Palo Alto Networks NG Firewalls Reviews

We use Palo Alto firewalls to secure the enterprise network and connect our branch offices with our data centers.

A lot of Palo Alto's attack mitigation is automatic. It's nice that you can define security policies and profiles, and the firewall can automatically take action to mitigate attacks as they occur.

We can avoid downtime because Palo Alto supports high-availability firewalls, which usually enable us to do maintenance without interruption to the enterprise. We also have redundancy in our wide area, so we are not dependent on one internet provider. If it fails, we can route across an alternate provider through our VPN tunnels. 

Palo Alto solutions are scalable and highly capable. NG firewalls offer a complete solution that's reliable, consistent, easy to manage, and full of rich security features. They're easier than other firewalls and certainly more effective.

NG Firewalls provide a unified platform that natively integrates all security capabilities. It's critical to have a cohesive system that works across the entire organization. Palo Alto embeds machine learning into the firewall's core, which is necessary to keep up with the threat landscape. 

Palo Alto could improve its machine-learning capabilities. That's all new. They integrate the telemetry data and analytics up to the cloud, where they can analyze security policies and best practices like DNS Security. It uses AI tools to sort through all the massive logs and highlight where you can take action or be aware of what's happening. If you don't have many tools in your organization, it's nice to have one tool that does an excellent job across the board. 

I have used Palo Alto NG Firewalls for five and a half years. 

Palo Alto firewalls have excellent scalability. The same techniques and configuration scale from a small branch office to larger data centers. They're consistent in terms of configuration. You have centralized administration through Panorama to manage all of them easily and have global visibility with both configuration and logging.

I rate Palo Alto support seven out of 10. Palo Alto has some excellent engineers, but recently, I've had difficulty finding a technician who can solve the problem quickly.  They're easy to reach, but it's sometimes harder to communicate with the support engineers. Some are more effective, but other engineers take a couple of days to analyze the issue. The support is not as good as it used to be.

I've used other brands of firewalls in another company, and this company has used some older firewalls. I have used Juniper SRX and NetScreen firewalls. I've also worked with Cisco ASA and SonicWall firewalls.

Palo Alto firewalls provide better visibility into the data and excellent logging that enables you to track all threats and activity. They seem to be more resilient to attacks. Other brands get overwhelmed by DDOS attacks, whereas Palo Alto has multiple levels of security that can head off some of those floods. They act almost like an intrusion detection system and some form of DDoS protection. They do a good job if you can't afford a separate product.

I rate Palo Alto NG firewalls nine out of 10 for ease of setup. They're easier to set up than Juniper SRX or NetScreen. When I arrived, they had already installed a few firewalls, but they weren't working well. The failover and high availability were not set up properly. 

They were new to Palo Alto. They started deploying a few in their branch offices and configuring them with Panorama, so they're all registered and centrally administered. There are consistent policies and shared objects across your organization for filtering geographic regions and things like that. 

The IT VP administered some of the network after their other engineer left. They had previously used Fortinet and only recently purchased Palo Altos, but they were trying to get them deployed. As a senior network engineer, I deployed it with the IT VP, and the IT manager made some operational changes. I and a member of my team maintain the firewalls. 

Palo Alto enables you to support an extensive, busy network with fewer people. You can centrally administer the solution and apply automated content updates for virus and threat prevention. Once you get these things set up, they do a lot of it independently. You only need to keep a close watch on them. 

Palo Alto can be priced higher than some less capable firewalls. However, they are exceptional when you consider the completeness of the solution and its ability to handle threats. Palo Alto is better than other solutions, which justifies a slightly higher price point. You have other tools that are easier to deploy, reducing your total cost of ownership. The newer models are faster, making the pricing more attractive.

A cheaper solution might be better if you have a small or home business that doesn't have many security requirements. Palo Alto scales down to small offices and larger data centers and enterprises. Their product scales to a wide range of use cases. 

I rate Palo Alto NG Firewalls 10 out of 10. I recommend spending time with Palo Alto and other support partners planning and understanding your network before you deploy. You can simplify many capabilities into common rules that you can apply consistently across the organization to save time. Planning can help you build consistency in naming address objects, VLANs, and network resources.

I primarily help users migrate from traditional firewalls to Palo Alto NG Firewalls. This involves troubleshooting, assisting with application control and backup configuration, and teaching users how to optimize the firewall for their needs. Additionally, I guide users through the process of redesigning their firewalls and migrating their servers, which often includes helping them understand and manage the vast number of applications they have. Sometimes, the firewall cannot identify specific applications, requiring customization to ensure accurate recognition and security. Currently, I am working on a management query language, which involves collaborating with other teams to assess the necessity of specific applications and connections between the firewall and various assets. This ensures optimal security and network efficiency.

Although Palo Alto Networks NG Firewalls now utilize machine learning, its significance wasn't initially apparent to me. My first experience with Palo Alto revealed the power of their machine learning through features like WildFire, which uses real-time analysis to understand and combat hacker attacks. While early versions had tools like Power Tool that hinted at machine learning capabilities, Palo Alto didn't explicitly promote this functionality until version 10, likely in response to increasing market competition and the growing prominence of machine learning in firewalls. The embedded machine learning is helpful.

Palo Alto NG Firewalls has improved our organization's security by providing strong protection through network segmentation and XDR. The firewall has proven effective in reducing security risks and monitoring endpoint activity. It offers excellent application recognition and thorough threat analysis, boosting overall network security.

Palo Alto NG Firewalls have reduced over 90 percent of our network downtime.

Palo Alto NG Firewalls offer an efficient interface that simplifies log checking, troubleshooting connection issues, and firewall policy configuration. The process is user-friendly, guiding users through network infrastructure setup, interface creation, settings application, and policy configuration in a clear and intuitive manner.

Palo Alto Firewalls can improve their support structure, especially concerning longer working hours for engineers. Enhancing support teams' capability to handle cases without much delay would be beneficial. Additionally, the high cost of the product could be re-evaluated.

I have been using Palo Alto Next Generation Firewalls for over ten years.

