Palo Alto Networks URL Filtering with PAN-DB Reviews

We have moved to Palo Alto Networks URL Filtering with PAN-DB.

I still work with Palo Alto Networks URL Filtering with PAN-DB for Asia Petroleum Limited.

I am speaking about Palo Alto Networks URL Filtering with PAN-DB VM-Series firewall.

We are using Palo Alto Networks URL Filtering with PAN-DB as a full guard advanced wildfire URL filtering, DP, with DNS security.

PanDB is what I use for URL filtering.

For Palo Alto Networks URL Filtering with PAN-DB, we are normally using Office 365 exchange services and SharePoint, so user access from laptops, and we are using a DVP PanDB private cloud for accessing Office 365 applications.

When it comes to Palo Alto Networks URL Filtering with PAN-DB, it has totally changed compared to Sophos. This is very advanced compared to Sophos. The options, especially in the OS of Palo Alto, are very stable.

The best advantages of Palo Alto Networks URL Filtering with PAN-DB compared to Sophos are that URL filtering is very advanced. All the functions of content filtering are content-based and connect with App ID. This is a very useful tool compared to Sophos. The main feature is the App ID, and basic filtering works based on App ID. Every application is assigned an App ID, and all filtering is done through that ID.

I think URL filtering could be better to some extent.

Improvements could be made in Palo Alto Networks URL Filtering with PAN-DB compared to Sophos. The URL filtering option in Palo Alto gives a very clear vision of the network and the applications using URL filtering. If you assign a user in a group not to access certain URLs, that user should only be allowed to access LinkedIn without running videos. However, deep URL filtering in Palo Alto is not configurable. One user can have access to LinkedIn with video running, while another cannot. They should improve this deep analysis of URL filtering options.

We have been using URL filtering with PanDB for three months, as our license for Sophos expired recently.

The installation of Palo Alto Networks URL Filtering with PAN-DB is quite difficult compared to others. It is not very user-friendly because the options are very typical to configure. First, we install it with the support of the vendor, then we try to configure it ourselves, but it's not familiar and not easy to configure. There are too many options, and it takes a lot of time. If you don't read through the internet, you cannot configure it because the option names are very different from what you're used to.

Palo Alto Networks URL Filtering with PAN-DB is stable, and I haven't seen glitches. It is the number one product in the Gartner report. Forrester also says Palo Alto is a leader in 2024.

Palo Alto Networks URL Filtering with PAN-DB is very scalable, and we also monitor it ourselves. If we need any support, we open a ticket on Prisma and resolve the issues.

Technical support from Palo Alto is very good.

I would rate the support as a three out of ten.

I would rate support from Palo Alto Networks URL Filtering with PAN-DB around nine.

Positive

We installed with a vendor as we are not a very big network. It is a small network of a total of 150 users. We only run internal applications in our network, using Office 365 cloud, not any critical applications using the cloud.

I think Palo Alto Networks URL Filtering with PAN-DB is too costly compared to others.

Regarding real-time analysis with Palo Alto Networks URL Filtering with PAN-DB, it's also good compared to Fortinet and Palo Alto. We are starting to not use it for a long time, but if you use Prisma Access in the cloud, you can check all the application filtering data and have a clear bird's-eye view of your network through Prisma Access.

Currently, we do not need maintenance for Palo Alto Networks URL Filtering with PAN-DB, but we plan to in the future.

Regarding AI features, I have seen some advanced AI integration with Palo Alto Networks URL Filtering with PAN-DB. If you configure it not on your own and try to configure via AI, you can create a rule. The AI function, called AI ops, is very advanced. I am not currently using it, but I attended a seminar where I learned about AI features in Palo Alto. Even if you are not capable of configuring the firewall on your own, it's possible to do it via AI. You simply ask them to create rules, and they create them for you while also providing step-by-step configuration notes in PDF format. This is very advanced.

I would rate Palo Alto Networks URL Filtering with PAN-DB a perfect 10 out of 10.

