diff --git a/PaloAlto/package/Classes/PaloAltoApp.yaml b/PaloAlto/package/Classes/PaloAltoApp.yaml
new file mode 100644
index 00000000..05520259
--- /dev/null
+++ b/PaloAlto/package/Classes/PaloAltoApp.yaml
@@ -0,0 +1,141 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+Namespaces:
+  =: com.mirantis
+  std: io.murano
+  res: io.murano.resources
+  netsfc: org.openstack.networkingSfc
+  sys: io.murano.system
+  conf: io.murano.configuration
+
+Name: PaloAltoApp
+
+Extends: std:Application
+
+Properties:
+  paloalto:
+    Contract: $.class(PaloAltoNode)
+  loadbalancer:
+    Contract: $.class(PaloAltoNode)
+  backendNodes:
+    Contract: [$.class(PaloAltoNode)]
+  network:
+    Contract: $.class(res:Network).notNull()
+  keyname:
+    Contract: $.string()
+  flavor:
+    Contract: $.string().notNull()
+  paImage:
+    Contract: $.string().notNull()
+  image:
+    Contract: $.string().notNull()
+  portPairGroup:
+    Contract: $.class(netsfc:PortPairGroup)
+    Usage: InOut
+  flowClassifier:
+    Contract: $.class(netsfc:FlowClassifier)
+    Usage: InOut
+  portChain:
+    Contract: $.class(netsfc:PortChain)
+    Usage: InOut
+
+Methods:
+  .init:
+    Body:
+      - $._environment: $.find(std:Environment).require()
+
+  deploy:
+    Body:
+      - If: not $.getAttr(deployed, false)
+        Then:
+          - $._log: $._environment.reporter
+          - $._log.report($this, 'Deploying SFC network...')
+          - $.network.deploy()
+
+          # preparing Firewall
+          - $.paloalto.spawnInstance(name => 'paloalto-fw-instance',
+              network => $.network, flavor => $.flavor,
+              image => $.paImage, portNum => 2)
+
+          # port pair & port pair group
+          - $._log.report($this, 'Deploying port pair...')
+          - $portPair: new(
+              netsfc:PortPair, $this, ingress => $.paloalto.ports[1],
+              egress => $.paloalto.ports[1], name => 'paloalto')
+          - $portPair.deploy()
+          - $.portPairGroup: new(
+              netsfc:PortPairGroup, $this, portPairs => [$portPair], name => 'paloalto')
+          - $.portPairGroup.deploy()
+
+          # preparing loadbalancer
+          - $.loadbalancer.spawnInstance(name => 'paloalto-loadbalancer',
+              network => $.network, flavor => $.flavor,
+              image => $.image)
+
+          # backends
+          - $net: $.network
+          - $.backendNodes.pselect($.spawnInstance(flavor => $.flavor,
+              image => $.image, network => $net, name => $.name))
+
+          # deploying and configuring software
+          - $._log.report($this, 'Deploying software on backend server...')
+          - $.loadbalancer.deploySoftware('loadbalancer')
+          - $.backendNodes.pselect($.deploySoftware('backend'))
+
+          - $bips: $.backendNodes.select($.getInternalIp())
+          - $backendIps: format('{0}', ':'.join($bips))
+          - $._log.report($this, format( "backend ips => {0}", $backendIps))
+          - $.loadbalancer.configureSoftware('loadbalancer', $backendIps)
+          - $.backendNodes.pselect($.configureSoftware('backend', $backendIps))
+
+          - $._log.report($this, 'Deploying flow classifier...')
+          - $.flowClassifier: new(
+              netsfc:FlowClassifier, $this, protocol => 'TCP', name => 'paloalto',
+              destinationIpPrefix => format("{0}/32",$.loadbalancer.getInternalIp()),
+              destinationPortMin => 80, destinationPortMax => 80)
+          - $.flowClassifier.deploy()
+          - $._log.report($this, 'Deploying port chain...')
