Palo Alto Networks NG Firewalls Reviews

I use NG Firewalls for perimeter defense. 

We've seen better throughput compared to our previous firewall. End-users are happier with their connections through Palo Alto. 

Palo Alto offers better Layer 7 protection than competing solutions by Cisco and Fortinet. I also like the VPN client more. The interface is simple, so administrators can deploy and configure it much faster than other firewalls. The interoperability with other vendors is excellent. We can connect Palo Alto firewalls to all our other solutions. 

I would like to see more artificial intelligence. However, that is going beyond firewalls to products like Prisma. Palo Alto has those features in an entirely different ecosystem. It isn't a problem. Machine learning is valuable, but I rely more on threat intel. 

I have been using Palo Alto's solutions since 2014.

I rate Palo Alto NG Firewalls a nine out of ten for stability. We have had zero downtime except for scheduled maintenance. The firewalls are in a cluster that never goes down.

The scalability is excellent because you can always purchase a bigger firewall as you grow. 

I rate Palo Alto's support a seven out of ten. It is good overall but worse in some regions. The first level of support will usually do nothing for you. If you're an IT company, you're not looking for level-one support. You need to escalate. Other vendors have a direct support line for enterprise clients, but not Palo Alto.

Neutral

Palo Alto has a better interface and integration with other solutions than competing vendors. The only drawback is the price. Go with FortiGate if you're looking for a firewall that is cheap and decent. If you can't afford Palo Alto, FortiGate is the next cheapest. 

We can deploy Palo Alto firewalls faster and easier than most other solutions. We assess the traffic, buy the appropriate size, and implement it. 

Palo Alto firewalls are expensive, but they're worth what we pay. 

I rate Palo Alto NG Firewalls a nine out of ten. Technical support has some room for improvement, and there are several minor issues that aren't worth mentioning. 

We use it as an Internet-facing parameter firewall. In my environment, it has security and routing. It is on a critical path in terms of routing, where it does a deep inspection, etc.

There have been a lot of improvements from security to service.

It is critical that Palo Alto Networks NG Firewalls embeds machine learning in the core of the firewall to provide inline, real-time attack prevention. In my environments, we have an integration with a third-party vendor. As soon as there is new information about new threats and the destination that they are trying to reach on any of our network devices, that traffic will be stopped.

Setting up a VPN is quite easy. 

It gives you a lot of information when you are monitoring traffic. 

In terms of user experience, Palo Alto has very good user administration.

Machine learning is important. Although we have not exhausted the full capabilities of the firewall using machine learning, the few things that we are able to do are already very good because we have an integration with a third-party. We are leveraging that third-party to get threat intelligence for some destinations that are dangerous, as an example. Any traffic that tries to go to those destinations is blocked automatically. There is a script that was written, then embedded, that we worked on with the third-party. So, machine learning is actually critical for our business.

There is a bit of limitation with its next-generation capabilities. They could be better. In terms of logs, I feel like I am a bit limited as an administrator. While I see a lot of logs, and that is good, it could be better.

I wanted Palo Alto Networks engineering to look at the traffic log, because I see traffic being dropped that happens to be legitimate. It would be interesting for me to just right click on the traffic, select that traffic, and then create a rule to allow it. For example, you sometimes see there is legitimate traffic being dropped, which is critical for a service. That's when actually you have to write it down, copy, a rule, etc. Why not just right click on it and select that link since that log will have the source destination report number? I would like to just right click, then have it pop up with a page where I can type the name of the rule to allow the traffic.

I started using Palo Alto in 2015.

It is very stable. We had two outages this year that were not good. They were related to OSPF bugs. Those bugs affected our service availability. 

It is quite scalable. I have been able to create a lot of zones to subinterfaces for a number of environments. I don't really have any issues regarding scalability. It meets my expectations.

Palo Alto Networks NG Firewalls technical support is very poor. Three or four months ago, I had a bug where the database of the firewall was locked. You cannot do anything with it. We looked for documentation, giving us a procedure to follow, but the procedure didn't work. We logged a complaint with Palo Alto Networks, and they gave us an engineer. The engineer relied on documentation that doesn't work, and we had already tested. In the end, the engineer gave us an excuse, "No, we need this account to be able to unlock it." This happened twice. The way out of it was just to restart the firewall. You can restart the firewall and everything goes back to normal. Therefore, I think the support that we got was very poor.

