Palo Alto Networks Panorama Reviews

We have firewalls in different locations and we want to manage them centrally to see all the information available. The best way to do this is by using this solution, we are able to monitor, manage, and have visibility of the networks.

The most valuable aspect of this solution is the ability to manage our devices centrally. Additionally, we can monitor the workforce connections, receive reports, and use the backup feature.

There are times when we are backing up a device centrally, we do not get a full backup. We are able to do a full backup of all the devices but when we attempt to backup a single device, it only does the backup of a few presets and not the full configuration.

In the future, they could improve by providing better management of the devices, such as bandwidth. 

I have been using the solution within the last 12 months.

The stability is good.

The solution is scalable. You are able to go through this solution and download from the internet upgrades to push them to the certain devices that need it.

The technical support is good. I receive a resolution from the technical support whenever I have dealt with them.

We sometimes have difficulty with the deployment configuration.

The solution requires a license and the price is higher than competitors. It would be better for them to decrease the price or maximize the discount.

I would recommend this solution to others if you have multiple sites and you want to manage them centrally.

I rate Palo Alto Networks Panorama a nine out of ten.

The solution is primarily used as a firewall reporting feature.

The dashboards are very good on Palo Alto. They offer a centralized dashboard for managers as well.

The solution needs to improve its pricing model.

Panorama needs to work on its configuration issues.

They should also focus on firewall management. Many clients have multiple firewalls, so Palo Alto should offer better management of them. They could model themselves off of AlgoSec, or maybe FireMon which are other very good firewall management tools.

The solution is stable. Palo Alto, in general, is pretty good. 

The solution is very scalable. We manage about 12 firewalls. The maximum might be 100.

Support from Palo Alto is very good. You can get it from the distributor or from Palo Alto directly.

The setup is generally straightforward. Deployment times vary, according to the client's environment and if they have multiple branches, etc. It can take anywhere from one to three days. After that, you have to fine-tune a few items, and that can take another two or three weeks. So the entire deployment process, depending on the organization, can take anywhere from three days to three weeks. Maintenence only takes one person, once again, depending on the setup of the company itself.

Most of our clients deal with the on-premises deployment solution, as cloud solutions in Egypt can occasionally be insecure.

I would advise anyone looking to implement the solution really focus on sizing before beginning the implementation.

I would rate the solution nine out of ten.

Our primary use cases are for web security, antivirus, and remote browsing. I'm a senior security specialist and we are integrators. 

The product is very efficient. 

This is a relatively expensive solution and I wouldn't recommend it for a stand-alone deployment. 

I've used this solution for five years.  

The solution is generally stable. There can be issues but it's generally related to power supply issues a company might have.

The solution is scalable. 

The technical support is very good. They're very responsive and always have engineers available to help. 

Positive

The initial setup takes around one week and is complex. All other firewall configurations are easier than Check Point. If you face any configuration issue, the only solution is to contact the Check Point team. Deployment generally requires an engineer. 

Licensing costs are cheaper than Palo Alto but more than other solutions. It's quite expensive. 

I recommend this solution unless you're in a location with a lot of power cuts. If you work for a software company, I'll always recommend this solution. If you're looking for a stand-alone deployment, then I would recommend Fortinet. I rate this solution nine out of 10. 

Panorama: Provides a central management capability for all of the firewalls. It has the ability to manage the devices in groups based on their use. We use the firewalls in two primary functions and the ability to provide management of the different groups of firewalls is very useful.

Firewalls: The application ID capabilities have been very useful for things like Active Directory, and not having to identify every port that Microsoft has decided to use.

I can’t say that it has significantly improved the functions of the organization over the firewalls that we were previously using. The addition of a good central management capability has helped improve the management of the firewalls, but the functions for the service that is provided to the users has not significantly changed.

Panorama: The ability to add scheduled jobs would be a significant improvement. Panorama has the ability to push out OS updates, but it would be nice to be able to schedule those updates so not to affect the site during normal business hours.