We previously discussed Palo Alto Networks WildFire, and we are currently using it for our firewalls with the WildFire subscription included.

We have micro-segmentation using the VMware environment with the VM series deployed in multiple locations, including cloud environments.

On the cloud, we are not using Palo Alto Networks AutoFocus for threat intelligence management or Prisma Access. Apart from WildFire, we have Palo Alto Networks URL Filtering with PAN-DB and other licenses from Palo Alto Networks.

We are using Palo Alto Networks URL Filtering with PAN-DB for our perimeter security as a perimeter firewall.

The most beneficial features of this product for us are easy management and migration into new generation features such as app IDs, which we find very useful.

Real-time analysis is excellent, and the integration of the solution with our infrastructure is straightforward and less challenging.

Management and maintenance are not problematic for us as we have great local support and don't need to put in much effort.

The drawback we see compared to FortiGate, which we use as an internal firewall in the data center, is the clustering behavior that has a different approach.

From Panorama, the management perspective on daily operations, FortiGate has a different method of policy pushing and other functionalities.

It would be beneficial to have support for geographically dispersed clustering, especially when having multiple data centers and wanting to migrate, enabling one firewall in one data center and another firewall in another data center in an active-active approach.

We have been using it for the last 7 years.

The product is stable in general; we haven't experienced many glitches or latency.

We haven't faced any limitations on scalability and have scaled up without any issues. With Panorama, scalability is not a concern.

Technical support from Palo Alto Networks rates seven out of ten points. It could be better due to local resource shortage. Support quality improves with escalation and is incident severity based.

Installation and deployment are very straightforward as we have performed them multiple times. Installation, migration, and other processes are simple due to our repeated experience.

The licensing costs and setup costs are very expensive for us. The price is significantly higher compared to other competitive products.

When comparing competitors such as FortiNet, the main difference with Palo Alto Networks is primarily in pricing, which is considerably higher for us.

Palo Alto Networks has a wide variety of products suitable for small and enterprise clients, depending on which model you select. This review provides a rating of 8 out of 10 for Palo Alto Networks URL Filtering with PAN-DB.

Neutral

I usually just deploy the firewall. I use URL filtering with PAN-DB, and it is category-based filtering. As long as I have a PAN-DB license, I get regular updates from Palo Alto, which allows me to perform filtering using wildcard URLs and category bases. I also deal with Palo Alto DLP or URL filtering.

The URL categories are updated by Palo Alto Networks itself. I do not have to use additional security solutions to block the URLs, as PAN-DB and URL filtering are both powerful tools when it comes to security. They work based on categories and wildcards.

I am a fan of Palo Alto Networks and do not notice many negative aspects. However, Palo Alto should not be expected to behave exactly like Zscaler since they have other functionalities, like firewall inspections and routing. Some software management-wise scalability features need improvement.

I have been using Palo Alto solutions since 2017. It has been over seven years now.

There are no issues with URL filtering. Sometimes the management plane shows slowness, however, it does not impact the data plane, preventing operational impact. For me, it is typically stable but might require adjustments in a virtualized environment.

There are no significant scalability issues experienced for URL filtering. However, management-wise to ensure smooth monitoring and management, especially in scenarios using SSH in cloud environments, improvements can help further.

Customer service is sometimes inconsistent. Some engineers are very knowledgeable, while others cannot answer questions and delay solutions.

Neutral

Setting up URL filtering is not complex. I follow best practices to block category-based URLs complemented by custom URLs that need to be whitelisted or blacklisted upon user request.

A colleague recommends FortiGate, a solution I have not personally used.

I always recommend Palo Alto Networks for firewall solutions. For overall URL filtering, I would rate it seven out of ten.

It provides visibility and control over where people are web browsing and protects them from going to malicious sites.

It’s a bit of a mixed bag. Occasionally, something might get categorized incorrectly, but their categorizations are generally accurate.