Neutral

I have used Check Point and Cisco ASA.

Initially, when I started with Palo Alto, we had Cisco ASA, but Palo Alto Networks beat ASA hands down.

We have a multi-vendor environment with different providers. Our standard is that we can't have the same firewall for each parameter, so there is some kind of diversity. 

We had ASA looking at one side of the network and Palo Alto Networks looking at the other side of the network. We also had Juniper looking at another side of the network. At the end of the day, ASA was very good, I don't dispute that. However, in terms of functionality and user experience, Palo Alto Networks was better. 

Palo Alto Networks beat ASA because it was a next-generation firewall (NGFW), while ASA was not.

When we bought Palo Alto, we had Juniper devices in our environment. We were told that it was a bit like Juniper, so we were happy. However, some people were a bit skeptical and scared of Juniper firewalls. Because of that, it took us a very long time to put them on the network. However, as soon as we did the implementation, we realized that we were just thinking too much. It was not that difficult. 

We deployed Palo Alto Networks as part of a project for data center implementation. The implementation of the firewall didn't take long.

We buy through a third-party. Our account is managed by IBM.

We have seen ROI. There is more visibility in the environment in terms of security. There was a time when we suspected a security breach, and this firewall was able to give us all the logs that we expected. 

Palo Alto is like Mercedes-Benz. It is quite expensive, but the price is definitely justified.

One thing is system administration. In our opinion, Palo Alto administration is easier compared to other vendors. I know other vendors who have Check Point. You have to manage Check Point, and it is a bit cumbersome. It is a very nice, powerful firewall, but you need more knowledge to be able to manage Check Point compared to Palo Alto. Palo Alto is very straightforward and nice to use.

In our environment, troubleshooting has been easy. Anybody can leverage the Palo Alto traffic monitoring. In Cisco ASA and Check Point, you also have these capabilities, but capturing the traffic to see is one thing, while doing the interpretation is another thing. Palo Alto is more user-friendly and gives us a clearer interpretation of what is happening.

One thing that I don't like with Palo Alto is the command line. There isn't a lot of documentation for things like the command line. Most documents have a graphic user interface. Cisco has a lot of documents regarding command lines and how to maneuver their command line, as there are some things that we like to do with the command line instead of doing them with the graphic interface. Some things are easy to do on a graphic interface, but not in the command line. I should have the option to choose what I want to do and where, whether it is in the command line or a graphic interface. I think Palo Alto should try to make an effort in that aspect, as their documentation is quite poor.

We would rather use Cisco Umbrella for DNS security.

I compared the price of Palo Alto Networks with Juniper Networks firewall. The Juniper firewall is quite cheap. Also, Palo Alto Networks is a bit expensive compared to Cisco Firepower. Palo Alto Networks is in the same class of Check Point NGFW. Those two firewalls are a bit expensive.

It gives us visibility. In my opinion, the first firewall that I would put on our network is Palo Alto Network and the second would be Check Point.

Palo Alto Networks NG Firewalls is a very good firewall. It is one of the best firewalls that I have used.

I would rate Palo Alto Networks as nine out of 10.

We use Palo Alto Networks Next-Generation Firewalls daily to create firewall rules that permit network traffic for specific applications and end users.

We use various models, including the 800, 400, and 3200 series. The specific model required depends on the size of the remote site where it will be deployed.

Embedded machine learning is crucial because hackers increasingly leverage AI to develop innovative methods of infiltrating networks. AI enables them to create more sophisticated malware and threats, intensifying the arms race between defenders and attackers. To counter this evolving threat landscape, next-generation firewalls must incorporate AI and machine learning capabilities to analyze and mitigate threats effectively.

AI and machine learning are valuable aspects.

UTM solutions like those offered by CheckPoint and Fortinet all offer a single pane of glass for managing security. Palo Alto is the same, but as a newcomer to Palo Alto, I've found its management, particularly with Panorama overseeing our hundred firewalls, challenging. Pushing changes, especially to individual firewalls, often results in failures, requiring full system updates. This inconsistency creates significant hurdles. While I suspect similar complexities exist in Cisco Firepower and potentially Fortinet, Palo Alto's implementation seems unnecessarily convoluted.

