Palo Alto Networks PA-Series Reviews

I am still using a Check Point, but CloudGuard is not enabled on that one. I am using it for internal purposes only.

We are using a plain firewall that we are running for internal purposes on our AWS cloud. We enable the firewall blade and some VPN blade on that one. We are using it only for security purposes.

We are using a firewall for the perimeter only. For a perimeter firewall, I am not using any Prisma. We are using GlobalProtect only for the remote VPN perspective. Apart from that, we are using a different proxy solution.

We are using Cisco Umbrella.

I need to check because we spin up those firewalls on our AWS. It is not a physical firewall. It is virtual.

We are working with Palo Alto Networks PA-Series.

Palo Alto Networks PA-Series, I know. We are using PA-3410 hardware for the perimeter. We have licenses such as Threat Prevention license and GlobalProtect licenses. We have Palo Alto Networks PA-Series in our DC and DR perimeter level.

Palo Alto Networks PA-Series is basically integrated with LDAP to fetch the identity of the users and we provide access based on the identity. This is one of the features we implemented. Another feature we are using is remote VPN of GlobalProtect. We have two gateways so we can serve regional users who are connecting to remote VPN. We are currently serving remote VPN through Palo Alto Networks PA-Series. Another feature is we are using Threat Prevention, which is getting automatically dynamic updates. We are receiving whatever the threat prevention WildFire sandboxing features, so most of the features we are using because it is a perimeter firewall and it is working as expected. Zone protection and DoS protection are also enabled. Overall, we utilize the next generation firewall as per our use case requirement.

We have not yet used App-ID. We are using content filtering only. App-ID has not been utilized.

WildFire is enabled. For threat prevention, it is getting a dynamic update through WildFire for signature-based authentication. WildFire is already enabled on that one.

Basically, it is better to give access because the identity is being fetched on the firewall. Instead of basing access over the IP address, we integrated LDAP and we are providing access based on the user ID or user group. It is better to track, better to go to zero trust, and better to review the access list.

The solution is not part of my job work because it is managed by SOC. There is a different team managing the SOC solution. It is not in my area.

I do not work on that one.

Currently, we are working with vendors such as Palo Alto Networks PA-Series, Cisco, Check Point, and Citrix.

Palo Alto Networks PA-Series is a better firewall.

Deep packet inspection and threat prevention basically comply with whatever traffic is incoming and outgoing through the firewall.

I do not think anything improvement is required. The thing is that Palo Alto Networks PA-Series works mostly on a license-based model. If you want to utilize any feature, you have to purchase the license. For example, URL filtering requires a license purchase.

It simplifies the implementation because LDAP server profile can be integrated. Basically, that simplifies the implementation of access rule or security policy.

Licenses are too costly. As I compare with Check Point or other OEM, the licenses are too much more costly and they should work on bundled licenses.

It has been more than three years.

I am giving stability a rating of 10 out of 10 because since implementation, we have not observed any issues with Palo Alto Networks PA-Series related to version, vulnerabilities, or anything else. Daily, we are able to receive notifications of vulnerabilities, any OS version related to GlobalProtect or firewall, iOS version, or any applicable vulnerability. I am fully confident in Palo Alto Networks PA-Series so I can rate it 10 out of 10.

If we are using hardware firewall, then there is a limitation. If I am using PA-3410, I can initiate almost 1800 sessions for GlobalProtect. The thing is that scalability should be understood during implementation along with use case requirements and we have to size the firewall properly. So far, there has been no scalability issue. If you talk about virtual firewall, it is easy to autoscale.

Technical support is not as great as I compare with Cisco. Cisco TAC support comes within five to ten minutes on the call. However, Palo Alto Networks PA-Series takes time. I can rate the TAC support seven or eight for that one.

Positive

So far, I mostly work on Palo Alto Networks PA-Series. I never deep dived into Check Point. That is the reason I think Palo Alto Networks PA-Series is better. However, I can rate Check Point as well. Since last two years I am working on Check Point. That is also nearby equivalent and not much difference. However, Palo Alto Networks PA-Series is better. Palo Alto Networks PA-Series has the upper hand.