Palo Alto NG Firewalls are stable. On a scale of one to ten, I would rate them around seven or eight for stability.

I find Palo Alto NG Firewalls to be highly scalable, and would rate their scalability as eight out of ten.

Customer support's effectiveness depends on the clarity and completeness of information provided by users.

Neutral

I've used Check Point and Fortinet in addition to Palo Alto, but I prefer Palo Alto's interface and performance.

The initial setup for Palo Alto NG Firewalls is clear and instructive, detailing network infrastructure setup before advancing to policy configuration.

A fresh deployment of Palo Alto NG Firewalls can be completed in three days, followed by a two-day handover session to train users. This totals five days for deployment and training. However, migrations for companies with over 10,000 users and 20 subnets can take up to a month, potentially involving additional user requests or a phased approach.

I have vast experience deploying these firewalls on-premises within our team, making use of the intuitive interface provided by Palo Alto for implementation.

Although Palo Alto is expensive, its superior security functions, application identification, and overall performance justify the cost and make it stand out from the competition.

I would rate Palo Alto NG Firewalls nine out of ten. The Palo Alto NG Firewalls are great, but they are expensive.

I'm most interested in Palo Alto NG Firewalls, specifically how to improve their efficiency and application identification capabilities. Sometimes applications have unique requirements or behave differently, making accurate identification crucial. Palo Alto NG Firewalls excel at application-level security because they can block traffic, prevent attacks, and identify potentially compromised applications. Unlike traditional firewalls, Palo Alto NG Firewalls go beyond basic policy enforcement and traffic filtering by incorporating intrusion prevention systems and antivirus functionality. This allows them to analyze internal traffic for risks, similar to how antivirus software protects endpoints.

Future users need to appreciate the costs involved in using Palo Alto, and the manual configuration required is beneficial because it ensures clarity and control over what is being configured. To enhance your organization's security posture and management, I recommend implementing Palo Alto Networks NG Firewalls.

Three people in our organization are directly using the Palo Alto NG Firewalls.

Upgrading Palo Alto Next-Generation Firewalls requires some maintenance.

We provide localization services and use Palo Alto Networks NG Firewalls to protect our environment.

We have two on-premises Palo Alto Networks NG Firewalls that are managed in the cloud.

Palo Alto Networks NG Firewalls provide a unified platform for centralized management. This is one of the most critical features of the NG Firewalls.

Palo Alto Networks NG Firewalls utilize embedded machine learning to combat the evolving landscape of cyber threats. This is crucial because traditional security methods often fall short against modern malware and sophisticated attacks. By employing machine learning, these firewalls proactively identify and mitigate risks in a way that static rules-based systems cannot, effectively countering the advanced techniques increasingly used by malicious actors.

It helps reduce downtime in our organization by 98 percent.

Palo Alto Networks NG Firewalls offer a comprehensive suite of security features, with Intrusion Prevention System and certificate inspection being among the most valuable.

The machine learning feature, with its continuous potential for improvement, directly enhances the security of Palo Alto Networks NG Firewalls.

I have been using Palo Alto Networks NG Firewalls for almost 12 years.

The technical support is good, and Palo Alto has excellent documentation.

Positive

We also use FortiGate Firewalls in addition to Palo Alto Networks NG Firewalls. Both offer similar features and prices and are considered top competitors in the market.

The return on investment from Palo Alto Networks Next-Generation Firewalls has been significant, as the enhanced security they provide to the enterprise effectively offsets their cost.

Palo Alto Networks NG Firewalls are affordable, and we get what we pay for.

I would rate Palo Alto Networks NG Firewalls ten out of ten.

We have over 10,000 end users.

When choosing a firewall, cost often reflects capability. While budget-friendly options exist, their security levels may not match those of higher-end providers like Palo Alto or Fortinet. Investing in a robust firewall often provides enhanced protection and advanced features, justifying the higher cost.

We have three employees and one consultant who are responsible for the maintenance of our NG Firewalls.

NG Firewalls form the edge between customers' networks and the internet. They often provide load balancing to multiple internet providers. In most cases, people use NG Firewalls for more than just a basic firewall function. 

The intrusion detection and prevention feature is usually the most significant piece that people want because it provides layers of protection against malware, ransomware, and things of that nature.

My colleague likes to tell our clients that none of his customers who installed a Palo Alto have ever had a ransomware attack. I'm always nervous when he says that because things change so fast. However, it gives people peace of mind that they're protected at the network's edge. 

The firewall is going to do everything possible to protect resources and data. We have customers with social security numbers, HIPAA data, and other sensitive customer information. Other products don't seem to provide the same level of protection and leave customers open to malware or ransomware attacks.

Palo Alto has many features to protect against data leakage and unauthorized downloads, so it can do quite a lot to protect a network against any attack. The leadership at our client companies feel reassured that they've done what they can with the best solution out there to protect themselves.

Smart people always do stupid things, like clicking on something they shouldn't. They often realize their mistake five minutes or five seconds after doing it. We've seen what these mistakes can quickly do to an organization. Palo Alto's features help you prevent those types of things from happening. You can immediately block suspicious file downloads and push those up to Palo Alto to investigate. You can get ahead of the problem and help other folks who might not have seen that attack.

NG Firewalls provide a unified platform that natively integrates all security capabilities. Having all those features in one platform at the edge is essential. That's a massive component of the customers' overall security structure. It isn't everything, but it protects the edge of the network. 

It does not prevent someone from getting their company laptop infected at home and infecting the network when they come to the office the next day. That's where other pieces come into play to make an overall security structure. The firewall is designed to protect everything at the edge and has everything you need to do that. It protects you at the edges and provides reports that give people information about what's happening on the network at a given time and date. 

NG Firewalls take care of any holes in the client's network and reduces the number of security tools needed. A decade ago, deploying these types of tools required multiple devices, whether that was Barracuda email, firewall, and an intrusion detection platform. Generally, people had antivirus and anti-spyware systems running in their enterprises. All of that is now integrated into the Palo Alto Firewall platform. 

The antivirus and anti-spyware features are as good as anything out there. It's updated constantly, so any novel threats are automatically detected. On top of all these features, it provides a solid edge platform that incorporates all of the security features necessary in that edge component.