Palo Alto claims their NG Firewalls are highly customizable, but this isn't always true. We've encountered an issue where changes to a firewall cannot be reverted. Unlike Cisco Firepower or ASA, where changes are only committed after saving, Palo Alto commits changes immediately and places them in a queue. This prevents reverting changes, even accidentally made ones. For instance, today I was testing firewall rules without intending to push them, but the changes were already committed to the locally managed Panorama server. This lack of control is a significant drawback compared to vendors like Cisco or Checkpoint, where uncommitted changes are not saved.

Executives often praise Palo Alto firewalls, but these same executives rarely have hands-on experience managing them. Unlike them, I deal with the daily complexities of firewall operations. While every firewall has its shortcomings, Palo Alto is no exception. Cisco's ASA, for instance, was frustrating to manage through its ASDM interface, but the CLI configuration was reliable. Unfortunately, other vendors like Checkpoint and Fortinet heavily rely on management servers, limiting CLI options. Pushing changes can be a nightmare with any firewall, often involving unnecessary whole pushes due to errors or version mismatches. Palo Alto is no different; it's prone to bugs and challenges like any other product. Contrary to popular belief, executives who lack firsthand experience with firewall management often exaggerate Palo Alto's strengths.

Palo Alto Networks NG Firewalls have been problematic. Due to failed configuration pushes, I've encountered issues requiring Palo Alto Technical Assistance Center involvement. Based on DNS hostnames, objects are supposed to be automatically resolved by Palo Alto, but this functionality proved unreliable, necessitating a firewall upgrade and patch to correct a bug. Contrary to claims, Palo Alto has not exceeded expectations; managing as other firewall brands has been as frustrating. Each firewall platform has complexities, but I don't believe Palo Alto surpasses Check Point, Fortinet, or Cisco Firepower. While it might have advantages over Cisco Firepower, when compared to Check Point or Fortinet, Palo Alto does not offer greater performance.

I have been using Palo Alto Networks NG Firewalls for nine months.

When installing a Palo Alto Networks NG Firewall, we connect it to the network via a management interface and configure basic settings. Next, we register the firewall with Panorama, its management server, and then plan the network transition.

Palo Alto Networks NG Firewalls are overpriced. While Fortinet offers a more affordable option, Palo Alto commands premium prices due to its strong brand reputation among CISOs and security executives. Despite this, I believe Palo Alto firewalls are overhyped and underperform expectations. Many of these executives, who lack hands-on firewall management experience, base their decisions on marketing claims rather than practical knowledge. In contrast, Check Point pioneered next-generation firewalls, offering advanced features before competitors. However, its reliance on a centralized management system limited flexibility. Cisco, while improving, has also moved towards centralized management, restricting CLI access. Ultimately, I prefer the balance of features and flexibility Check Point offers.

I would rate Palo Alto Networks NG Firewalls eight out of ten.

The solution is to provide protection for our cloud-based server resources.

We don't have to spend as much time monitoring or configuring the solution. We just feed the alerts into our stock and we don't have to manage it regularly.

The configuration and stability are great. The solution offers many good features. Palo Alto has by far the best firewall in the world.

Palo Alto NG Firewalls embed machine learning into the core of the firewall to provide real-time attack prevention. Of course, that's just expected these days. Anyone worth considering is doing this. Low-end firewall devices out there do not provide that. However, they're not enterprise-ready.

The machine learning in Palo Alto's Next-Generation Firewalls is excellent for securing our networks against threats that are able to evolve and morph rapidly. It's a ten out of ten.

The product provides a unified platform that natively integrates all the security capabilities. That's very important to us.

The product has zero-day signature features implemented.

There are no trade-offs between security and network performance with Palo Alto.

We haven't had any issues so far.

I've used the solution for the last three years, although the company has used it for longer. 

Technical support is proactive in letting us know when there are updates that need to be made to the system. We've not had any issues with any of the maintenance activities.

Positive

We are customers of Palo Alto.

I'd rate the solution ten out of ten.

Our primary use case is to provide our clients with an internet gateway. 

The best feature is the packet inspection; compared to solutions like Cisco and FortiGate, Palo Alto's packet inspection is much less CPU intensive, allowing it to detect threats embedded within packages more quickly and efficiently. 