It is simple. I configured zones which are inside, outside, DMZ, and VPN. Those four zones were configured.

We are using a Zabbix tool for the monitoring of all network devices. For troubleshooting, we do not have any such tool. We still depend on manual work. I would rate this product a 9 out of 10 overall.

My use case for Palo Alto Networks PA-Series is to save my organization from outside threats.

Palo Alto Networks PA-Series has multiple security features, including antivirus, IPS, and behavior-based analysis. If any attacker wants to attack my organization, Palo Alto Networks PA-Series blocks those attempts and gives us a notification.

With the help of Palo Alto Networks PA-Series, we can monitor our users, monitor the website activity, the application activity, and much more.

Palo Alto Networks PA-Series has given us multiple best features, but one of the best features is GlobalProtect, which protects us from outsiders. Palo Alto Networks PA-Series gives us web control, application control, antiviruses, VPNs, and site-to-site VPNs. There are many things we have received from Palo Alto Networks PA-Series.

Most of our users are working from home, so GlobalProtect is the one we use the most. Palo Alto Networks PA-Series is a great feature with integrated AI that prevents us from outsiders and checks the website standards and what is the market standard for that particular website. That type of functionality is what Palo Alto Networks PA-Series provides.

One thing I have seen in Palo Alto Networks PA-Series is the network DLP feature, which we have not seen in any other firewall.

With the help of Palo Alto Networks PA-Series, we are saving money, time, and multiple other resources. Without a firewall in my organization, attackers would attack and ransom our organization, potentially trying to extort money for decrypting files. Palo Alto Networks PA-Series saves money, time, and multiple resources.

At this time, Palo Alto Networks PA-Series is good, and I have no issues with it, but if Palo Alto Networks PA-Series integrates DNS protection into its environment, it will be even more helpful. If multiple solutions provide free VPNs, then it will be more useful for all customers.

When I call support, they assign an engineer based on the SLA, and if there were any type of quick support for troubleshooting, then it would be more helpful.

Because they have a separate license for VPNs and do not provide any type of quick support, which is why I have rated it nine instead of a perfect score.

I have been working here for the last 2.5 years.

Palo Alto Networks PA-Series is working fast, and it is working fast because we have not encountered any type of latency. If my firewall hangs, there are two types of CPU: one is the data plane and another one is the management plane. If the data plane hangs or gets stuck, then we can troubleshoot using the management plane.

Palo Alto Networks PA-Series is scalable and performs well.

Palo Alto Networks PA-Series can handle growth and increased demand easily.

Customer support is good, but there are some gaps. When I call customer support, they assign an engineer based on SLA, which can take two or three hours. Overall, it is good.

I previously used Check Point.

I switched from Check Point to Palo Alto Networks PA-Series because Check Point is no longer user-friendly for us.

Palo Alto Networks PA-Series will be more reliable and will save money, time, and multiple resources.

If we look at the features, then the price is good, but they do charge for the GlobalProtect VPNs. Overall, the pricing is good, but if they included GlobalProtect, it would be more valuable.

Before choosing Palo Alto Networks PA-Series, I evaluated multiple options.

I considered SonicWall among the other options before deciding on Palo Alto Networks PA-Series.

Palo Alto Networks PA-Series has good Panorama support as well because with a single console, we can manage all our branches' firewalls with Panorama, so it's good.

I advise others to use Palo Alto Networks PA-Series because it is faster than any other firewall on the market.

Overall, I have given Palo Alto Networks PA-Series a rating of nine out of ten.

The main use case for Palo Alto Networks PA-Series is edge protection.

Some of the best features of this firewall are flexibility, overall depth of security analysis, and ease of use.

I use application-based traffic classification.

It has helped reduce my attack surface considerably; it's much better than simply doing a port-based analysis.

The usefulness of machine learning algorithms in identifying threats with Palo Alto Networks PA-Series is mostly behind the scenes; we subscribe to the threat analysis, so we don't see too much. It does perform some in-depth analysis, but most of the machine learning features operate on the back end, more than what we would see.