+          - $.portChain: new(
+              netsfc:PortChain, $this,
+              name => 'paloalto',
+              portPairGroups => [$.portPairGroup],
+              flowClassifiers => [$.flowClassifier])
+          - $.portChain.deploy()
+
+          # Workaround: due to current PA config drive support implementation
+          # it is required that user will distribute config manually
+          - $replacements:
+              "%ZONEIP%": $.paloalto.getSecondIp()
+          - $config: sys:Resources.string('pa-configuration.xml').replace($replacements)
+          - conf:Linux.putFile($.loadbalancer.agent, $config, '/home/ubuntu/pa-config.xml')
+
+          # Workaround: unusual number of sleeps is due to LP #1611019 - then this gets
+          # resolved, need to remove it.
+          - $lbip: $.loadbalancer.getInternalIp()
+          - $._log.report($this, 'Due to current PA config import implementation you need to do the following manually')
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, format('1. Assign floating IP to PA machine to {0} IP', $lbip))
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, '2. Login via SSH to this host using ssh admin@floating_ip')
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, format('scp import configuration from ubuntu\@{0}:pa-config.xml \#password is ubuntu', $lbip))
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, 'configure')
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, 'load config from pa-config.xml')
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, 'commit')
+          - conf:Linux.runCommand($.loadbalancer.agent, 'sleep 1')
+          - $._log.report($this, 'Deployment finished. Please see the deployment logs')
+
+          - $.setAttr(deployed, true)
diff --git a/PaloAlto/package/Classes/PaloAltoNode.yaml b/PaloAlto/package/Classes/PaloAltoNode.yaml
new file mode 100644
index 00000000..de57523e
--- /dev/null
+++ b/PaloAlto/package/Classes/PaloAltoNode.yaml
@@ -0,0 +1,100 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+Namespaces:
+  =: com.mirantis
+  std: io.murano
+  res: io.murano.resources
+  sys: io.murano.system
+  netsfc: org.openstack.networkingSfc
+
+Name: PaloAltoNode
+
+Extends: netsfc:Instance
+
+Properties:
+  name:
+    Usage: InOut
+    Contract: $.string().notNull()
+  flavor:
+    Usage: InOut
+    Contract: $.string()
+  image:
+    Usage: InOut
+    Contract: $.string()
+  keyname:
+    Usage: InOut
+    Contract: $.string()
+  network:
+    Usage: InOut
+    Contract: $.class(res:Network)
+
+Methods:
+  .init:
+    Body:
+      - $._environment: $.find(std:Environment).require()
+
+  getInternalIp:
+    Body:
+      - Return: $.ipAddresses.first()
+
+  getSecondIp:
+    Body:
+      - Return: $.ipAddresses[1]
+
+  spawnInstance:
+    Arguments:
+      - name:
+          Contract: $.string().notNull()
+      - flavor:
+          Contract: $.string()
+      - image:
+          Contract: $.string()
+      - keyname:
+          Contract: $.string()
+      - network:
+          Contract: $.class(res:Network)
+      - portNum:
+          Contract: $.int()
+          Default: 1
+
+    Body:
+      - $._environment.reporter.report($this, format( 'Creating {0} VM with {1} port(s)...',
+          $.name, $portNum))
+      - Repeat: $portNum
+        Do:
+          - $port: new(netsfc:NeutronPort, $this, network => $network)
+          - $.ports: $.ports.append($port)
+      - $.deploy()
+      - $._environment.reporter.report($this, format( 'VM {0} deployed', $.name))
+
+  deploySoftware:
+    Arguments:
+      - role:
+          Contract: $.string().notNull()
+    Body:
+      - $resources: new(sys:Resources)
+      - $template: $resources.yaml('PaloAltoDeploy.template').bind(dict(role => $role))
+      - $.agent.call($template, $resources)
+
+  configureSoftware:
+    Arguments:
+      - role:
+          Contract: $.string().notNull()
+      - backends:
+          Contract: $.string().notNull()
+
+    Body:
+      - $resources: new(sys:Resources)
+      - $template: $resources.yaml('PaloAltoConfigure.template').bind(dict(role => $role,
+          backends => $backends))
+      - $.agent.call($template, $resources)
diff --git a/PaloAlto/package/LICENSE b/PaloAlto/package/LICENSE
new file mode 100644
index 00000000..67db8588
--- /dev/null
+++ b/PaloAlto/package/LICENSE
@@ -0,0 +1,175 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
diff --git a/PaloAlto/package/README.rst b/PaloAlto/package/README.rst
new file mode 100644
index 00000000..68e3b838
--- /dev/null
+++ b/PaloAlto/package/README.rst
@@ -0,0 +1,7 @@
+=================
+PaloAlto Firewall
+=================
+
+This application will deploy PaloAlto Firewall, http Loadbalancer and number of
+http backends and will setup SFC which will push traffic to Loadbalancer
+thru PaloAlto Firewall on port 80.