One of the simple features I like about Palo Alto firewalls is that it's extremely easy to find out what's happening in the network. The reporting is phenomenal, and it's easy to find which threats have been detected and what traffic is going through the box. When a customer notices something is wrong, you can quickly check the amount of traffic going through the firewall around that time. If there is anything out of the ordinary, you can decide it needs to be investigated further.

I talk to customers a lot about simple aspects. Palo Alto firewalls have vast technical capabilities in the signature database, which is constantly updated. Palo Alto does a lot of work to find threats in the wild, which is rare among vendors. From a practical and operational standpoint, the ability to see what's happening at any time, live or historically, is a huge benefit compared to other firewalls that are out there.

Machine learning is a massive part of it. Threats are always evolving, and they can constantly update the signatures they're hunting and the raw data streams they're looking for outside of something that's been defined as a true signature type of attack.

Most of my customers use what Palo Alto refers to as the Wildfire functionality. Their online analysis team checks every 15 minutes to find anything new that has been detected in the wild anywhere in the world. Once their team finds something, they immediately disseminate that information down to the firewalls so they can start looking for something new. That includes anything that has evolved from one version of an attack to another. So far, we have not run into any issues with changing attacks creating problems for customers with a Palo Alto firewall in place.

It's rare for our customers to use the zero-day intelligence feature to upload information to Palo Alto. Still, receiving anything from Palo Alto that others have detected out in the wild is beneficial. Any zero-day signature people find in a data stream can be pushed down to the firewalls, and it's a huge benefit to know that the firewall can stay on top of the changes in the attack world.

The PA 400 series is excellent. It's the product that they were missing. Years ago, there was a Palo Alto 200 and a Palo Alto 500. The 500 was a relatively low-cost platform that focused more on team-sized businesses. It reached the end of its life, and they replaced it with an 800, a similar form factor but quite a bit more expensive. The 200 was replaced with a 220, which was at the low end cost-wise in the product family, but they never had anything in the middle. 

They didn't have something that offered high performance at a reasonable cost. The 400s provide that missing link inside their product family to cater to small and medium-sized businesses. Because more and more, even though companies are small, with 50 to 100 people in a company, internet bandwidth has gotten so cheap that they're typically running 1+ gigabit-per-second connections out to the internet.

While they may not be using that much bandwidth today, that will change as they do more and more online. We saw during the pandemic how that could change quickly. Suddenly, everybody's working from home, and internet connectivity is the company's lifeblood. The 400 series gives customers decent performance at a lower price point in a small form factor. It's a product they can deploy, knowing it will protect them and provide the performance they need for years.

The reporting and visibility are phenomenal, but you don't get that information out of the box. They can email reports regularly, and the functionality is all there. However, a lot of it is based on an older model for email, where customers have in-house email servers. The small and medium-sized business customers I deal with are moving toward Office 365 or some other cloud-based mail and not maintaining their own internal mail servers. 

Palo Alto is developing that, and I need to understand how they integrate with an Office 365-type mail environment. The next piece is figuring out how to get that information to the people who need it without somebody physically sitting in front of the screen or going to the firewall to have it delivered to them regularly. The capability is there, but it's primarily based on an older email architecture that customers rarely use anymore.

I'm an integrator who has been doing professional services with Palo Alto installations for at least eight years.

Palo Alto firewalls are solid. I can recall that we haven't had platform failures or product issues with the Palo Alto Firewalls. Everything can have a power supply failure. We have seen that occasionally, but it's rare. In eight years, we've had to replace power supplies in two firewalls out of hundreds we've deployed. It's a physically stable platform, and the software is also solid. I typically avoid the most recent software versions until they reach what I consider mature and seasoned. 

We've seldom had issues with performance. I always tell people that internet bandwidth will be bigger and cheaper in the future, so firewalls need to keep pace from a performance standpoint. Palo Alto has done a decent job of bringing out new models with higher throughput levels while maintaining all the threat-driven functions. But we constantly need to evaluate where we are with internet bandwidth and where we expect to be in the future. 

We tell people that the physical hardware platform they choose will protect them today, no matter which one. However, the choice will determine how long that can stay in your network. It ultimately comes down to pure bandwidth. As we move towards the cloud, more and more internet bandwidth becomes critical. Multiple internet providers are now essential on most of our customers' networks. The raw bandwidth and performance through the box must keep up with that. Palo Alto's newer platforms have multiple-gigabit throughput, and I assume they'll continue with that as they evolve the product line further.

Their product line includes sizeable chassis-based firewall systems that can do multiple virtual firewalls within a single platform. Even their middle-tier products have that capability. Some of our customers have numerous divisions that need separation between departments, so those scalable features come in handy. Most are organizations with one or two firewalls per site. Still, I've worked with large enterprises that had tens or hundreds of firewalls in their overall environment to maintain a separation between departments and to separate users from servers.

Palo Alto also has a product called Panorama that lets you centralize the configurations of vast numbers of firewalls. It acts as a central point for changing firewall settings, and you can push the changes out to a subset of firewalls in your environment or all of them. The bottom line is that Palo Alto can scale up NG firewalls to massive numbers of platforms.

I rate Palo Alto support eight out of 10. 

Positive

NG Firewalls are easy to set up. I've been doing it for a long time, so it's effortless for me to set them up. When registering a firewall with Palo Alto, you can download a Day 1 configuration into the box with many of the standard protection features activated. 

I don't use that, but I periodically check it to see if there is something else Palo Alto has determined should be enabled or a feature that should be tuned differently than I typically do. They provide the initial configuration with the critical features activated.

Deployment requires a small team. Sometimes, it's only a person from the customer side and me. Usually, it is me plus one other engineer working on deploying these where we've got changes on switches to support the firewall or adjustments to the DNS systems. A lot of different areas come into play when we change the edge. Frequently, our customers are transitioning from a rudimentary network design to a new design where we're implementing firewall and network segmentation within their environment. That's easy, but we use a team of two or three folks to finish the job as quickly as possible.