Integrated threat intelligence has empowered my organization to adapt to threats by taking a lot of the burden off us; there's just no way we would see the same breadth of knowledge that a vendor or manufacturer would have. They're gathering data from all over the world, and we're going to see what we get hit with, but now we're seeing what everybody else is getting hit with.

The areas that could be improved with Palo Alto Networks PA-Series include price.

My experience with the price of the product is that they are reasonable, but they are probably the highest in the market. If you look at the market space they're in, they're the Cadillac of what's out there. You can buy cheaper products, but I believe in the value they're giving us. However, they are expensive and there might be some sticker shock if you just looked at them for the price.

I have 10 years of experience with Palo Alto Networks PA-Series Firewall.

I have dealt with their tech support multiple times, and I would rate them at least an 8.5.

I found them super responsive, generally super knowledgeable, and really good at follow-up, almost to a fault. They're constantly following up after a case has been opened to ensure that it has been resolved properly.

Positive

The return on investment with this product is a hard question because security tends to be a cost center rather than a profit center. Return on investment can be a hard quantitative thing to make because if we had an inferior product, we'd spend more time chasing things, but I don't think I can put a dollar value to it.

I have used different solutions before this product, having evaluated options outside of Palo for firewall; I've used Fortinet, Cisco, and all the major players including SonicWall. Among them all, Fortinet and Palo are the two that are the best in my opinion.

The main differences between Fortinet and Palo Alto Networks PA-Series would be cost; Fortinet is considerably cheaper. However, I find Palo Alto support to be better than Fortinet support.

Policy-based controls and deep packet inspection have extended our ability to filter on a much wider variety of traffic, as it's getting down to the application layer from layer four to layer seven over simply doing port and source IP and destination IP.

I rate Palo Alto Networks PA-Series an 8.5.

The use case for the Palo Alto Networks PA-Series firewall is network security related now.

The best features of the Palo Alto Networks PA-Series firewall include Global protector VPN workings, and content filtering is easy to manage and operate.

I do not have any challenges or areas for improvement with Palo Alto Networks PA-Series.

There are no AI integrations in the Palo Alto Networks PA-Series firewall. I would to see something in the future, but as of now, it is not required.

For the next release of the Palo Alto Networks PA-Series firewall, I would like to see logs monitoring included. The logs feature could be added.

I have been using it for the last year.

We need to deploy, and we are managing in-house only.

I would give stability nine points.

There are no restrictions in scalability. I would give scalability nine points.

I am happy with the technical support from Palo Alto. I would give support nine points.

Positive

I find the solution reasonable.

Regarding value for money, we brought this Palo Alto Networks PA-Series firewall last month, and we have taken up to 3 year renewals.

I work with some CrowdStrike products, but we are not using Falcon Sandbox features.

Apart from CrowdStrike, we have another firewall, Palo Alto Networks PA-Series.

For email security, we are using Microsoft Defender.

I'm the customer and partner of another company involved with Palo Alto Networks PA-Series. I am not a partner; I am a customer.

We are a small company, so there's no need for integration and other things. We are only using standard standalone, keeping daily updates and backups so we can restore if anything happens.

I do not want to be a reference for Palo Alto Networks PA-Series; we only work as a partner of CompTIA.

Basically, we are using only the Palo Alto Networks PA-Series firewall and CrowdStrike, and from Palo Alto's perspective, we are just using the firewall, not SASE or any DLP products.

I do not work with any VPN solutions.

On a scale of 1-10, I rate Palo Alto Networks PA-Series a 10.

I am using Palo Alto Networks PA-Series to ensure protection and cybersecurity by preventing and implementing network security features to safeguard networks against threats and malware. I have to apply Palo Alto Networks PA-Series for troubleshooting to minimize the impact of incidents on network security operations.

I have to install Palo Alto Networks PA-Series solutions with security technologies such as IDP and IPS. I also have to conduct security audits and implement corrective measures. I manage the firewall infrastructure.

I manage daily network traffic control with the help of Palo Alto Networks PA-Series.

The most valuable feature of Palo Alto Networks PA-Series is that the tools and devices are very easy to configure. The deployment of network devices and solutions are prompt, and the commands are user-friendly.

