What advantages and disadvantages do Palo Alto firewalls have, compared to others in the market

Question

I am about to start an evaluation process for firewalls. I have experience with Checkpoint and Juniper, but I don't have any information on Palo Alto networks, other than their marketing stuff.

So I would like to hear from IT analysts/network administration the pros and cons of Palo Alto in areas such as:

• Ability to identify malicious traffic at speed
• Ease of configuration - through management console, individual GUI, command line etc
• Remote management functionality
• Logging functionality
• Does it play well with other vendors' hardware

etc.

Answer 1

Let me state up front, that I am a partner of Palo Alto Networks as well as Check Point and Juniper. Over the years we have had a lot of success with all three manufacturers. Palo Alto Networks has built a network security device that is technically different from everything else on the market. If you clear away the marketing BS, there is no denying it. My technical explanation follows in the next paragraph. Whether you think what Palo Alto Networks does is important enough to make the switch, that's up to you.

The purpose of a firewall is to enable you to create a Positive Enforcement Model (default deny) control between two networks that have different trust levels. Traditional stateful inspection firewalls were able to this when they first appeared in the mid 1990s. They can no longer do it because of the way modern applications are written using techniques such as port sharing, port hopping, tunneling, and encryption.

To the best of my knowledge, Palo Alto Networks is the only firewall on the market that allows you to do implement a Positive Enforcement Model. Furthermore, Gartner just came out with their Firewall Magic Quadrant in late December 2011 and said the same thing.

Palo Alto's IPS functionality matches up very well with the best stand-alone IPS's in the industry according to NSS Labs, a well respected security product evaluation shop in the UK. What is interesting is that the PAN IPS functionality needs less tuning because it knows the application and applies only the relevant signatures.

WRT to UI, CLI, logging, and other "standard" firewall features, PAN is satisfactory.

Finally, Palo Alto continues to innovate with support for remote and mobile users and for analyzing files for malware in a separate (cloud-based) process that does not impact stream processing.

Answer 2

My experience with Palo Alto is limited so please take what I say with a grain of salt (and I'm sure people here can correct me as necessary)...

Palo Alto is a completely different firewall paradigm than Check Point, Juniper, or almost any other firewall. A traditional firewall defines traffic flow based on source IP, destination IP, and port (or IP protocol definition, e.g. ICMP type/code). Palo Alto defines traffic flow based on data stream content; a TCP flow over port 80 is expected to be HTTP, but it could just as easily be SSH, and in the Palo Alto world you limit connectivity based on semantic content - you'd block that SSH even though HTTP would get through to the same device. A Check Point or Juniper would let both through if port 80 was open. (Yes, I believe Check Point has limited ability to enforce on application protocol if so configured, but that is a tacked-on addition to the traditional IP protocol filtering which is the core of their product.)

The weakness of such an approach is that it hinges on the ability to classify and decode traffic, which is a non-trivial problem. Go look at any IDS' false positives for evidence of that. Also, these days, everything can be (and is) wrapped in SSL, complicating protocol analysis.

Some people think Palo Alto does a great job; some people think it isn't good enough. If you're going to do installations as part of your eval, you can make your own decision on that, I'd be hesitant making that decision for your network based on someone else's experience on their network, since it's a content (and context) sensitive device.

Someone with more experience with Palo Alto could probably draw really useful comparisons to proxy firewall and IDS/IDP products, so perhaps that should be part of your question.

Answer 3

Since this is the technical topic Im trying to give you simple and straight answers and the examples Im referring here doesn't meant to promote or insult any products ... Paloalto is like Apple laptop vs Juniper is like Linux and Cisco is like Windows Laptop. Juniper Firewall is for super users who needs more granular config and tweaks. Cisco is for Old Schooler who dont want to explore/upgrade themselves nor train their resources. Paloalto is for the New Guys (Amateur GUI guys). PAN doesnt even share the root password to the customers and if you access the device as root I think then the warranty voids :) ... I have all these firewalls so believe me when am saying these statements its out of my experience...