While all next-generation firewall platforms have some degree of these different components built into them, Palo Alto has rock-solid antivirus, anti-spyware, threat prevention, data leakage prevention, and file blocking, plus all of the typical functions that a firewall does. It does all of these functions exceptionally well in addition to regular firewall aspects like blocking DDoS attacks and generic types of attacks. It tends to be more expensive than most competing platforms, but the return on investment is huge. I'm almost to the point of saying that I won't support any other firewall platforms out there.

There are several new firewall models that have come along, but I tell people that Palo Alto will provide all the protection you could need. There's no reason to look at anything else out there because most other platforms don't provide the same level of protection. The value proposition to customers is the peace of knowing they've got the best protection at the edge they can buy.

The licensing model is becoming more and more typical of vendors. There are several different licenses that we usually provide with the firewalls. DNS security is a newer one, and we're considering the types of customers who might benefit from that. 

The cost of the license is platform-dependent. It would be nice if they standardized that across the board to make the license a flat fee instead of based on scale and the platform you're using. Functionality shouldn't change based on the platform or the amount of data going through it. It's the same functionality on there. That's one aspect customers often raise. The platform's price is what it is, but the ongoing cost of the annual license is hard for some customers to wrap their heads around. 

Many people are just looking for the cheapest, fastest firewall, and my answer is always the same. It's a cliche to say you get what you pay for, but when you opt for the cheapest product, you have to understand that the costs of an attack are monumental. We had a customer who deployed SonicWall firewalls because they wanted something inexpensive that provides a basic level of functionality. They have spent three weeks trying to recover from a ransomware attack because the firewall didn't prevent them from downloading files into their environment, and it lacked some of the features a Palo Alto firewall has.

I tend to use examples like that. It's like switches. When everything's working great, you can go to the local store and buy yourself a cheap and expensive switch, and it'll be fine. But when there are problems, how do you recover? And what can you do with the firewall that will protect you against attacks you don't anticipate? That's where Palo Alto shines. You know you are protected when you deploy it.

Other products are less expensive because they don't provide the same level of functionality. They'll talk about threat prevention, anti-spyware, and malware functions, but they have not been updated automatically like Palo Alto and they lack zero-day functionality. Maybe they don't have some other components, like data leakage protection or file download protections to thwart a concerted attack against organizations.

I always ask people what it would cost to shut down their business for several days. This customer had a solid backup strategy for their servers at least, enabling them to start using cloud-based versions of all their servers within three days. They still were out of business for three days. Now that we've put Palo Alto firewalls in place, they feel confident that's not going to happen again.

I get nervous when people say it can't happen, but we haven't seen it happen with the Palo Alto firewall with the capabilities and features we enable on these boxes. When people say they don't want to spend that money, they need to consider it as something protecting their entire business. An internet connection isn't a nice-to-have; it's the lifeblood of their business, being protected by the firewalls.

I rate Palo Alto NG Firewalls 10 out of 10. People who are only starting with these firewalls should rely on the technical notes and briefs Palo Alto provides on functionality. I started using Palo Alto firewalls years ago, and we deployed firewalls the way we knew how. Later, I worked with another integrator who had been doing it for about two or three years more than I had. He was configuring areas on the firewalls that I had never considered. That becomes the critical piece; turning a firewall up based on what another firewall vendor does is enough to get you the same level of functionality that the other vendors provide.

But with the additional capabilities that Palo Alto includes in the firewalls, it's imperative to have all the different pieces activated as much as the customer can accommodate in their environment. And that's a critical piece that Palo Alto provides a lot of online resources, and there are a lot of technical notes that are out there on what needs to be enabled in addition to that Day 1 configuration. That can give you a big headstart on all the different areas that need to be enabled within the firewall.

We use the solution for all the capabilities that the firewall offers, including proxy filtering, VPN connection, and Next-Gen firewall capability. We integrate the solution with clients that use ExpressRoute, which is a very common and popular service in Australia. We route all our client's local traffic, 10.x, and the client's Class B public address traffic all into Palo Alto Networks NG Firewalls. We use the solution to provide hub and spoke integration, web filtering, and for VPN. 

The solution is a fully managed centralized firewall service for both public and private traffic, including on-prem traffic and Azure traffic.

The solution ties into existing services. We offer network-based services and SD-WAN overlay. We use VeloCloud appliances and put the solution at the heart of that to provide Next-Gen security capability. The solution benefits our clients by reducing the number of firewalls required in their organization, which is hosted in Azure. The solution's aggregation gives us the ability to service our clients by reducing their firewall footprint. The solution also enables us to route all traffic, including internet outbound traffic from a client's side onto Palo Alto NG Firewalls across an ExpressRoute connection.

Palo Alto NG Firewalls provide a unified platform that natively integrates all security capabilities.

In combination with additional tools and services we offer, the solution makes a significant contribution to eliminating security holes.

The solution helps eliminate multiple network security tools and the effort required to have them work together. The solution simplified our operations. We only support and deliver Palo Alto NG firewalls as a service. We don't offer a firewall as a service on any other appliance. We chose Palo Alto because of its Next-Gen capabilities and being the market leader in terms of security appliances. 

I like the native integration into Azure AD and the solution is fantastic from the perspective of managing user access and using the VPN client. The TLS inspection is a fantastic service that's offered in Palo Alto NG Firewalls. In my opinion, the solution is best of breed, which is one of the reasons why we adopted it in the first place.

We have had a couple of DNS attacks and predictive analytics and machine learning for instantly blocking DNS attacks worked well. 

Depending on the license skew, we implement the zero delay signatures feature for some of our customers.

I can enable the features I want and configure the policies based on the user and network traffic, making firewall management much easier.

There are some features of Fortinet such as the virtual domain capability, that I would love to see in this solution, but they don't outweigh the technical capabilities of Palo Alto as the firewall.

We have not taken Palo Alto's firewall management solution because it's too expensive and we don't feel it delivers significant value. We have developed our own reporting. Sometimes there are limitations around the APIs and it would be great if the APIs could be enhanced.

