I would suggest all the main stream Firewall builds for vm are equally as good as those in tin. I would also say that I have seen under provisioning of resources has caused processing bottlenecks in vm firewall testing environment. Any bottle necks anywhere will become an issue if provisioning does not assure it's well above expected throughputs.
I would rate it with a solid 10, VM series from Palo Alto Networks share the same OS with physical appliances so the management experience is the consistent, beginning PanOS 8.0 the specs went crazy with VM capable of deliver 8Gbps throughput with TP subscription activated, the VM is supported on almost every virtual environment VMware vSphere (with or without NSX), Openstack, KVM, Hyper-V, AWS, Azure, and others. Bottom line it's a great product with a great cost for the value it delivers to the business, also Palo Alto's support is great.
Palo Alto firewalls are great with the Application control features being very impressive.
It is very effective and accrues Low TCO for the User. Design and Installation is usually the main issue but with proper specifications, the administration will be pretty smooth.
Users awareness of the security policies is also key to have a seamless administration.
Sorry, I don’t have experience with VM-Series Palo Alto Firewalls. From a comparison perspective based on DEMO’s I have seen of physical Firewall implementations. I would rate Palo Alto equivalent to Checkpoint. Palo Alto is probably not quite as expensive.
As function they work the same as physical box, but the way it process the packet will be different from physical box and vm. Physical box had parallel process for packet sniff , antivirus , IPS and vpn. . Motherboard and daughter board their own responsibility for the service process therefore they can process very fast all service almost the same time.
VM , will do the same function and you wouldn't notice the background process until you hit the peak often which you will never near there..
We currently do not use Palo Alto VM's and cannot comment on our real world experience. We do use PA-3020, PA-5050 and PA-5060 and they work great. We are planning on deploying Virtual Palo Alto in Azure once funding is provided.