diff --git a/PaloAlto/package/Resources/PaloAltoConfigure.template b/PaloAlto/package/Resources/PaloAltoConfigure.template
new file mode 100644
index 00000000..256e60f7
--- /dev/null
+++ b/PaloAlto/package/Resources/PaloAltoConfigure.template
@@ -0,0 +1,32 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+FormatVersion: 2.0.0
+Version: 1.0.0
+Name: Deploy PaloAlto software
+
+Parameters:
+  role: $role
+  backends: $backends
+
+Body: |
+  return PaloAltoConfigure('{0} {1}'.format(args.role, args.backends)).stdout
+
+Scripts:
+  PaloAltoConfigure:
+    Type: Application
+    Version: 1.0.0
+    EntryPoint: runPaloAltoConfigure.sh
+    Files: []
+    Options:
+      captureStdout: true
+      captureStderr: true
diff --git a/PaloAlto/package/Resources/PaloAltoDeploy.template b/PaloAlto/package/Resources/PaloAltoDeploy.template
new file mode 100644
index 00000000..3ab10290
--- /dev/null
+++ b/PaloAlto/package/Resources/PaloAltoDeploy.template
@@ -0,0 +1,32 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+FormatVersion: 2.0.0
+Version: 1.0.0
+Name: Deploy PaloAlto software
+
+Parameters:
+  role: $role
+
+
+Body: |
+  return PaloAltoDeploy('{0}'.format(args.role)).stdout
+
+Scripts:
+  PaloAltoDeploy:
+    Type: Application
+    Version: 1.0.0
+    EntryPoint: runPaloAltoDeploy.sh
+    Files: []
+    Options:
+      captureStdout: true
+      captureStderr: true
diff --git a/PaloAlto/package/Resources/pa-configuration.xml b/PaloAlto/package/Resources/pa-configuration.xml
new file mode 100644
index 00000000..7d80f248
--- /dev/null
+++ b/PaloAlto/package/Resources/pa-configuration.xml
@@ -0,0 +1,390 @@
+<?xml version="1.0"?>
+<config version="7.0.0" urldb="paloaltonetworks">
+  <mgt-config>
+    <users>
+      <entry name="admin">
+        <phash>fnRL/G5lXVMug</phash>
+        <permissions>
+          <role-based>
+            <superuser>yes</superuser>
+          </role-based>
+        </permissions>
+      </entry>
+    </users>
+  </mgt-config>
+  <shared>
+    <application/>
+    <application-group/>
+    <service/>
+    <service-group/>
+    <botnet>
+      <configuration>
+        <http>
+          <dynamic-dns>
+            <enabled>yes</enabled>
+            <threshold>5</threshold>
+          </dynamic-dns>
+          <malware-sites>
+            <enabled>yes</enabled>
+            <threshold>5</threshold>
+          </malware-sites>
+          <recent-domains>
+            <enabled>yes</enabled>
+            <threshold>5</threshold>
+          </recent-domains>
+          <ip-domains>
+            <enabled>yes</enabled>
+            <threshold>10</threshold>
+          </ip-domains>
+          <executables-from-unknown-sites>
+            <enabled>yes</enabled>
+            <threshold>5</threshold>
+          </executables-from-unknown-sites>
+        </http>
+        <other-applications>
+          <irc>yes</irc>
+        </other-applications>
+        <unknown-applications>
+          <unknown-tcp>
+            <destinations-per-hour>10</destinations-per-hour>
+            <sessions-per-hour>10</sessions-per-hour>
+            <session-length>
+              <maximum-bytes>100</maximum-bytes>
+              <minimum-bytes>50</minimum-bytes>
+            </session-length>
+          </unknown-tcp>
+          <unknown-udp>
+            <destinations-per-hour>10</destinations-per-hour>
+            <sessions-per-hour>10</sessions-per-hour>
+            <session-length>
+              <maximum-bytes>100</maximum-bytes>
+              <minimum-bytes>50</minimum-bytes>
+            </session-length>
+          </unknown-udp>
+        </unknown-applications>
+      </configuration>
+      <report>
+        <topn>100</topn>
+        <scheduled>yes</scheduled>
+      </report>
+    </botnet>
+  </shared>
+  <devices>
+    <entry name="localhost.localdomain">
+      <network>
+        <interface>
+          <ethernet>
+            <entry name="ethernet1/1">
+              <layer3>
+                <ipv6>
+                  <neighbor-discovery>
+                    <router-advertisement>
+                      <enable>no</enable>
