer distributes traffic to healthy VM-Series instances across two availability zones. CloudWatch session, throughput and dataplane utilisation metrics inform capacity decisions. Health checks determine which instances can take traffic, so adding capacity includes confirming it is ready to serve.
Consistent protection as capacity changes
Panorama applies the same application and threat protection policy across the pool as instances join or leave. The engineering includes App-ID, Threat Prevention and URL controls, managed through common templates and device groups. Capacity can change without redefining that policy. During migration, coordinated route changes kept internet and VPN traffic on the intended operating path across AWS and the existing environment.
More of our work
All project storiesConnect the studios. Keep security in the path.
Routing, load sharing and network security across ALT VFX’s studios, data centres and AWS connections.
ALT VFXBuild cloud security into a connected environment.
Infrastructure as Code, cloud security and a successful migration, with Telstra Cloud Connect linking the wider network.
Fire Rescue VictoriaWhat needs to work better?
Talk to us about the environment, the constraint and the change.