Palo Alto Networks NGFW provides a unified platform that natively integrates all security capabilities; it's easy to integrate with other platforms, and we never faced any issues doing so.  

Using Palo Alto Networks NGFW's unified platform, our clients have eliminated multiple network security tools and the effort needed to get them to work together.

The solution doesn't support routing in virtual firewall creation, and we want that to be enabled. 

We've been involved with Palo Alto Networks since 2008 and are a reseller, so we implement the solutions for our clients.

The solution is very stable; we don't have any problems with the stability. 

The product is very scalable. Most of our customers are enterprise-sized financial institutions with over 3,000 branches. 

Palo Alto Networks doesn't directly support Pakistan but rather through distributors. Out tickets go to the distributors, which are then forwarded to Palo Alto.

Neutral

The initial setup is very straightforward; we can complete it three to four hours after activating the licenses.

The product is expensive. With one being the cheapest and ten being the most expensive, I give it an eight.

I rate the solution nine out of ten. 

Palo Alto Networks NGFW is an excellent solution; 90% of the financial institutions in Pakistan use it as their ultimate gateway. 

People are just starting to get into machine learning in Pakistan, so we're not 100% sure of its capabilities and potential. I believe machine learning becomes more efficient in a cloud environment than a hybrid one, though I have yet to research this thoroughly.

To a colleague at another company who says they want the cheapest and fastest firewall, Palo Alto Networks provides an expensive solution, but you can't compromise on security. You can buy the most inexpensive firewall, but you'll have to purchase add-ons and subscriptions to enable a complete security infrastructure in your organization. One solution for every situation that doesn't require any additional services is a better choice. 

I advise those considering the solution to understand where they want to deploy it in the organization, as a broad installation is best for internet gateways. Next, the sensitivity of the data is important; for a financial institution like a bank, I recommend Palo Alto NGFWs because of the quality of the security and machine learning.

We use Palo Alto Networks NG Firewalls for our gateway security.

Embedded machine learning is important.

The user experience is good and the configuration is very easy.

Palo Alto Networks NG Firewalls provide a unified platform that natively integrates security capabilities.

IDM is the most valuable feature.

The process of applying updates to Palo Alto Networks NG Firewalls has room for improvement.

The price also has room for improvement and the technical support could respond faster.

I have been using Palo Alto Networks NG Firewalls for one year.

The solution is extremely stable.

The solution is scalable. We have 60 people that use the solution in our organization.

The technical support is good but can sometimes be slow.

Positive

I previously used WatchGuard XTM firewalls, but I switched to Palo Alto Networks NG Firewalls because of their superior performance and features.

We have seen a good return on investment.

Palo Alto Networks NG Firewalls are expensive compared to WatchGuard XTM firewalls.

I give Palo Alto Networks NG Firewalls a ten out of ten.

We have to perform regular updates for the solution.

We use it for our edge firewalls and our east-west and north-south traffic for our firewalls. We have also deployed each firewall to every site for our Layer 3 connections back to our data center.

Since we've integrated it into our east-west traffic and north-south traffic, I feel that it has reduced the number of viruses or other things in our endpoints. I wish to expand it more all the way to our endpoint computers so that we have end-to-end firewall security through Palo Alto.

It provides a unified platform that natively integrates all security capabilities. This is very important to me because I'm in IT infrastructure. I take care of the entire operations network and everything that flows north and south, east and west, and inside and out of our data center. It's very important that we have Palo Alto to protect us.

It embeds machine learning in the core of the firewall to provide inline, real-time attack prevention. When any packet comes through the network, everything is like a first pass. It goes through every single part of our network, and we don't have a delay in alerts or network security. It stops any attack on the line.

I like all the threat alerts and WildFire. I also like scanning because everything that comes into our network via customers is scanned. We're an electric company, so every one of the bills is scanned and emailed in and out of our network. 

I like the reports, but I wish the reporting was a little better. When I set up the automatic reports to come in, they're pretty basic. I would like them to be a little more advanced at the ACC monitoring and things like that. I still enjoy all the daily alerts that I get and all the daily PDFs and reports, but I just feel that it could expand upon the visualization of the reports.

I've been using this solution for seven years.

The stability is great. They're not going anywhere. They're the industry leader.

It doesn't matter whether you are small or large, Palo Alto will fit your needs.

I'm in Pacific Standard Time. During the day, I have great support, and after 5:30, I don't have great support. During my business hours, I would rate their support as a ten out of ten. I love Palo Alto's support. However, at night, when the sun changes and I go to a different area, it's not always the best at level 1. If the incident was like having a system down, the support would be better, but after hours or 5:30, I have a harder time.

We were using Cisco ASA. We switched because of its ease to use and the GUI. There is also Single Pass Architecture, which is related to the way a packet flows through our network. It doesn't have to go through one area into another area. It's all at one, and it just separates. It gives me the best visibility of our network and firewalls.

It has decreased the time of technicians in researching the vulnerabilities. We also do web filtering, so that helps. Web filtering has changed things because we used to use Websense, and it's night and day.

It's very expensive. However, we usually use all of the subscriptions and threat alerts on any firewall that uses the internet. For each edge security endpoint, we use all subscriptions. Otherwise, we just utilize the threat alert, the antivirus, WildFire, etc.

Palo Alto is the best firewall company. Whether you're a small company or a large company, it will fit your needs.

By attending this RSA Conference, I was hoping to find new security solutions. However, I seem to like my existing Palo Alto security solutions. In terms of the impact of the RSA Conference on our organization’s cybersecurity purchases, it depends on what we're looking for at the time of attending an RSA Conference. Right now, we're looking for something that I didn't really see here. We're looking for security, but this means we need a security operations center (SOC), whereas we're small. We just don't have that type of network. This is almost too much. However, that's why we have Palo Alto Networks.

I would rate it a nine out of ten. It's not perfect, but it's pretty good. Palo Alto is the best firewall security network that I could possibly purchase.

Our use cases include combining multiple next-gen firewalls and bringing them into the Panorama centralized platform.

In general, it's one of the better firewall brands out there. It definitely has the investment and the dedication of the Palo Alto team to constantly improve their product and move forward. They're not a static company, like some of the other companies out there, and that's why I like them.

From a firewall perspective, there is a unified platform that natively integrates all security capabilities, which is good because there is a single pane of glass. I don't have to go to every single firewall to look at certain things. I don't have to go to every single firewall to deploy rules. I can use Panorama to deploy the rules, so it's a one-stop job type of thing.

For securing data centers consistently across all workplaces, all next-gen firewalls pipe into the same Panorama centralized management solution. We can manage everything from a single pane of glass, deploy all that out, and make sure it goes through each firewall and updates correctly. That's huge. If you had to do it manually and you had thirty locations, that'd be like a day's job versus thirty minutes.

Having a centralized platform where they all feed into the Panorama solution significantly drops firewall-by-firewall management. We can use the Panorama solution to communicate with all of them.

I like the navigation of the general Panorama solution. I can easily navigate around and get to the thing I need. I'm not wasting time trying to find something.

Personally, I feel that their dashboards for reporting and things like that need some improvement.

We've been using Palo Alto for one to two years.

It has been very stable so far.

So far, it has been scalable enough to hit multiple divisions.

I have not personally contacted their support. That just dictates that they have a good product.

Positive

We also use Cisco firewalls.

I am not directly involved in its deployment, but I do help manage it. To my knowledge, the deployment was straightforward. It was easy to connect them into the Panorama platform.

There was a consultant. They knew their stuff.

There is typically no return on investment for firewalls because it's an IT cost, and we don't make money because we don't resell them.

It's pretty good.

We evaluated Fortinet and Check Point.

The value I receive from attending an RSA Conference is huge because I visit all my vendor partners to understand their roadmaps for the future. Attending an RSA Conference has had an impact on our organization’s cybersecurity purchases made throughout the year afterward because it brings out new features and subsets of the vendor partners. Also, if there is a deficiency in any of the current ones we currently use, we'll go engage other providers in order to find out if they can reach that gap or not, and then it'll dictate future proof of concepts and decisions.

Palo Alto embeds machine learning in the core of the firewall to provide inline, real-time attack prevention, but I personally haven't experienced that. It's a good thing that there hasn't been an attack where that became useful, but that's great to know.

As a result of our experience with Palo Alto NGFW, to a colleague at another company who says, “We are just looking for the cheapest and fastest Firewall,” I would say, "Go with Palo Alto."

Overall, I would rate Palo Alto NGFW an eight out of ten.