We can detect unknown zones in real-time. With Palo Alto Networks PA-Series, we can control web traffic and application usage by filtering categories, and it can detect threats and violations, which is essential.

There is room for improvement in Palo Alto Networks PA-Series in the areas where they can minimize applications and implement features that can be useful for us.

I have been using Palo Alto Networks PA-Series for six plus years.

The initial setup installation of Palo Alto Networks PA-Series was not easy, but the setup can be completed with multiple attempts.

Palo Alto Networks PA-Series is definitely worth the investment a company is paying to use it.

There are also different firewalls such as Fortinet firewalls and Cisco firewalls, but Palo Alto Networks PA-Series has advanced security features. They are capable of handling modern networks and are very alert with user-based policies.

Palo Alto Networks PA-Series is not a traditional firewall that only focuses on ports and protocols; it has the unique feature of controlling and identifying security controls within a precise manner. I can say that my agents working with Palo Alto Networks PA-Series can access the platform from multiple devices and locations. I would rate Palo Alto Networks PA-Series an eight out of ten.

We have a customer in Sri Lanka who uses it. They are banks with multiple branches and use the Palo Alto firewall to connect them in local area. It's also used to connect their local area network and servers. Basically, it's a standalone firewall for their setup.

Another customer is Maliban, a textile and garment company in Sri Lanka. They also use a standalone PA-800 series firewall. I haven't personally enrolled it, but I can manage it since I have experience working with the VM version in a VMware setup. Palo Alto is not only a hardware product, it can be used in VM environment.

Additionally, there's CELSI, which has a PA-5500 series firewall. I enrolled that one when I first started my current job.

Overall, our enterprise-level customers mainly want to secure their bank branches, local networks, and websites. They primarily use standalone firewalls, and I haven't had any issues managing them so far. Even though I haven't personally enrolled all of them, I'm confident I can handle any recommendations or configurations needed.

It handles security threats really well. Wildfire keeps updating all the security threats in the cloud environment. If we receive any latest attacks, we can forward them to the cloud and check them in Panorama. The Wildfire updates are excellent for security. That is the feature they have, as per my understanding.  

The URL filtering and antivirus capabilities are great. 

Users can also create custom applications and mold them as needed. 

We've done QOS configurations for specific traffic, prioritizing or deprioritizing certain applications like YouTube. 

We also configure GlobalProtect for remote VPN clients, and some customers even require access to the company network through GlobalProtect. I've also worked with Wildfire, URL filtering, antivirus, file blocking, QOS, and VPN. Recently, I configured a VPN with Azure.

Palo Alto has predefined applications that you can control at the application level. You can manage policies and specifically mention which applications to control. If you need to configure a custom application that's not already in Palo Alto's database, you can create one. Sometimes an application doesn't come pre-defined, so you need to create a custom application using signatures or packet captures.

Palo Alto can improve the web application firewall (WAF) feature at layer 7. Currently, I don't think it's available. If they can improve that, it would be better. We wouldn't need to purchase a separate WAF solution because they already have advanced URL filtering. 

But I don't think that advanced URL filtering has the same features as a dedicated WAF, like F5 or other solutions. That is an area for improvement.

If they can improve the WAF feature, customers won't have to buy a separate WAF solution. They could do it with the same Palo Alto firewall, perhaps through a subscription-based model.

So the web application firewall feature has to be improved.

I have experience with Palo Alto model, it was either a PA-2250 or PA-2220, something like that.

I have over five years of experience with Palo Alto.

It is stable. It's a top-notch product from a leading vendor. If it wasn't stable, it wouldn't be a leader in the Gartner Magic Quadrant.

The PA-800 had some performance issues, but the other models are better. I would give it an eight or nine.

Scalability is somewhat limited. The PA-800 and PA-220 models are not modular, so we can't scale them by adding components. In an HA environment, we can add multiple firewalls for scalability. We can also improve performance by adding Ethernet ports or fiber ports. 

However, I don't think it's possible to upgrade the CPU or memory on our current systems. Other models might allow for that, but I'm not sure. So, there's some level of scalability, but it's limited.

We don't get direct support from Palo Alto. We go through a distributor in Sri Lanka. So, I don't have much experience with their support team directly. I think their support is good.

