Instead of using Palo Alto (PA) Firewall, Hillstone Firewall can use in between VPC to form VPN tunnel to encrypt traffic between VPC and also as a security control point.
Reference:
腾讯云部署云界5.5R9P6版本验证案例
Tencent Cloud using 3rd parties firewall to between VPC firewall solution - Hillstone