+                    </router-advertisement>
+                  </neighbor-discovery>
+                </ipv6>
+                <ndp-proxy>
+                  <enabled>no</enabled>
+                </ndp-proxy>
+                <lldp>
+                  <enable>no</enable>
+                </lldp>
+                <ip>
+                  <entry name="%ZONEIP%"/>
+                </ip>
+                <interface-management-profile>mgmt-all</interface-management-profile>
+              </layer3>
+            </entry>
+          </ethernet>
+        </interface>
+        <profiles>
+          <monitor-profile>
+            <entry name="default">
+              <interval>3</interval>
+              <threshold>5</threshold>
+              <action>wait-recover</action>
+            </entry>
+          </monitor-profile>
+          <interface-management-profile>
+            <entry name="mgmt-all">
+              <permitted-ip>
+                <entry name="0.0.0.0/0"/>
+              </permitted-ip>
+              <http>yes</http>
+              <https>yes</https>
+              <http-ocsp>yes</http-ocsp>
+              <ssh>yes</ssh>
+              <snmp>yes</snmp>
+              <ping>yes</ping>
+              <response-pages>yes</response-pages>
+              <telnet>yes</telnet>
+            </entry>
+          </interface-management-profile>
+        </profiles>
+        <ike>
+          <crypto-profiles>
+            <ike-crypto-profiles>
+              <entry name="default">
+                <encryption>
+                  <member>aes-128-cbc</member>
+                  <member>3des</member>
+                </encryption>
+                <hash>
+                  <member>sha1</member>
+                </hash>
+                <dh-group>
+                  <member>group2</member>
+                </dh-group>
+                <lifetime>
+                  <hours>8</hours>
+                </lifetime>
+              </entry>
+              <entry name="Suite-B-GCM-128">
+                <encryption>
+                  <member>aes-128-cbc</member>
+                </encryption>
+                <hash>
+                  <member>sha256</member>
+                </hash>
+                <dh-group>
+                  <member>group19</member>
+                </dh-group>
+                <lifetime>
+                  <hours>8</hours>
+                </lifetime>
+              </entry>
+              <entry name="Suite-B-GCM-256">
+                <encryption>
+                  <member>aes-256-cbc</member>
+                </encryption>
+                <hash>
+                  <member>sha384</member>
+                </hash>
+                <dh-group>
+                  <member>group20</member>
+                </dh-group>
+                <lifetime>
+                  <hours>8</hours>
+                </lifetime>
+              </entry>
+            </ike-crypto-profiles>
+            <ipsec-crypto-profiles>
+              <entry name="default">
+                <esp>
+                  <encryption>
+                    <member>aes-128-cbc</member>
+                    <member>3des</member>
+                  </encryption>
+                  <authentication>
+                    <member>sha1</member>
+                  </authentication>
+                </esp>
+                <dh-group>group2</dh-group>
+                <lifetime>
+                  <hours>1</hours>
+                </lifetime>
+              </entry>
+              <entry name="Suite-B-GCM-128">
+                <esp>
+                  <encryption>
+                    <member>aes-128-gcm</member>
+                  </encryption>
+                  <authentication>
+                    <member>none</member>
+                  </authentication>
+                </esp>
+                <dh-group>group19</dh-group>
+                <lifetime>
+                  <hours>1</hours>
+                </lifetime>
+              </entry>
+              <entry name="Suite-B-GCM-256">
+                <esp>
+                  <encryption>