Positive

I have experience with Juniper SRX Series Firewall (Juniper), SonicWall, Juniper, and Sophos firewalls and F5 Advanced Web Application Firewall. We are an F5 partner in Sri Lanka.

In the last twelve months, I've worked with Palo Alto and Juniper SRX. The SRX model was a smaller one, either a 250 or something similar. I also worked with the Elastic stack a long time ago, but not recently.

It's a very user-friendly setup. The configuration and troubleshooting are very easy. Compared to my experience with Juniper, Palo Alto is much better and easier to setup. I have experience with multiple firewalls, so I recommend Palo Alto.

Even an administrator with less experience can manage Palo Alto using the knowledge base articles. It's very user-friendly. Installation is easy, and troubleshooting is straightforward with the traffic monitoring capabilities. We can easily filter traffic and drill down using custom filters.

They also have good monitoring features. We can monitor traffic, including the number of packets and users, directly from the Palo Alto interface. This eliminates the need to purchase additional hardware for monitoring.

Palo Alto has some level of built-in monitoring capabilities. We can monitor traffic, including the number of packets and users, directly from the Palo Alto interface. This is good because it eliminates the need to purchase additional hardware for monitoring.

From my perspective, with Palo Alto, we can manage security at the user level, unlike regular firewalls that only offer IP-based control. We can create combinations of IP and user policies. Palo Alto also has the latest advanced features that are usually found in separate security devices.

Their URL filtering features are excellent, and they keep their cloud-based threat intelligence updated, which we can use in our environment. If users [our customers] weren't using Palo Alto, they'd have to purchase additional devices to protect against the latest attacks, incurring extra costs. With Palo Alto, they save money by not needing to buy those extra devices.

Moreover, we can manage security at both the application and user levels, which isn't possible with other firewalls. Performance is generally good, although we recently had a tech case where the PA-800 was a bit slow. However, I believe their other firewalls perform very well. They have a feature called "multiprocessing" that allows them to run many features independently.

Customers will get benefits from it, but not immediately. They will see the return on their investment within three to five years. Palo Alto is a good product for security, and it's a good purchase. It's better to go for the latest firewalls like Palo Alto or Checkpoint. They will see the benefits within five years.

It's not cheap. In Sri Lanka, it's expensive compared to other firewalls. But considering the features and the potential ROI, it's a good price. If customers are getting more benefits from it, then it's worth the cost.

It's about what you pay and what you get. You get more features, and it's easy to manage. Even a less experienced technical person can configure and implement it. Compared to other firewalls like Juniper, which rely more on command lines, Palo Alto is much more user-friendly.

It's user-friendly. And the support is good. Overall, it's the best.

Overall, I would rate it a nine out of ten.

Mostly, my partners and customers are connected through VPNs. I have VPNs for my enterprise, which work with multiple customers for online solutions and payment gateways. I also have a contact solution for payments.

My firewall solution allows me to manage stability and security effectively. I ensure the stability of security solutions through routine checks and updates.

The most effective features of the solution are its Magic Quadrant positioning, making it a leading firewall on perimeter areas and internet edges. It functions very well in data centers. Its effectiveness is highly dependent on budget and approach. Moreover, the return on investment is calculated according to my organization’s sizing and has never been an issue.

I experienced some problems with AWS cloud parameters connected to Palo Alto firewall. However, I haven't thought of a specific solution for improvement.

I have been using this firewall in my current organization for eight years.

I rate the stability as ten out of ten. The solution is very stable for my needs.

Scalability depends on picking the right box. For my case, it is rated nine out of ten. The solution can handle more than ten thousand users in my organization.

The support has been shaky. Initially, it took one or two hours to get a Palo Alto engineer, which is quite slow. I expect faster response times.

Negative

No other solution was evaluated on the perimeter side or the edge internet side in my region.

The initial setup is straightforward and mature. If you're experienced, it’s rated eight to nine out of ten in terms of ease of process. For beginners, it might be a six or seven out of ten.

The return on investment is maintained according to my organization's sizing, and no issues have arisen.

The firewall is expensive for every company, but the cost is worth it to ensure maximum security. However, I do not have exact figures on the financials.

If you have the budget, go for Palo Alto without any doubts. 

I rate the overall solution nine out of ten.

We use the solution as a gateway for users and network devices. 

When I compare the tool with other firewalls, it’s the most powerful. It's the most powerful security engine. All the traffic going to the Internet passes through it as the first layer of protection. Because of its good performance, we also use it for decryption.

The product's most useful function is its performance. I also appreciate the ability to create rules as groups and apply filters to each group. Each application has its own rules, which can be combined using a group, which is very effective. Additionally, we use Palo Alto Networks PA-Series for decryption, applying encryption policies on the firewall. The encryption policy works for all traffic going to the Internet.

We integrated it with Active Directory, specifically with our three or five Active Directory servers. This integration works well for user analysis and policy authentication.

The tool is rated high in Gartner reports. 

I had opened a case before with the tool because I could not create a wildcard for the security address. We can create wildcards for security addresses in Fortinet, but this feature doesn't exist in the product.

We use it as a decryptor using the decryption policy. Any site with a certificate chain with some intermediate CAs not in the CA database already downloaded in Palo Alto Networks PA-Series will not open until I extract the certificate and import it manually into the CA database. This is a workaround. I opened a ticket, and they guided me to upgrade the firewall to a specific version, but I haven't done it yet.

I have been working with the product for three years. 

I rate the tool's stability an eight out of ten. 

I rate the tool's scalability a nine out of ten. We have approximately 2,000 to 2,500 users working through the firewall. In addition to the users, we have around 2,000 non-user end devices, such as printers and cameras, connected to the network.

I haven't contacted the tool's support directly. We seek assistance through our vendor. 

Fortinet has some features that surpass the Palo Alto Networks PA-Series. While Palo Alto Networks PA-Series' performance is very good, Fortinet offers some advantages not found in Palo Alto Networks PA-Series. One of the best features is the wildcard security and address. Another significant advantage is the built-in SD-WAN feature with the FortiGate firewall. These features are not available in Palo Alto Networks PA-Series.

The tool's deployment is simple because of its intuitive dashboard. 

The solution's pricing is high compared to that of Cisco and Fortinet. 

I rate the overall product a nine out of ten. I recommend it. If you search the Internet, you'll find reports and customer reviews that highly recommend it at various levels.

There are various use cases, particularly for desktop scenarios. One of them involves exploring contacts. Virtual firewall use cases revolve around different scenarios, such as transitioning to the cloud. For instance, when Barclays uses Azure or AWS, there's a focus on meeting security obligations and implementing threat prevention to comply with regulations like GDPR or PPA. This includes creating segmentation to align with regulatory standards. As part of this process, security features available in cloud platforms like virtual firewalls and threat prevention are incorporated.

After the implementation here, especially since I work in the data center, I've noticed the significance of security. For example, Veeam, CDL, and other aspects became crucial, especially during the COVID period when users started working from home. 

This situation led to numerous blocks, and user profiles were getting blocked due to issues with IP addresses ending up on blocklists. However, after implementing the 3M series virtual firewall, we were able to effectively manage security for our cloud applications, like those in AWS. This enabled us to monitor remote workers and take necessary actions, such as blocking problematic IP addresses. Consequently, we reduced the number of tickets raised with ISP providers.      

A valuable feature that we can consider is the deployment time, which is significantly reduced, almost 90% faster compared to other solutions. This leads to quicker deployment and less downtime.

I have found that the tool works well for me, but there are areas where security testing and protection could be improved, especially in virtual or cloud environments. However, in this project, once we deployed it, we haven't encountered any issues.

The cost is currently manageable, but as we migrate fully into the cloud, additional features like capacity upgrading and improvements to hardware resources will be necessary, especially since our equipment consists of older-generation switches and routers. I'm looking for additional capabilities in these areas.

I've been working on my current project for more than two years now.

I would rate it 9 out of 10. 

I would rate it 8.5 out of 10. 

The deployment is quite straightforward, and it's faster than it used to be. This means that the deployment process is quicker, and there is less downtime involved.