I have been using Palo Alto Networks for about 10 years, but not the Next-Generation version. Five years ago, we set up a Palo Alto firewall as a service with Palo Alto in the back end. We did this for Telstra in Australia, and we're the only company in the world that can support the default route over ExpressRoute, using the Palo Alto Networks NG Firewalls as a service that we offer.

The stability of this solution is unbelievable and the best on the market. We've never had an outage as a result of a technical problem on hundreds of firewalls that we run or thousands when we include the HA pairs and clusters that we've built.

The solution is scalable and we have never reached the limits. We stuck with Palo Alto because of their Next-Gen capabilities, and we have about 500 clients using this solution as a service.

The technical support is exceptionally good. They have more capabilities in Australia now and we've had no problems. The technical support has been so good, we haven't had to look for another vendor.

Positive

The initial setup is straightforward. We have a multi-tenanted version and a single version. We have different flavors of the implementation and it's all scripted. We can build a fully operational firewall HA pair with follow-the-sun, 24-hour, seven-days-a-week support in about 30 minutes. We use DevOps to set everything up and it is effective because it is all scripted.

The implementation was completed in-house.

Our service is incredibly profitable. We don't feel we can offer an alternative that will give us the same return on investment.

The pricing is straightforward with no hidden costs. There is a cost for the licensing, the Virtual Network if the solution is run in Azure, and there is also a cost for the operational support.

I suggest sizing correctly when in the cloud because the skew can always be changed at a later time.

We've evaluated a couple of other products in the past to make sure that we still have the right solution in the market.

I give the solution a nine out of ten.

The embedded machine learning included in the solution's firewall core used to provide inline real-time attack prevention is an important capability because it gives us the heuristics. The solution uses existing knowledge of the service and how we use the firewall, to determine if something nefarious is being undertaken. I don't believe that we are using the feature to its fullest capability.

We integrate Palo Alto NG Firewalls into Sentinel and we use additional data points to determine attacks.

We use the solution's DNS security for some of our clients.

We use a lot of data points from various systems and not only this solution to determine if a threat is live and active. We don't recommend publishing using the solution. We do local DNS resolution using the Palo Alto NG Firewalls. We're purely an Azure consultancy. We use Azure publishing services to publish. We integrate the solution into virtual networks from a DNS point of view, but we are always on the safe side, and we never use the solution for DNS publishing to the public internet. We are an ISB. We provide managed services, but we are primarily an integrator.

In terms of a trade-off between security and network performance, there will always be a performance lag when doing TLS inspections because the traffic has to be decrypted in real-time, however, the benefit outweighs the disadvantages from a network performance perspective. When the TLS inspections are sized properly, the performance lag is hardly noticeable.

We sometimes work with Palo Alto, for example, to support the default route over ExpressRoute.

The maintenance is all scripted and fully automated. We are always at the current stable release and we update as regularly as we get the updates from Palo Alto. There is no impact, no downtime, and no loss of service unless we've got a customer with a single firewall that requires a reboot, in which case we schedule the outage.

I have worked with many different appliances in Azure over the years, and I still do with some clients who already have incumbent NBAs, but for our firewall as a service, I have always used Palo Alto.

What we find is that clients want to utilize the features but don't know how to implement them or have the capability. We offer that support. Palo Alto is extremely good value for the money if we maximize its capabilities. If we want a cheap firewall, then Palo Alto isn't the answer. If we want a capable value-for-money firewall, when we are utilizing all of the services available, Palo Alto is the best on the market. If we want a cheap solution we can go to Fortinet which is not as technically sound but for someone who is price sensitive and doesn't want to use all the features and functions of Palo Alto NG Firewalls that is an option. We work with Palo Alto for our firewall as a service, and we work with Velo for our network as a service. The operational run cost for us is low with these vendors because those firewalls are extremely reliable and because we don't have problems with the firewalls, we don't need a big operational support team.

We did some work with the NHS Test and Trace program and they had a multi-client solution that we deployed hundreds of firewalls across Azure and AWS, using Palo Alto. The client did explore other vendors that were cheaper and after looking at the operational support capability, features, and how reliable the firewall was, the option was clear and not driven by price. 

I would automate the solution. I would use infrastructure as code deployment and manage my devices using IHC. If I was going for a larger state, I would use the solution's management tool.

We're using Palo Alto Networks NG Firewalls as a backup hardware solution. When the main firewalls have an issue, we're using the backup solution and hardware firewalls to avoid any network issues or prolonged downtime.

Palo Alto Networks Firewalls helped us reduce downtime. When we have another backup solution, the firewalls come down, we have backup hardware, and we have a Docker site that can work if we have an issue in our HQ data center.

Palo Alto provides more security. 

I have no issues if the subscription is renewed on time. 

Some configurations can take time.

The dashboard needs improvement as I find it more complicated compared to Sophos. It is not as user-friendly, especially when trying to easily check problems or generate reports which are easier with Sophos.

I've used the solution for two years.

The solution is stable. It has a feature that allows load balancing across multiple lines. If one line drops, another line can maintain service until the issue is resolved and we return to the original line.

The solution is scalable for large companies, however, it is expensive for medium and small companies.

I would rate technical support from Palo Alto at an eight out of ten.

Positive

We are still using a Sophos appliance as well. However, we are planning to consolidate to using just one solution soon.

I was involved in the setup. I participated with the company that ran the implementation. They didn't provide me with most of the information necessary to help implement in other areas.

The consultant company we're dealing with is the one handling the setup for this solution, not us. The consultant is a partner with Palo Alto.

As an investment, if you're going to use it for enterprise, it's good.

The price of Palo Alto Firewalls is too expensive compared to Sophos licenses and appliance hardware.

For medium companies, I would advise using Sophos. For larger enterprises, Palo Alto is more suitable.

I'd rate the solution seven out of ten.

We implemented Palo Alto Networks NG Firewalls as our intrusion prevention system to filter layer seven traffic and perform SSL inspection through deep packet inspection at the application layer.

We use Palo Alto Networks NG Firewalls for layer three packet filtering of east-west and north-south traffic and layer seven filtering through web filtering.

Palo Alto Networks NG Firewalls include Panorama, a unified platform providing a complete overview of our security features. This centralized management tool offers a single pane of glass for monitoring all security touchpoints through metrics, streamlining our network infrastructure protection. As a crucial component of our perimeter defence strategy, Panorama is integral to our overall network security priorities.

The machine learning feature embedded in Palo Alto Networks NG Firewalls for inline, real-time attack prevention is essential for proactive incident response and mitigation.

We realized their advantages within the first month of deploying Palo Alto Networks NG Firewalls. While those unfamiliar with the firewall's capabilities may not immediately recognize the benefits, those with a deeper understanding have seen positive results almost instantly.

Palo Alto Networks offers a diverse range of firewall models, catering to small offices, entry-level needs, and large data centres. This consistency in their product line allows them to effectively secure organizations of all sizes, from small to medium-sized businesses to extensive data centres. Considering their out-of-the-box protection across different work environments, I would give Palo Alto Networks a rating of nine out of ten for consistency.

Palo Alto Networks NG Firewalls have helped our organization reduce downtime by safeguarding against DDoS attacks, phishing attempts, and other malicious threats. These firewalls effectively prevent unauthorized access to our enterprise infrastructure.

The most valuable features are IPS and stateful inspection. Stateful inspection simplifies firewall management by automatically allowing return traffic for established connections, eliminating the need to create separate policies for inbound and outbound traffic within the same session.

Palo Alto Networks Next-Generation Firewalls are expensive and could become more competitive with reduced costs.

I have been using Palo Alto Networks NG Firewalls for five years.

Palo Alto Networks NG Firewalls are highly stable.

Since Palo Alto Networks NG Firewalls are physical hardware devices, they offer scalability but are limited by the hardware's capabilities.

The technical support of Palo Alto is fantastic.

Positive

I previously used Cisco ASA firewalls but switched to Palo Alto Networks NG Firewalls because Cisco ASA does not offer next-generation firewall capabilities like stateful.

The deployment was straightforward, even though we received some assistance from Palo Alto engineers.

The deployment was completed in five days. Prior to execution, we planned the integration of the firewall into our infrastructure. This high-level plan involved identifying the network, provisioning the firewall, connecting network cables, configuring the firewall, and conducting tests.

Our logs indicate a significant number of attempted unauthorized access or attacks on our infrastructure, which the Palo Alto NG Firewalls have successfully blocked. Given this evidence of the firewall's effectiveness in protecting our systems, I believe it demonstrates a strong return on investment.

Palo Alto Networks NG Firewalls are expensive.

I would rate Palo Alto Networks NG Firewalls ten out of ten.

Even though Palo Alto might be more expensive, I would always recommend it because you typically get better equipment for your investment.

Occasionally, we need to upgrade the operating system, which is considered maintenance. Although we have a high availability setup with two firewalls, an active one and a backup, they typically run continuously without issues.

We have 1,000 users across multiple locations that utilize Palo Alto Networks NG Firewalls in our organization.

I recommend always having a proper plan and considering not only the cost but also the technical benefits in terms of the next-generation firewall features offered by Palo Alto.

The tool's most valuable features are its security features, which are highly valued based on market standards and Gartner reports. We conducted a POC before procuring it, and from that perspective, it is very good. The machine learning feature helps prevent more threats, but no device or firewall can be 100 percent secure because threats evolve daily.

We use geofencing in our firewalls to prevent unknown attacks from other countries. The solution stops these attacks in the cloud so they don't reach my firewall. Only allowed countries can access it.

The solution provides a unified platform that natively integrates with other security platforms. It is a must as a compliance requirement and aligns with standard security best practices. The platform also helps to prevent security holes by 70-80 percent. 

We have implemented the Zero-Delay Signature feature. It is important to prevent unwanted network penetration and information theft, so having it in the firewall at the gateway level is mandatory. 

The setup was complex. We have perimeter firewalls and multiple voice devices handling calls. Directing traffic through gateway perimeter firewalls becomes quite complex in such a scenario. The implementation took around two months and required three to four people for deployment.

I have been working with the product for four years. 

Palo Alto Networks NG Firewalls' stability is very good. 

Based on our expected growth, we have some buffer and procured a model that offers an additional 10-20% capacity. Around 1,500 people in our company use it, and two to three administrators manage it around the clock. Currently, we have no plans to increase usage.

The technical support is very good. We log a call and get a response within five to ten minutes. If there is any critical issue, they get on a call and resolve it. We opt for OEM direct support. It depends on whether an integrator will assist us or we must log in through the portal. 

Positive

I decided to switch from FortiGate to Palo Alto Network NG Firewalls because we found that it performs better regarding security standards. It's considered an industry standard.

A system integrator helped us with the implementation. 

Cost-wise, I don't see much difference in network-related costs, but this is a premium-grade firewall. There is a cost involved, and you must pay for that to get the most out of it. Its licensing costs are straightforward. There aren't any hidden costs. 

I need to check DNS security with Palo Alto Firewalls. I set it up initially, but my team manages it daily. I approve any changes, but my team handles the hands-on work. I can't say all tools will be integrated, but other tools might also be needed based on our business and use cases. This alone might not suffice.

Network performance is okay but not great because multiple hops are involved. Each tool, like an endpoint with antivirus, scans the traffic before it moves to the firewall, which also scans it before sending it out. So, there will be some performance regulation. We cannot expect 100% performance in any network once you have any firewall with all the built-in security features implemented.

When I recommend the tool to others, I first check their business needs and understand what they're looking for. If they're focused on security posture and are ready to invest, I'd recommend Palo Alto Networks NG Firewalls. But if they want something cheap, I'd suggest options like FortiGate or SonicWall. Also, I'd check if they have the in-house skills to manage it day-to-day.

I'm familiar with the PA-400 series of Palo Alto Networks NG Firewalls. It's good for small offices, and we use the same series in one of our branch offices. 

I've learned that using this solution is a continuous learning process. Every day, I analyze and evaluate the differences between each product to see if it meets our business requirements and is cost-effective. I rate it a ten out of ten. 

Palo Alto is used as our organization's perimeter firewall. In fact, it is our data center. We use it to protect our perimeter level. The model that we use is the PA-5020, which is a bare metal device.

I currently work in ISP operations, where we host DNS servers for customers and also have a few AAA servers for broadband authentication. In Sri Lanka, there are ADSL customers and broadband customers, who authenticate against our AAA service. Additionally, we also protect our internal members using Palo Alto firewalls.

In the event that Palo Alto Networks NG Firewalls detect evolving and rapidly moving threats, we get help from the Palo Alto teams to resolve the issues. We do the level one troubleshooting and then open a tactic attempt to pass that to tech managers for resolution.

Previously, there were a couple of limited features available from GlobalProtect. However, after introducing these new features, the solution has been very helpful for us. This is very important.

We are a telecommunication service provider and we offer many IT services to our customers. The recent attack has made it very important for us to take precautions. Having a unified platform for our organization is an integral part of being able to identify and address attacks quickly.

Most of the features in Palo Alto are very valuable. Recently, in the COVID pandemic situation, we used SSL VPN through GlobalProtect from Palo Alto, which was very helpful for us to do work at home. We use general category-based filtering. Palo Alto is a very sophisticated firewall.

Palo Alto Networks NG Firewalls machine learning in the core of the firewall to prevent attacks is very important. Previously, our country was not targeted by attackers, but recently, we have identified that there are a couple of situations happening in our country. Recently, there has been an unstable political situation in our country, and during that time period, many attackers have been trying to infiltrate our networks. We definitely have to go to the next-generation features such as the Next-Generation Firewalls.

Having a unified platform that natively integrates all security capabilities is a great feature. We previously used a single management platform, Panorama from Palo Alto, across all of our Palo Alto products. However, Panorama is no longer being supported, due to its end-of-life status.

Having a unified platform helped to eliminate security holes. Between the UTM platforms, and Palo Alto, all features are available in one firewall, so we don't need to buy different products or separate IPS devices and separate antivirus devices. In Palo Alto UTM firewalls, most of the features are available such as antivirus with filtering, which is very important.

The solution is user-friendly.

The pricing of the solution is high and can be improved.

Most other VPN clients include mobile VPNs but Palo Alto does not. We are required to purchase the mobile VPN clients separately. During our RFPs we have noticed that most features by vendors are similar but the price for those features is higher with Palo Alto.

I have been using the solution for seven years.

The solution is very stable.

I'm not seeing scalability problems in my scenario, but overall Palo Alto is doing well in terms of scalability. I'm using ten licenses for V systems and the port density is good.

There are five firewall administrators, two engineers, and three technical staff. In my department, there are thirty users and during the work-from-home scenario, all of them are connecting through the SSL VPN. Thirty plus users in our organization and the request for the service that is in our country, in our broadband customer segment are 1,500 thousand.

The solution is at the end of the life cycle and we are in the process of upgrading.

The support from the tech team is good, and their response is fine.

There is a tendering process in my organization, so products that are technically qualified go through a two-stage process: the first stage is the technical qualification stage and the second stage is the financial qualification stage. However, in the end, everything comes down to finances, and that's why Palo Alto was awarded the tender and we switched from Check Point.

The first thing we did was install a client to manage the Check Point firewall. However, I think the new versions which operate at this time don't need the client. Previously, it definitely required a client, so that was a headache. Palo Alto is not like that, it's a dual-based configuration. Also, when we apply the rules, it's also very easy in Palo Alto. Another important aspect is that Palo Alto uses its own based firewall, and Check Point does not. We have to put the configuration to interfaces and likewise. This is very helpful because in my network, in some cases, we have to have a couple of interfaces that are met with the source, and we have to easily apply rules by selecting the source.

The initial setup is straightforward. I was in the deployment stage when this firewall came to my organization. Palo Alto includes a quick reference guide in the box. For an initial setup, everything is available in that quick reference guide. 

We had the Check Point firewall previously and after the tender process, Palo Alto was selected as the new replacement. We took three to four weeks to migrate all the Check Point rules. We migrated around 100 to 150 rules from Check Point to Palo Alto which was very easy.

There is a team in my organization made up of engineers and technical officers. Working under the engineers the technical officers are responsible for the physical implementation of everything. I am an engineer in my organization, and engineers are responsible for installing programs and configurations. We have a timeline to meet for every new implementation, which is a project for us.

In the deployment stage, we had six or seven members on the deployment team. After deployment, we now have two engineers and three technical staff, for a total of five people who perform maintenance.

The implementation was completed in-house.

My firewall is used to protect my internet servers. This means that the servers provide services to our broadband customers. After taking the revenue from broadband customers, Palo Alto is almost covered. However, there is no direct ROI for Palo Alto in my setup.

We are purchasing an annual subscription for signatures, and categories. Our box has ten perpetual licenses for V Systems.

We don't have licenses for SSL VPNs because it is included in the box. For VPNs, we don't need a license. However, if we use the Power VPN client on our mobile devices, we need to purchase the client software.

Before choosing Palo Alto, we evaluated Check Point and FortiGate.

I give the solution a nine out of ten.

We are currently in the process of procuring a new parallel processing solution. Our current parallel processing solution is reaching the end of its life in 2023, so we need to find a new solution by March 2023. Ideally, we would like to find a new solution from Palo Alto, but the selection process is still in progress so I can't say for sure which model will be chosen.

In the past seven years I have been using the solution, I have only had to open ten tickets for support.

The zero delay signature feature is not implemented because our license is not enabled in our firewall. We use layer seven filtering for our data center.

Palo Alto Networks NG Firewalls are protecting our data center. Almost all our country's broadband users request access through this firewall.

I can recommend the Palo Alto firewall for other companies as a perimeter firewall, as a data center, and as a work-from-home scenario for SSL VPN, but I don't have experience with it as a managed service.

To any potential new users, definitely go for Palo Alto, don't worry about its sophistication. With all my experience using Palo Alto, I have had very minor issues. I recommend Palo Alto as a company network solution.

The configuration of the solution is nice. During the time period that I have used Palo Alto, I have had only a few tickets raised and the tech support is helpful. Palo Alto firewalls cover most security threats.

We are using PA-820. This Palo Alto series is being used in our separate branch office. We are managing surveillance and internet activities with this Next-Generation security firewall. We are using the UTM features and running best security practices through this firewall. Moreover, VPNs and other remote access security features are being implemented in our environment with this firewall.

It has a very good security database for attack prevention. There are many security breaches, and most of the 2022 security breaches use automation. It has a really good automation engine that clearly prevents new types of attacks. We recently avoided an attack with Palo Alto.

DNS security is super good in this. Its DNS attack coverage is 40% more, and it can disrupt 80% of attacks that use DNS. Without requiring any change in your infrastructure, you can avoid the attacks. With this Palo Alto firewall, we are able to manage DNS security in a single device because it has single-pass architecture.

It provides a unified platform that natively integrates all security capabilities. It has a VPN. We don't need to go for additional security features or devices in our environment. It is an all-in-one solution. With other firewalls, such as FortiGate, you require separate licenses. For example, for high availability, you would require an additional license, which is not the case with Palo Alto. In this way, Palo Alto is completely in line with our budget requirements. We are also planning to go with the higher version of Palo Alto firewalls in our environments.

It has helped to eliminate security holes. It creates a usage pattern with its machine learning and artificial intelligence features. It uses a good amount of artificial intelligence to create a pattern. If there are any changes in the usage pattern, it notifies us, and we are able to take action.

In our environment, we are running a lot of production servers. So, we cannot compromise on security. We give more priority to security than performance in our architecture. We put 70% focus on security and 30% on performance. Palo Alto completely suits our requirements. They have three-tier security. We can see the application layer traffic, network layer traffic, and session layer traffic.

It integrates perfectly. It integrates with SIEM solutions such as Darktrace. For log analysis, we are able to completely retrieve the logs.

The most important feature is advanced threat prevention. It stops most malware. It provides 96% or 97% prevention against malware. It has a leading intrusion prevention system in the industry. It is really good at malware prevention. It ensures that files are saved in a good and secure environment. It automatically detects and prevents unknown malware with its powerful malware prevention engine. 

It has a unique approach to packet processing. It has single-pass architecture. We can easily perform policy lookups, application decoding, and integration or merging. This can be all done with a single pass. It effectively reduces the amount of processing required to perform multiple actions. This is the main advantage of using Palo Alto.

It is a complete product, but the SSL inspection feature requires some improvements. We need to deploy certificates at each end point to completely work out the UTM solutions. If you enable SSL encryption, it is a tedious process. It takes a lot of time to deploy the certificates to all endpoints. Without SSL inspection, UTM features will not work properly. So, we are forced to enable this SSL inspection feature. 

It has been three years.

It is extremely stable.

It is scalable. There is a VM solution also, so it is completely scalable. 

We have about 3,000 users in our branch office. In terms of our plans to increase its usage, we are also planning to go for Palo Alto as our main firewall. We are planning to go with the higher-end version.

I would rate them an eight out of ten.

Positive

In our branch office, before the Palo Alto firewall implementation, we have been using FortiGate. We switched because of the budgetary requirements. With FortiGate, for the high availability feature, we required two devices. We had to buy two licenses, whereas Palo Alto required only one license. It was completely in tune with our budget. So, we had to go with Palo Alto.

FortiGate did not have single-pass architecture. It took a huge amount of resources for each action. For policy lookups, it took a considerable amount of system resources, such as CPU, RAM, etc. The waiting time was too high for policy lookup, application decoding, and signature matching. All this is carried out in a single pass in Palo Alto. So, it is considerably fast and also secure. There is no compromise in terms of security. It is completely secure, and we are able to do more functions in a single pass with the Palo Alto firewall. So, we save a lot of resources. With FortiGate, security was around 50%. After the implementation of PA 820, it has increased to 80%. We have achieved about a 30% increase in security. Even though PA 820 is not a higher-end series, performance-wise, it matches the higher-end series of FortiGate. So, there is a considerable amount of cost savings. We are able to save 20% to 30% extra.

In our organization, we have multiple vendors. We have FortiGate, Cisco ASA, and other security implementations. We have already purchased many other products. So, we cannot simply suggest Palo Alto across the organization. We have to consider the older purchases.

Palo Alto is a good competitor to FortiGate. Cisco, FortiGate, and Palo Alto are the three main competitors. When we compare these products, they have similarities, but I would suggest going with Palo Alto for higher security. If you are giving more priority to security and less priority to performance, definitely consider this. Cisco ASA and FortiGate are more performance-oriented. So, if you are planning to give more priority to security, I would definitely suggest Palo Alto.

Its initial setup was complex. It was not straightforward. It required a considerable amount of time and effort. Migration was a little bit complex because we had a different vendor product. Migrating to this product required a considerable amount of time and planning because we didn't want to disrupt the networking in our existing environment. It took a good amount of planning and decision-making to migrate to Palo Alto.

Its deployment took about a week. In terms of the implementation strategy, we were deploying it at the branch office. We already had a solution there. So, we had to completely migrate the policies and everything else. We also had to identify the interfaces with the utmost urgency. We first migrated important interfaces and made sure that they all are working fine and all the security features are working fine. After that, we enabled all the policies and other features. In this way, we were able to completely migrate in seven days.

It required three network administrators. They are responsible for actively managing the firewall configurations, taking backups, etc.

With this highly secure environment, we are able to maintain our production-level servers on-premises. We were planning to move them to the cloud for security, but with the implementation of Palo Alto, we were able to maintain them on-premises. We could create a considerable amount of production service, and thereby, we had a great return on investment through this.

It is not that expensive. I would rate it an eight out of ten in terms of pricing. Other than the licensing, there are no additional costs.

We didn't evaluate anything other than FortiGate and Palo Alto.

I would recommend this solution if security is more important to you. If the performance of the users is more important, I would not suggest Palo Alto. It gives more priority and weight to security. It has a complete security mechanism with AI, log-based analysis, etc. I would recommend it for higher cybersecurity and IT-related environments.

I would rate it a nine out of ten.