+                    <member>aes-256-gcm</member>
+                  </encryption>
+                  <authentication>
+                    <member>none</member>
+                  </authentication>
+                </esp>
+                <dh-group>group20</dh-group>
+                <lifetime>
+                  <hours>1</hours>
+                </lifetime>
+              </entry>
+            </ipsec-crypto-profiles>
+            <global-protect-app-crypto-profiles>
+              <entry name="default">
+                <encryption>
+                  <member>aes-128-cbc</member>
+                </encryption>
+                <authentication>
+                  <member>sha1</member>
+                </authentication>
+              </entry>
+            </global-protect-app-crypto-profiles>
+          </crypto-profiles>
+        </ike>
+        <qos>
+          <profile>
+            <entry name="default">
+              <class>
+                <entry name="class1">
+                  <priority>real-time</priority>
+                </entry>
+                <entry name="class2">
+                  <priority>high</priority>
+                </entry>
+                <entry name="class3">
+                  <priority>high</priority>
+                </entry>
+                <entry name="class4">
+                  <priority>medium</priority>
+                </entry>
+                <entry name="class5">
+                  <priority>medium</priority>
+                </entry>
+                <entry name="class6">
+                  <priority>low</priority>
+                </entry>
+                <entry name="class7">
+                  <priority>low</priority>
+                </entry>
+                <entry name="class8">
+                  <priority>low</priority>
+                </entry>
+              </class>
+            </entry>
+          </profile>
+        </qos>
+        <virtual-router>
+          <entry name="default">
+            <protocol>
+              <bgp>
+                <enable>no</enable>
+                <dampening-profile>
+                  <entry name="default">
+                    <cutoff>1.25</cutoff>
+                    <reuse>0.5</reuse>
+                    <max-hold-time>900</max-hold-time>
+                    <decay-half-life-reachable>300</decay-half-life-reachable>
+                    <decay-half-life-unreachable>900</decay-half-life-unreachable>
+                    <enable>yes</enable>
+                  </entry>
+                </dampening-profile>
+              </bgp>
+            </protocol>
+            <interface>
+              <member>ethernet1/1</member>
+            </interface>
+          </entry>
+        </virtual-router>
+      </network>
+      <deviceconfig>
+        <system>
+          <update-server>updates.paloaltonetworks.com</update-server>
+          <update-schedule>
+            <threats>
+              <recurring>
+                <weekly>
+                  <day-of-week>wednesday</day-of-week>
+                  <at>01:02</at>
+                  <action>download-only</action>
+                </weekly>
+              </recurring>
+            </threats>
+          </update-schedule>
+          <timezone>US/Pacific</timezone>
+          <service>
+            <disable-telnet>yes</disable-telnet>
+            <disable-http>yes</disable-http>
+          </service>
+          <hostname>PA-VM</hostname>
+        </system>
+        <setting>
+          <config>
+            <rematch>yes</rematch>
+          </config>
+          <management>
+            <hostname-type-in-syslog>FQDN</hostname-type-in-syslog>
+          </management>
+          <auto-mac-detect>yes</auto-mac-detect>
+          <tcp>
+            <asymmetric-path>bypass</asymmetric-path>
+          </tcp>
+        </setting>
+      </deviceconfig>
+      <vsys>
+        <entry name="vsys1">
+          <application/>
+          <application-group/>
+          <zone>
+            <entry name="left">
+              <network>
+                <layer3>
+                  <member>ethernet1/1</member>