From my perspective, managing the price is important, especially because we're a small business. For larger organizations like Barclays, we provide our requirements to the client, and they place the order on BigFix. It's their responsibility to consider their budget and make decisions accordingly. We appreciate the features we get, but the cost-sharing still depends on the client.

The client needs to provide approval for the POCs used by our team; it's not within my control.

When evaluating options, we should consider team members who are knowledgeable in supporting next-generation firewalls like NGFW. We also need to factor in the specific product offerings. For instance, if we have options like the PA-440, PA-850, and PA-8350, we should compare their prices and features. It's important to make decisions based on the situation and the needs of the organization.

Considering factors like availability and the specific situation, I would rate this an eight. It's important to explore other potential cases as well.

Firewall implementation and firewall rule edition are the primary use cases.

It's very secure. It inspects the application. Compared to script-based or CLI-based firewalls, it's easier to use the GUI (graphical user interface) to implement the firewall. 

It has its own logging system. You can go to monitoring and check the logs to see if a connection is getting blocked. You can use multiple types of logs to check if a file or a port is getting blocked or if there are any TCP resets from the source or destination. It's easy to troubleshoot with the monitoring and logging it provides.

There seem to be some issues with TAC (Technical Assistance Center) or Palo Alto support. Anytime you open a case, a level one engineer joins, and then you have to escalate it to level two or three. The support system has changed in the past few years, and that's something they need to look into.

In future releases, I would add one feature where we can take a subnet or take an IP and create a list of rules that are for that IP. There is an option, but it's not as expansive as I would like. When you run a report, you have to run it for a hostname. And when you look at the report, you see the hostnames, but you don't see the IPs. Like, there is no additional column for seeing the IP of the hostname or the subnet of the hostname. So that creates an issue. You have to go into the file and take the export list of firewall rules, and then you have the hostname got have the IP, then you have to note down the IP addresses.

I have been working with this solution for more than eight years. 

It is a very stable product.

The solution scales easily. For example, when we did a migration, we brought in more than 14,000 firewall rules from Juniper into our Palo Alto. After importing, obviously, that's a huge number. But, after doing that, the CPU went really up because we have so many rules. And after having to talk with Palo Alto, they told us to get a better model. We have the 5500 model. So, we were asked to replace the Palo Alto with a bigger or better model. That's what we're gonna be doing.

We can absolutely update the firewalls with a better GPU and CPU. With a better CPU, it can handle more connections. Especially when the environment grows, adding new data centers and more applications. So, after a year or two, there is a need to either bring in more firewalls or upgrade the existing ones you have.

Currently, there are around 12 end users using this solution in our organization.

There are certain issues when we open a ticket with TAC (Technical Assistance Center), the issue goes to engineering, and then they inform us that the fix for the issue we're having will be included in the next software update. 

So, there are some issues in the backend or with new features that don't work correctly. We usually open tickets for that, and then usually, they assure us that this issue will be fixed in the next update.

Neutral

Juniper environment we had was reaching the end of life. That's why, rather than bringing in new Juniper devices, the enterprise architecture team decided to go with Palo Alto.

The initial setup was easy. I was migrating from the Juniper SLX firewall to Palo Alto, so I had to move a lot of firewall groups and create a script on the engine tool to facilitate the move. There were some hurdles. But, personally, it was pretty smooth. The transition was pretty smooth.

So we have physical on-premises, and also instances on the cloud, AWS Cloud.

I would recommend using this product , but it's important to have whiteboard sessions with the network and another team to give them information on exactly how to check the BGP settings. You need to go over with the team the things they need to do on the GUI and on the CLI. So, you definitely need to educate the team before using it.

Overall, I would rate the solution an eight out of ten. It's very stable. There are some tools for pushing the rules to Panorama, pushing the rules to the device, especially if you're working with a team, if you're working on a rule and someone pushes to Panorama, or if they want to push your firewall rules. Someone could push you if you have set up something for a change and you need to the changes at a certain time, if another member comes in and puts a change, you definitely need to have your changes or your pushes to the device or to Panorama, you need to have good communication between the team. So there are some good and bad things with Panorama. As you work on it, you adjust.