What is our primary use case?
We use the solution for segregation. We also use it as a gateway in order to do URL filtering on the DNI as a security measure. We use the product's global protective VPN as well.
How has it helped my organization?
The application ID, this kind of technology, has a very high-level check. It makes everything more secure for your enterprise network. Otherwise, fake applications can sneak in.
If you're using application ID, they check the high side, the traffic, and they analyze everything. They see if it's a normal application. They're working closely with each vendor, to make it easy to identify applications. For the hackers or malicious traffic, they can see it and block it.
What is most valuable?
I like the user ID and the application ID as it's easy to identify the popular applications and the EZT does the security checking in regards to the user and the application ID.
The initial setup is very easy.
The solution is easy to manage. It has a good interface as well.
The solution is stable.
The product can scale.
The solution offers good integration potential.
What needs improvement?
While Palo Alto is the leading firewall worldwide, it's so pricey. Other products like Checkpoint still do the job, and yet it's way cheaper than Palo Alto. The solution is extremely expensive. You can integrate it with other Palo Alto products, however, it ends up being too much.
Palo Alto prefers the VM version. However, for the VM level, often we have a migration from one host, VM host, to another host, and then the network jobs. And they're not fully redundant. With VM, the purpose is easy migration from one host to another one. That's the purpose of VM in play, however, if you want to have high availability or redundancy, you have to purchase two licenses - one on one host, another one on another host - and it costs a lot of money to do that.
Technical support could be better.
For how long have I used the solution?
I've used the solution for about five to seven years at this point.
What do I think about the stability of the solution?
It is a stable solution. With the cloud, you don't even touch the physical box at all. However, for the traditional network guests, I like my stuff to be reliable. That's why I don't like the VM migrating from one host to another host. That's why I'm in the process of converting the VM back to the physical box using redundancy. That will be the network solution. I want my network available 24/7.
What do I think about the scalability of the solution?
The solution is quite scalable.
We have about 150 people using the product currently.
How are customer service and support?
Support is awesome. However, it can depend. When you get a ticket and you take it to the proper person, they can give you a solution really quick, and the support is really good. That said, sometimes, if you are not lucky, you create a ticket and a salesperson or specialist runs it to a different person. Sometimes it takes a long time. Sometimes they make you do a lot of the work and ask you to send them reports or check certain things. If they run the ticket to the proper person, I can resolve the problem in 10 minutes. If they run my ticket to some other person, maybe it takes a whole day or two and I don't have time to play around.
I'd rate it as average, at maybe a five out of ten in terms of the service level you get in general.
Which solution did I use previously and why did I switch?
I previously used Juniper. I have experience with Cisco ASA as well.
Currently, I use Microsoft Defender for my endpoint protection.
I switched when Palo Alto turned into the top firewall management solution. I did do research.
From the GRI management port, it's easier than Cisco ASA.
How was the initial setup?
The solution is very easy to set up. I've been working for many years on this. I know the whole process is easy to start with some simple logarithmic management It's easy to manage.
The deployment is fast. It usually takes about a day. On the first day, you get the management running on the UI. On the second day you need to get the traffic going through the certificate, and to do some proper security policies. That's all. Yes. To do it in one day is just a one-man job.
I manage the solution myself and maintain it every two months or so. Of course, if there are any issues in between these maintenance events, I also work on them.
What about the implementation team?
I did the implementation myself, however, five or seven years ago, I used a consultant and learned from him. I've likely done 20 or so firewalls myself at this point.
What's my experience with pricing, setup cost, and licensing?
The issue with Palo Alto is that the price is almost double other products such as Checkpoint, or Fortinet. There's no reason you price yourself to be double other brands.
I just did a call for renewing my license. I requested two redundancy units. The price, which was all-inclusive with WiFi, a VPN solution, a global VPN, et cetera - all of them bundled together, for two units, over three years, was $81,000.
You can buy the hardware only and each box is not even $10,000. It's only $8,000 for the unit itself. However, then you are charged a three-year license at $81,000.
What other advice do I have?
I'm just a customer.
I'm using the latest version of the solution.
I would rate the solution at an eight out of ten.
Which deployment model are you using for this solution?
On-premises
*Disclosure: My company does not have a business relationship with this vendor other than being a customer.