Palo Alto Networks Panorama Reviews

This is a solution that we implement for our customers.

It allows our customers to manage several firewalls from a central location. Some examples are securing the internet edge, data centers, micro-segmentation within the data centers, and securing their campuses.

The majority of the deployments are on-premises, however, we have more and more customers that are moving to the cloud. This solution is helping them to secure their cloud, as well.

Using this solution means that you can store logs for longer periods, up to perhaps two years, depending on your attached storage.

The most valuable feature is the ease of use that comes from the GUI. I have found that you can do almost everything from the GUI. You rarely have to log into the CLI, at perhaps once in six months or a year.

This solution offers a lot of advanced functionality that is easy to deploy and not available from other vendors. An example of this is credential theft. Credentials are sometimes collected through phishing emails or websites, and this solution helps to reduce that type of attack. Every five minutes, Palo Alto updates the list of phishing websites. You can set up a profile to ensure that if anybody tries to access such a website, whether it be Http or https, then the attempt will be blocked.

Palo Alto will automatically monitor the contents of POST messages and check to see if they contain credentials such as a username and password. If they do then it may indicate an attempt to steal credentials by an external site. The traffic will be blocked, the incident will be reported, and the admin will be notified.

This solution makes the lives of security admins very easy in cases, as an example, for configuring IPS. If you want to secure traffic between any two zones, we need to make sure that the applications are identified, the users are identified, and all of the security profiles are applied. These including antivirus, anti-spyware, and IPS. This solution makes the configuration very easy.

Each firewall is treated as a security sensor where the firewall talks to the cloud and a machine running artificial intelligence helps to detect malware or other threats. This is an important step in the protection that this solution offers.

The dual WAN functionality is missing in this solution.

This solution is very stable. It is a mature solution with a mature operating system. I have one firewall that has been running since 2010, and it is still upgrading to the latest software and still working.

This solution scales well.

We have many more than forty customers who are using this solution. One is a university with twenty thousand students, and we have deployments in large banks, different branches of government, etc. There are many thousands and thousands of users who are being secured.

The demand is very high and the standards are improving. Data centers are booming, and customers are looking for more enhancement in their platforms.

Technical support for this solution is awesome. However, I rarely open a case because their platform is very stable. Most of the cases are related to basic support, such as an RMA. I have seen other vendors like Fortinet or Cisco, where the enabling of a function means that you have to deal with support, and there are issues that come from that.

The initial setup of this solution is very easy. The length of time for deployment depends on how many policies you have, but the basic configuration should not take more than one hour.

For policy tuning, you need to review and tune the devices. Palo Alto has several tools to help with migration from the legacy approach of port-based policies to application-based policies.

Initially, Palo Alto looks expensive, but if you dig deeper then you will find that it is very comparable, or even cheaper than other solutions. For example, if you are looking for a one-gig next-generation firewall then you will start looking at the Palo Alto 850. If you compare the price of this to Fortinet, Worksense, Forcepoint, or Sophos, then you will see that they offer three or four gig performance at half the price. However, it is not true.

The reason for this is that not all of the security features are enabled. When you enable them, the performance degrades by more than ninety percent, and I have seen this happen in many different scenarios. This means that for the Palo Alto 1GB, it actually means 1GB with all of the functionality enabled. For the other vendors, you will never see their datasheet with all of the functionality enabled for a real environment with real traffic. It is based on lab traffic. Because the reality is that the performance of Palo Alto is better, it means that the price is better. When you compare models using real performance, and you do the calculation, you will see that Palo Alto is very comparable.

We have worked with many, many vendors, and this is the most mature next-generation firewall in the market. The performance of Palo Alto is very predictable, unlike other vendors who are faking their datasheet in terms of high-performance numbers that are unrelated to a real network, or real traffic.

Palo Alto provides numbers that reflect what is happening when all of the security functions are enabled, whereas other vendors do not show their performance will all of the functionality enabled. In reality, they are better than others. At the end of the day you are buying a security device, and you don't want to turn off any of the functionality to enhance your performance. Palo Alto is designed from day zero for performance and security.

This is the most mature next-generation firewall in the market and a solution that I strongly recommend.

The biggest lesson that I have learned from this solution is not to trust internet users. Whether it is regular users or employees, they do not like to be detected. They keep trying to work around the policies using different applications and peer-to-peer functionality. I have learned this because Palo Alto has full visibility to all types of traffic, and we're able to catch these scenarios and put security policies int place.

Palo Alto has done a lot towards closing gaps in security. Cloud security is not their only focus. It is concerned with the flows between VMs, storage, and containers. They are concerned with PCI requirements and compliance. They have also launched Cortex Analytics to help close gaps further. They are in a very good position to lead the future.

At the end of the day, everything is relative, and I would rate this solution a ten out of ten compared to other products. However, there is room for improvement.

Overall, I would rate this solution a nine out of ten.

My clients use Palo Alto Networks Panorama for centralized management of multiple firewalls across various locations. It allows them to easily oversee and configure all their firewalls through a single interface, streamlining security management across their network infrastructure.

The most valuable aspect of Palo Alto Networks Panorama for me is the centralized management of multiple firewalls. It saves time, provides consolidated visibility into my network, and allows me to configure all firewalls from one web interface, eliminating the need to access each firewall separately.

In the future, it would be beneficial if Panorama could include a firewall assurance feature similar to Skybox. While each firewall has its policy optimizer, a consolidated policy optimizer in Panorama could further enhance firewall management and optimization.

I have been working with Palo Alto Networks Panorama for over ten years.

Panorama is stable.

Palo Alto Networks Panorama is scalable and can support up to 1,000 devices, making it suitable for various network sizes. In terms of clients, it is mainly used by larger customers with more than ten firewalls. Some smaller customers with six or eight firewalls may not opt for Panorama, but those with ten or more find it beneficial for centralized management.

I find Palo Alto Networks' technical support to be good, especially with premium support. The initial support level is handled by us, and if we encounter issues beyond our scope, Palo Alto's support team is efficient in resolving them. I would rate the support as a nine out of ten.

Positive

Installing Palo Alto Networks Panorama is easy, and connecting firewalls is a straightforward process. Deployment typically requires just one person, usually the firewall administrator. Maintenance is also easy, especially for those familiar with managing individual firewalls, and Panorama serves additional functions like log collection and setting up SD-WAN functionality, making it highly useful for networks with multiple firewalls.

In terms of return on investment, Palo Alto Networks Panorama is worthwhile, especially for larger networks with more than ten firewalls. The time saved and the consolidated view it provides investment pay off quickly, often within a couple of months.

In terms of pricing, Palo Alto Networks Panorama is moderate. It is very affordable when compared to more expensive firewalls. The license is yearly, and the price typically includes the initial license and support, with subsequent years requiring only twenty percent of the initial license cost for support. It is negotiable, and the overall cost depends on your network setup and the type of firewalls you are using.

Overall, I would rate Palo Alto Networks Panorama as an eight out of ten.

Palo Alto Networks Panorama has improved the way my company works, which is why my company uses it.

What I like about Palo Alto Networks Panorama is that it's stable and setting it up isn't complex.

My company's getting whatever it needs from Palo Alto Networks Panorama, but in the cloud, there's an issue with CPU management, and that's an area for improvement. Though the normal data traffic doesn't go through the management interface, whenever there's an increase in the throughput, CPU management becomes high. If you increase the load, CPU management spikes, and it's what needs to be taken care of in Palo Alto Networks Panorama.

I've been using Palo Alto Networks Panorama for the past four years.

Palo Alto Networks Panorama has good stability. I didn't see any instability from it, though at times, the CPU goes high in terms of usage, and that's what you need to take care of.

Palo Alto Networks Panorama is a scalable solution.

Technical support for Palo Alto Networks Panorama, in my experience, was initially good, but now the wait time is longer. My company has a dedicated account manager, so it gets support, but in general, the response time is longer.

The initial setup for Palo Alto Networks Panorama was straightforward. I didn't see any complexity. It was a normal firewall configuration. I haven't done any new deployment of Palo Alto Networks Panorama, but in the cloud environment, it didn't take much time for me, and you can complete a setup within one to two hours.

We implemented Palo Alto Networks Panorama through a vendor team by Palo Alto, specifically for the on-premises deployment, to migrate from Check Point to Palo Alto Networks Panorama, but in the cloud environment, as it is a VM, we did it ourselves.

Palo Alto Networks Panorama is deployed everywhere, particularly in the public cloud and on-premises as well.

My company is just a customer of Palo Alto Networks Panorama, but because it's a big company, it has a dedicated account manager in Palo Alto.

My company uses the solution extensively. There are more than six Panoramas. Forty to fifty firewalls are managed currently through Palo Alto Networks Panorama.

I'm rating Palo Alto Networks Panorama nine out of ten. It's a good solution. What would make my rating a ten is if the CPU management spike issue was addressed and if the delayed response of technical support was addressed as well. A few years ago, the response time from support was immediate, but now, there's a delay with the response, even though my company has a dedicated account manager from Palo Alto Networks Panorama, and this makes you think about a midsized company with no account manager in terms of how much time it gets a response from Palo Alto support.

My obligations consist of overseeing cyber threat intelligence, threat defense operation, digital forensic incident response, and data loss prevention. So in the context of endpoint solutions, my position pertains mainly to the DLP (data loss prevention) function.  

Cisco AMP (Advanced Malware Protection) plays a significant role in our perimeter strategy for protecting the infrastructure. I work primarily with making sure that we have indicators of compromise in Cisco AMP. I am not on the network engineering or network operations side of things. I am mainly a consumer of services from those particular groups.  

We use Snort rules (open source network intrusion detection system [NIDS]). We use Yara rules (Yet Another Recursive/Ridiculous Acronym, rules for malware identification). We have Palo Alto IPSs (Intrusion Prevention Systems).  

Our use cases are primarily perimeter-based for runtime malware defense.  

The most valuable features are the management features like the ACL (Access Control List) management. These give us the capacity to make effective use of the capabilities of the product.   

Pricing is always something that consumers hope will be addressed in their favor. I think that some method of allowing for more customization and open integration with other controls within the enterprise is something that we want to have. We want to be able to have more orchestration of disparate parts.  

I think the features that most of the features that I would like to see are currently being implemented. Behavioral heuristic analysis of connections, for example. That is something that I know is being done now.  

We have been using Networks Panorama for a couple of years now.  

The stability is good. If you consider the size of our organization and the number of users that can verge on being impressive.  

I have good impressions of the scalability of this solution. We have not really had any issue scaling the usage.  

The tech support is actually pretty good. In general, they address issues in a timely manner with reasonable responses.  

My team has not previously used any different solutions in this company, but I have definitely, in the past, used other solutions. It is really necessary for the evaluation of product capabilities.  

The installation was straightforward in a complex environment. That means that we could have had far more issues were the product not well-designed from an installation standpoint. We are a big organization. Deployment can be a matter of weeks or it could be a matter of months depending on what jurisdiction the installation happens to be in.  

We have various partners and consultants that we work with in addition to having expensive competencies in-house. We do not often have a reason to go beyond the network of expertise that we have established.  

My advice to anyone considering Networks Panorama is to thoroughly research the competitive landscape. Do your Gartner research. Make sure you develop a set of requirements — a feature matrix that you can use to compare your requirements with the functionality offered by the various solutions under consideration. There are a lot of solutions out there and the goal would be to pick the one that best fits your situation rather than just one that someone recommends.  

On a scale of one to ten (where one is the worst and ten is the best), I would rate this product as an eight-of-ten considering the knowledge and insight I have into it now.  

We use Palo Alto Networks Panorama firewall, rule and policies management.

The most valuable feature of Palo Alto Networks Panorama is the simplicity of rule management. Both this device group and template management are very easy to use. 

Palo Alto Networks Panorama currently lacks the capability of integrating with other software, such as AlgoSec to simplify rule management and schedule management. However, this feature has been requested by the company and it is uncertain if Palo Alto will implement it in the future. Additionally, the UI needs improvement, it is too slow.

I have been using Palo Alto Networks Panorama for approximately five years.

The solution has frequent upgrades that reduce the stability.

I rate the stability of Palo Alto Networks Panorama a six out of ten.

Palo Alto Networks Panorama is scalable.

I have been using the same management software from other vendors, such as Check Point and Fortinet, but they are not as scalable as Palo Alto Networks Panorama.

We have approximately 25 people using the solution.

We do not plan to increase our usage because we are migrating to Zscaler and Cisco. Zscaler has some scalability advantages over Palo Alto Networks Panorama and this is why we are switching.

I rate the scalability of Palo Alto Networks Panorama a nine out of ten.

There are a few areas where Palo Alto Networks Panorama support could be improved. Specifically, when we encounter issues, it takes a significant amount of for support to resolve them, particularly when it comes to coding-related problems. We are unsure if they have invested in research and development in this area.

The initial setup of Palo Alto Networks Panorama took a long time to complete because there was not a lot of documentation.

We used the support from Palo Alto Networks Panorama for the implementation. They were very professional and helpful. We used five people for the deployment of the solution.

The price of Palo Alto Networks Panorama should be reduced. We pay for the solution annually.

We have acquired Palo Alto Networks Panorama for a three-year period, and we are selecting firewall options based on our specific needs, which may result in purchasing a DNS Security solution separately.

We use five people for the maintenance of the solution.

The solution is easy to use and superior to other competitors. Additionally, there are occasional graphical or visual glitches that also take a while for them to address through updates. The length of time it takes to resolve these issues depends on their severity.

I rate Palo Alto Networks Panorama a nine out of ten.

The solution is good compared to the competition, but the support is not up to standard.

We are using Palo Alto Networks Panorama for security and access controls.

Palo Alto Networks Panorama has some bugs that could be fixed.

I have been using Palo Alto Networks Panorama for approximately one year.

Palo Alto Networks Panorama is stable.

The scalability of Palo Alto Networks Panorama is good.

We have less than 100 people using this solution in my organization.

I have used the support from Palo Alto Networks Panorama.

I rate the support from Palo Alto Networks Panorama an eight out of ten.

Positive

The initial setup of Palo Alto Networks Panorama is of a medium level of difficulty.

We did the implementation of the solution in-house.

There is a license needed to use Palo Alto Networks Panorama. The cost is not that important, what is important is meeting all the requirements and security features.

We decided to use Palo Alto Networks Panorama over other solutions because we have the strategy sheet which defines our requirements, and our requirements were mostly met. We have a standardized service we want to deliver when it comes to a firewall we use Palo Alto Networks Panorama, if we use load balancers, we use F5, and for networks, we use Cisco. We have certain things that are already defined as a criterion for us to follow.

My advice to others is if this solution fits their use case then they should use it.

I rate Palo Alto Networks Panorama an eight out of ten.

Panorama: Provides a central management capability for all of the firewalls. It has the ability to manage the devices in groups based on their use. We use the firewalls in two primary functions and the ability to provide management of the different groups of firewalls is very useful.

Firewalls: The application ID capabilities have been very useful for things like Active Directory, and not having to identify every port that Microsoft has decided to use.

I can’t say that it has significantly improved the functions of the organization over the firewalls that we were previously using. The addition of a good central management capability has helped improve the management of the firewalls, but the functions for the service that is provided to the users has not significantly changed.

Panorama: The ability to add scheduled jobs would be a significant improvement. Panorama has the ability to push out OS updates, but it would be nice to be able to schedule those updates so not to affect the site during normal business hours.

Firewalls:

• (1) App-ID is good, but could be better. We use off ports for some common services and App-ID does identify the application correctly, but the rule allowing the traffic does not allow the traffic without adding the ports to the rule. This negates the need for App-ID in the rule. If App-ID worked as I think it should, we would use it and then block the common port.
• (2) Integration with Microsoft Active Directory incurs significant additional traffic across the WAN circuits. We have a number of GCs across our environment and the configuration of Active Directory in the firewalls requires significant communications to all of the GCs across our environment. We were seeing the firewalls generate around 500kb of WAN traffic communicating with all of the GCs. After reviewing the configuration with Palo Alto support, the config was correct. While we do want to be able to use the User-ID functionality of the firewalls, that kind of overhead is not acceptable.

We have been using Panorama and the PAN FWs for just over one year.

So far we have not seen any issues with stability.

We have not run into any issues with scalability.

Technical support with Palo Alto has been very good and responsive.

We previously were using Cisco ASA devices. The switch was made based on central management and the NGFW functions. The timing was in the middle of Cisco delivering their NGFW functionality. The other issue that led to the move was when Cisco presented their recommended replacement for the existing devices, they recommended their Meraki line with Internet management, which was not in line with our requirements for many of our more sensitive firewalls.

Initial setup is very easy. After working with a few new installations we were able to put together a script to apply the new firewalls to setup the management access, Panorama location, high availability (HA) configuration and the initial IP stack. This makes it easy to start the OS updates and initial rules from Panorama. By having the HA setup scripted, it also makes the OS updates a single download instead of a download for each device. The HA connection allows the firewalls to copy the OS over to the other firewall with the single download. That is important because there are several large downloads necessary to update the OS to the current OS levels.

Pricing is high compared to other vendors in the same space. Licensing is also fairly high for different functions to be added on, like Intrusion detection/prevention, user VPN, URL filtering. Some firewall vendors offer the “additional” licensing/functions as part of their license for the device and then others offer it like Palo Alto.

The original decision was made by a different group within the company. The re-evaluation included Cisco ASA, Cisco Meraki, Fortinet and Palo Alto.

Talk to other customers. Start with the ones recommended by the vendor, but also in forums as well. Everyone understands that recommended customers are handpicked and forums can be contain spurned customers. But if you look for information regarding specific functions that you need, you can find more useful information. Make sure if you hear something glowing from a vendor recommended customer about a function, check on that function online.

This solution allows us to centrally manage all devices. It's deployed on-premises.

There are 10,000 employees in my organization. We have two or three data centers across the globe.

It's easy to deploy any software or policies. Even if you have multiple devices across the globe, if you have urgent searching or maybe policy enforcement, you can do it easily.

The interface is easy to understand and manage. It's an intelligent device and can capture any spyware or vulnerabilities.

It's a leader in the market, and they observe the market requirement and upgrade the software accordingly.

The price could be lower. I would like to see remote VPN, like the Cisco client.

I've been working with Panorama for four years.

Panorama is stable.

It's scalable.

Setup isn't simple, but it's easy to migrate from another vendor.

Right now, we use 40 employees to manage the solution.

Cost-wise, it's very expensive. If you want to go with another vendor, Cisco and Fortinet are good for medium-size networks.

I would rate the cost 4 out of 5.

I would rate this solution 8 out of 10.