+                </layer3>
+              </network>
+            </entry>
+          </zone>
+          <service/>
+          <service-group/>
+          <schedule/>
+          <rulebase>
+            <security>
+              <rules>
+                <entry name="test-sfc">
+                  <to>
+                    <member>any</member>
+                  </to>
+                  <from>
+                    <member>any</member>
+                  </from>
+                  <source>
+                    <member>any</member>
+                  </source>
+                  <destination>
+                    <member>any</member>
+                  </destination>
+                  <source-user>
+                    <member>any</member>
+                  </source-user>
+                  <category>
+                    <member>any</member>
+                  </category>
+                  <application>
+                    <member>any</member>
+                  </application>
+                  <service>
+                    <member>any</member>
+                  </service>
+                  <hip-profiles>
+                    <member>any</member>
+                  </hip-profiles>
+                  <action>allow</action>
+                  <rule-type>intrazone</rule-type>
+                  <option>
+                    <disable-server-response-inspection>no</disable-server-response-inspection>
+                  </option>
+                  <log-start>yes</log-start>
+                </entry>
+              </rules>
+            </security>
+          </rulebase>
+          <address>
+            <entry name="%ZONEIP%">
+              <ip-netmask>%ZONEIP%/24</ip-netmask>
+            </entry>
+          </address>
+          <import>
+            <network>
+              <interface>
+                <member>ethernet1/1</member>
+              </interface>
+            </network>
+          </import>
+        </entry>
+      </vsys>
+    </entry>
+  </devices>
+</config>
diff --git a/PaloAlto/package/Resources/scripts/runPaloAltoConfigure.sh b/PaloAlto/package/Resources/scripts/runPaloAltoConfigure.sh
new file mode 100644
index 00000000..71b52f91
--- /dev/null
+++ b/PaloAlto/package/Resources/scripts/runPaloAltoConfigure.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+# $1 = role (backend/loadbalancer)
+# $2 = backend ips
+
+lb(){
+  CONFIG=$(echo "$1" | tr ':' "\n" | while read -r line; do echo "  server ${line}:80;" ; done)
+  sudo tee /etc/nginx/conf.d/backends.conf <<EOF
+upstream backend {
+${CONFIG}
+}
+EOF
+  sudo tee /etc/nginx/sites-enabled/default <<EOF
+server {
+  listen 80 default_server;
+  server_name localhost;
+
+  location / {
+    proxy_pass http://backend;
+  }
+}
+EOF
+  sudo /etc/init.d/nginx reload
+  sudo sed -i 's|PasswordAuthentication no|PasswordAuthentication yes|' /etc/ssh/sshd_config
+  sudo /etc/init.d/ssh restart
+  echo 'ubuntu:ubuntu' | sudo chpasswd
+}
+
+
+http(){
+  sudo tee /usr/share/nginx/html/index.html <<EOF
+<!DOCTYPE html>
+<html>
+<head>
+<title>Welcome to backend!</title>
+</head>
+<body>
+<h1>Welcome to backend $(hostname)</h1>
+</body>
+</html>
+EOF
+}
+
+case "$1" in
+    "loadbalancer" )
+        lb "$2"
+    ;;
+    "backend" )
+        http
+esac
diff --git a/PaloAlto/package/Resources/scripts/runPaloAltoDeploy.sh b/PaloAlto/package/Resources/scripts/runPaloAltoDeploy.sh
new file mode 100644
index 00000000..de314c16
--- /dev/null
+++ b/PaloAlto/package/Resources/scripts/runPaloAltoDeploy.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+# $1 = role (backend/loadbalancer)
+
+install-software() {
+  sudo apt-get install -y nginx
+}
+
+sudo apt-get update
+case "$1" in
+    "loadbalancer" )
+        install-software
+    ;;
+    "backend" )
+        install-software
+esac
diff --git a/PaloAlto/package/UI/ui.yaml b/PaloAlto/package/UI/ui.yaml
new file mode 100644
index 00000000..3136e2bd
--- /dev/null
+++ b/PaloAlto/package/UI/ui.yaml
@@ -0,0 +1,108 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+Version: 2.2
+
+Templates:
+  BackendNode:
+    ?:
+      type: com.mirantis.PaloAltoNode
+    name: generateHostname('paloalto-backend#', $index)
+    flavor: $.appConfiguration.flavor
+    image: $.appConfiguration.image
+    keyname: $.appConfiguration.keyPair
+    networks:
+      useEnvironmentNetwork: false
+      useFlatNetwork: false
+  PANode:
+    ?:
+      type: com.mirantis.PaloAltoNode
+    name: 'paloalto-firewall'
+    flavor: $.appConfiguration.flavor
+    image: $.appConfiguration.paImage
+    keyname: $.appConfiguration.keyPair
+    networks:
+      useEnvironmentNetwork: false
+      useFlatNetwork: false
+  LBNode:
+    ?:
+      type: com.mirantis.PaloAltoNode
+    name: 'paloalto-loadbalancer'
+    flavor: $.appConfiguration.flavor
+    image: $.appConfiguration.image
+    keyname: $.appConfiguration.keyPair
+    networks:
+      useEnvironmentNetwork: false
+      useFlatNetwork: false
+
+  networks:
+    ?:
+      type: io.murano.resources.ExistingNeutronNetwork
+    internalNetworkName: $.appConfiguration.network[0]
+    internalSubnetworkName: $.appConfiguration.network[1]
+
+Application:
+  ?:
+    type: com.mirantis.PaloAltoApp
+  paloalto: $PANode
+  loadbalancer: $LBNode
+  backendNodes: repeat($BackendNode, $.appConfiguration.numberOfBackends)
+  network: $networks
+  paImage: $.appConfiguration.paImage
+  image: $.appConfiguration.image
+  keyname: $.appConfiguration.keyname
+  flavor:  $.appConfiguration.flavor
+
+Forms:
+  - appConfiguration:
+      fields:
+        - name: numberOfBackends
+          type: integer
+          label: Number of backend nodes
+          initial: 1
+          minValue: 1
+          required: true
+          description: >-
+            Select the number of backend nodes.
+        - name: image
+          type: image
+          imageType: linux
+          label: image
+          description: >-
+            Select valid image for the application. Image should already be prepared and
+            registered in glance.
+        - name: paImage
+          type: image
+          imageType: linux
+          label: PAN-OS image
+          description: >-
+            Select image of Palo Alto vFW. Image should already be prepared and
+            registered in glance.
+        - name: keyPair
+          type: keypair
+          label: Key Pair
+          description: >-
+            Select the Key Pair to control access to instances. You can login to
+            instances using this KeyPair after the deployment of application.
+          required: false
+        - name: network
+          type: network
+          label: Network
+          description: Select a network to join. 'Auto' corresponds to a default environment's network.
+          required: false
+          murano_networks: translate
+        - name: flavor
+          type: flavor
+          label: Instance flavor
+          description: >-
+            Select registered in Openstack flavor. Consider that application performance
+            depends on this parameter.
diff --git a/PaloAlto/package/logo.png b/PaloAlto/package/logo.png
new file mode 100644
index 00000000..ba18178c
Binary files /dev/null and b/PaloAlto/package/logo.png differ
diff --git a/PaloAlto/package/manifest.yaml b/PaloAlto/package/manifest.yaml
new file mode 100644
index 00000000..4b2be0e5
--- /dev/null
+++ b/PaloAlto/package/manifest.yaml
@@ -0,0 +1,25 @@
+#  Licensed under the Apache License, Version 2.0 (the "License"); you may
+#  not use this file except in compliance with the License. You may obtain
+#  a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#  License for the specific language governing permissions and limitations
+#  under the License.
+
+Format: 1.3
+Type: Application
+FullName: com.mirantis.PaloAlto
+Name: PaloAlto App
+Description: |
+  "PaloAlto Networks virtual Firewall application with http loadbalancer and configurable number of backends"
+Author: 'Mirantis, Inc'
+Tags: [Palo, Alto, PaloAlto]
+Classes:
+ com.mirantis.PaloAltoNode: PaloAltoNode.yaml
+ com.mirantis.PaloAltoApp: PaloAltoApp.yaml
+Require:
+  org.openstack.networkingSfc: