Hi Andrew,

One use case that is immediately useful for multiple instances on aa single chassis is the use case where we want to inspect VPN traffic and handle SSL decrypt off box.

Instance_1 --> Load balancer to SSL decrypt --> Instance_2

By sandwiching the LB between 2 NGFW instances, we could terminate the VPN traffic, decrypt the SSL payloads, then L7 inspect the traffic in clear text, before ultimately passing the traffic off to the destination servers.

I'm wondering if another use-case could be where the VPN and SSL decrypt are handled by instance 1 and layer 7 handled by instance 2 (No LB in this mix). Could a hardware resource limitation be set on each instance so that SSL in instance 1 would never starve CPU cycles from the inspect engines in instance 2 or vise-versa?