Firewalls:

• (1) App-ID is good, but could be better. We use off ports for some common services and App-ID does identify the application correctly, but the rule allowing the traffic does not allow the traffic without adding the ports to the rule. This negates the need for App-ID in the rule. If App-ID worked as I think it should, we would use it and then block the common port.
• (2) Integration with Microsoft Active Directory incurs significant additional traffic across the WAN circuits. We have a number of GCs across our environment and the configuration of Active Directory in the firewalls requires significant communications to all of the GCs across our environment. We were seeing the firewalls generate around 500kb of WAN traffic communicating with all of the GCs. After reviewing the configuration with Palo Alto support, the config was correct. While we do want to be able to use the User-ID functionality of the firewalls, that kind of overhead is not acceptable.

We have been using Panorama and the PAN FWs for just over one year.

So far we have not seen any issues with stability.

We have not run into any issues with scalability.

Technical support with Palo Alto has been very good and responsive.

We previously were using Cisco ASA devices. The switch was made based on central management and the NGFW functions. The timing was in the middle of Cisco delivering their NGFW functionality. The other issue that led to the move was when Cisco presented their recommended replacement for the existing devices, they recommended their Meraki line with Internet management, which was not in line with our requirements for many of our more sensitive firewalls.

Initial setup is very easy. After working with a few new installations we were able to put together a script to apply the new firewalls to setup the management access, Panorama location, high availability (HA) configuration and the initial IP stack. This makes it easy to start the OS updates and initial rules from Panorama. By having the HA setup scripted, it also makes the OS updates a single download instead of a download for each device. The HA connection allows the firewalls to copy the OS over to the other firewall with the single download. That is important because there are several large downloads necessary to update the OS to the current OS levels.

Pricing is high compared to other vendors in the same space. Licensing is also fairly high for different functions to be added on, like Intrusion detection/prevention, user VPN, URL filtering. Some firewall vendors offer the “additional” licensing/functions as part of their license for the device and then others offer it like Palo Alto.

The original decision was made by a different group within the company. The re-evaluation included Cisco ASA, Cisco Meraki, Fortinet and Palo Alto.

Talk to other customers. Start with the ones recommended by the vendor, but also in forums as well. Everyone understands that recommended customers are handpicked and forums can be contain spurned customers. But if you look for information regarding specific functions that you need, you can find more useful information. Make sure if you hear something glowing from a vendor recommended customer about a function, check on that function online.

My customers use this solution in their companies. 

Especially for big, worldwide clients, one of the most valuable features is being able to create some rules to place on the security groups.

We have had some issues in the past because integrating a new device is not intuitive. If there is some room for improvement, that would be it.

I'm not an expert on the matter, but I would like to see more capabilities regarding automation and integration. We are seeing a trend where the clients are asking for integrations with European tools. I know the solution is quite integral with all kinds of tools, but there are some different tools here in the market in Europe, so this is important. 

The menu is full of options, which is good in some ways, but for a newbie it can be a little bit overwhelming and you need to properly understand it before starting to work with it. I think the ramp up at the beginning is quite intense.

I have been familiar with this solution for two years. 

The solution is quite stable. Among our clients, it is actually one of the preferred solutions. 

Our clients who use this solution are enterprise companies. We have around 50 people at our company working with the solution. The number of admins needed for the solution depends on the company, but most of our clients have over 15 admins. 

The initial setup is kind of easy. I think it takes about half a day to set it up properly. 

The pricing is considered a little bit expensive, but depending on the client, it's worth it. Again, it depends on the client, but they generally consider it a good solution.

The payment structure depends on the contract that the client has with Palo Alto. I think usually the cloud solution is charged monthly.

I also work with Fortinet, and I think their solution is more intuitive. The menus are less charged, and I found the documentation to be a little bit more clear.

I would tell people considering this product that you always have the support of Palo Alto. They can be plan B just in case something happens while configuring a new device, for example, to ensure everything gets configured the way it should be at the beginning.

I would rate this solution as an eight out of ten. 

Our primary use case is to have a centralized console for gateways.

It has shared profiles for all gateways. If I do not have Panorama, I need to create a separate profile for each and every gateway by logging into that particular gateway, but with Panorama, I can create a shared profile and just push it down to each and every gateway connected to it.

In our version, there is no feature to transfer or upload a database of third-party vulnerabilities or signatures so that Panorama can convert them into its own database. This kind of feature might already have come in version 10.

I have been using this solution for around four years.

As of now, I am not seeing any limitation in terms of technicality, deployment, and functionality. In terms of licensing, depending on the number of gateways or serial numbers, I need to purchase the license, which is not really a limitation.

They are good. Whenever there are some issues or bugs and we are not able to trace them out, we reach out to them. They provide the required support.

It was straightforward. The gateway integration with Panorama was also a pretty straightforward configuration for us. 

We deployed it site-wise. For each HAPS, it took us around two hours to take an existing production gateway behind Panorama.

I would recommend this solution to others. It is a good solution. If any environment has multiple gateways, such as 50 or 100 gateways, it is good to have Panorama. If you have only one or two gateways of Palo Alto, you can easily manage them individually without having Panorama.

I would rate Palo Alto Networks Panorama a nine out of ten.

Palo Alto Networks Panorama has a lot of features.

The price of Palo Alto Networks Panorama could be better.

I have been using Palo Alto Networks Panorama for approximately four years.

Palo Alto Networks Panorama is stable.

The scalability of Palo Alto Networks Panorama is good. We have middle to large enterprises using this solution.

The technical support is very good and they are at the top of the class.

If the customer doesn't have the budget, I recommend Fortinet. It is not the same level as Palo Alto Networks Panorama, but for a budget, it is an advantage. Check Point is a little bit complex, compared to Palo Alto. If the customer is looking for the technical specifications then Palo Alto Networks Panorama is the best. If the customer is on a budget, there are alternatives.

The initial setup of Palo Alto Networks Panorama is easy and takes approximately one day.

Palo Alto Networks Panorama is a more expensive solution than competitors. They should lower the price to stay competitive.

All my clients are happy and satisfied with the solution. We can strongly recommend it to others.

I rate Palo Alto Networks Panorama a nine out of ten.

Panorama is one centralized management server through which all our devices are protected. It's a security management tool.

One of the most valuable aspects for us is the fact that all of the policy management and configuration management is able to happen right from the centralized management. This makes everything much easier.

The initial setup is pretty simple.

The solution, especially the latest versions, is very stable.

The product can scale well.

The customer support needs to be better. Sometimes we need to wait for hours before getting someone from the product team or someone from the Palo Alto customer support to get on a call if we are facing some issue. They could reduce the wait times.

I've been using Palo Alto for about a year and a half.

The solution is quite stable. The more high-end devices you take, the more stability. If you're using a little old model of firewalls, then there are issues with regard to stability. In such cases, Palo Alto would likely recommend you upgrade to the latest hardware. The latest hardware is really very stable.

The solution is quite scalable. 

Technical support is quite slow. They are not quick to respond.

The initial setup is easy. It is not that complex. There are articles and documentation, readily available on the Palo Alto website, the Palo Alto Portal, which can help you figure out how to configure the device.

Our deployment strategy for any new customer is to directly implement it in a testing phase. In a testing phase, we try to see if all the requirements that the customer wants to see if we will be facing any challenges. We want to initially try and replicate that in a lab scenario. That way, if there are any issues, we can get back to the team at Palo Alto and ask them questions. If it works, then the customer goes into production.

We don't have any dedicated person for maintaining anything. The antivirus, everything, can be directly, automatically updated on the firewall. That is not an issue. On top of that, if a particular device is getting into trouble then we get the NMS alerts for that device. In such scenarios, once we have a device failure at a particular site, we can have that device replaced. We can open a case with the vendor and once we give them a particular serial number or the VM instance, we can initiate an RML to replace that device with a new device. It takes a couple of days for that to happen.

We have another team that handles licensing. In operations, we do not have any visibility with regard to cost.

I'd rate the solution at a nine out of ten. We've been very happy with its capabilities.