The main issue arises when categories are divided. For instance, if a single category is split into two for more detailed control, it requires advanced notification and communication. This is important because users must update their security policies and configurations to accommodate the new categories.

It is continuously updated and integrates with WildFire, which analyzes and detects new malware. When WildFire identifies a new piece of malware interacting with various domains, it updates PAN-DB to label those domains as malicious. This update is then distributed to all firewalls using URL filtering, ensuring real-time protection.

The main limitation is that it needs a live Internet connection for ongoing updates. URL filtering may not be necessary without Internet connectivity, as you wouldn't be accessing URLs. It's important to note that URL filtering itself doesn't require a separate license. The license you purchase grants access to the URL database and category mappings. If you're comfortable creating and managing your categories, you can use URL filtering without a subscription.

Many of the employees, particularly in first-tier customer support, lack experience. This often results in repetitive questions and strict adherence, even if you have completed several steps.

The biggest differentiator is its integration with WildFire. When a Palo Alto user worldwide submits a new file to the sandbox for evaluation, antivirus signatures, and URL database entries are automatically generated and propagated if the file is found malicious. While competitors aim to achieve similar results, they have not yet reached the same execution level as Palo Alto.

I have been using Palo Alto Networks URL Filtering with PAN-DB since 2009.

They're quite stable. Stability has never really been an issue.

Each Palo Alto firewall performs its lookup independently, which makes the system entirely scalable. As you add more firewalls, each one handles its processing. You might experience some reduction in internet performance if you have minimal bandwidth, but most users today have more than adequate connections to avoid such issues.

URL filtering on Palo Alto devices is relatively straightforward to configure, especially if you want to customize categories. In comparison, setting up on the Fortinet platform can be a bit more complex. Many people find that even if Fortinet offers 80% of the functionality of Palo Alto, they often don’t use 100% of Palo Alto’s features anyway. If they can achieve 80% of the capabilities at 60% of the cost, and the differences in functionality are in areas less critical to their operations, they are increasingly considering switching to the Fortinet platform despite the additional learning curve and overhead.

The initial setup is easy. Just a few clicks are enough. It only takes one person.

Pricing is ridiculous. They've been jacking the prices up at a rate that they're actually starting to lose business because they're just too expensive.

I rate the product’s pricing a nine out of ten, where one is cheap and ten is expensive.

Overall, I rate the solution an eight or nine out of ten.

Our company is based in Sacramento. This solution is generally used for enforcing HR policy for enterprise. In our case, most of the clients are state government institutions. Palo Alto ensures that no hate speech or anarchy websites, for example, get through. We also implement this product. If somebody takes our recommendation and buys the product, they can trust that it's good because we're not partners with Palo Alto, we're recommending it because it's a good product. I trust PAN.

It lets us know that our Human Resources policies regarding the categories of Internet sites that are off-limits using the company's resources are strictly enforced without a ton of manual administrative overhead.

What I really like about PAN and what makes it a worthwhile solution is that rather than having an administrator constantly updating a list of prohibited URLs, you can do it by categories. Every one of these URLs gets meta-tagged as hate speech or antisemitic or pornography, or whatever it is, and when you set up the filter everything that's prohibited by HR policy is there. I don't have to maintain anything, it catches everything. 

One of the less favorite features is the cost of the solution. For example, ~5K for a PA-820 AND ~$1K EACH *per year* for Premium Support, Threat Prevention, and PANDB URL filtering. We also implement other solutions. We tell customers that if they want to have the best possible perimeter security, they're going to have to pay for it. Some smaller entities don't have the budget for it, so we'll suggest Fortinet or something that has similar but inferior capabilities, but is less expensive.

I've been using this solution for three years. 

PAN has really good stability, overall. If you subscribe to their support email list you get alerts from them three or four times a week with updates or notifications about bugs. They're on top of it. If I discover a problem they're usually already onto it with a recommendation for a micro upgrade. And then there's the URL filtering - I've never seen an issue that was attributed to it that didn't turn out to be a different root cause or the web site was so new that it hadn't yet been categorized in PAN's URL DB.

PAN hardware and virtual appliances can scale from a few Mbps to tens of Gbps with full Deep Packet Inspection (DPI) and App ID application layer gateway protection. They've got everything from the "baby" PA-220 at 270 Mbps Threat Prevention up to the king-sized PA-7080 at 342 Gbps (yes, you read that right) Threat Prevention.

Technical support is okay but I'd like them to adopt a model similar to Cisco with their CCIEs, so that if you have their expert certification, you have access to a different support queue. If something happens and the solution is down, or you're troubleshooting and the CTO can't get to something, there's a lot of pressure and you'd like to be able to get support quickly. Once you do get there, they're fine and onto it. 

Yes, Cisco ASA and ASA-X used to be "gold standard." However, they've never really caught up with the single pass architecture and advanced, in-line threat hunting throughput of PAN's truly Next-Generation Firewall platforms. I've used ASA-X with FirePOWER (fka Snort) at other clients and it's cumbersome and high administrative overhead compared to PAN solutions.

The initial setup is a little complex. There's the option of setting up with a monitor mode and specifying the categories you want to restrict, without actually blocking anything.

We implemented this in-house as it's important to our business model to have hands-on "stick time" with anything we recommend.

Licensing costs are quite expensive but my impression from our executive clients has been a focus on quality, and they generally go for PAN. 

I work with Cisco as well as Palo Alto, and I think Palo Alto does things well. For us, it's about having the best solution, knowing that I can get hold of somebody when I need some help and will the solution break the bank. Cisco's ASA has never really done a great job of fully integrating Firepower. You can write custom signatures but most people aren't ready to do that. PAN is constantly pushing updates and you can set the system to auto download. If you're uncomfortable with constantly adding modules of your software on an auto subscription basis, you can audit each one. And that's all configurable too. You can download updates once you've looked at them or put it on auto mode. 

The web is going towards everything HTTPS which means you can't see inside it anymore. PAN does the SSL decryption about as painlessly as it can be done. There's still a lot of unique use cases with the chain of trust and there's a balancing act as to what should be blocked. Our executive clients want to know what's going on but since everything's encrypted, you have to figure out how it works and how aggressive you want to get about it. 

I rate this solution a nine (9) out of ten (10). 

My primary use case is to ensure there's no need for a separate IDS or IPS solution.

The most valuable feature is that the product can do everything in a single device, including the firewall, rules, and the PBL. It also has good routing and switching.

An area for improvement would be the technical support, which can be slow.

I've been working with this solution for over five years.

This solution has pretty good stability.

The scalability of this solution is pretty good.

The support team is pretty quick when you first open a case but can be difficult to contact later on.

The initial setup was pretty simple.

This product is more expensive, but that's because it provides everything.

I would rate this solution as eight out of ten.

We have a few servers in DMC that are not going to go through proxy, but at the same time, they are trying to connect to the internet to download some updates from repo. So, anything that is not a red-hat-related repo or Apache-related repo is blocked, and we have a specific repository. This is when we have been trying to use a URL filter.

Palo Alto Networks URL Filtering with PAN-DB is easy to use, easy to operate, and easy to edit. When we want to analyze data, we can download it as a CSV file and just go through with Excel rather than using a complex dashboard.

I have never had any challenges so far that I couldn't figure out myself. Also, when it comes to documentation, Palo Alto is pretty good.

We have been trying make Palo Alto Networks URL Filtering with PAN-DB work with ELK stack. We have had some challenges with that because we are getting limited SNMP. It would be good if it worked better with ELK stack.

I'm only able to do it faster when I log into the device and not through Panorama.

We have been dealing with it for the last three months.

The stability is very much better.

The scalability is much better with Palo Alto Networks URL Filtering with PAN-DB.

The initial setup is quite simple.

It is more expensive than ASA but is far cheaper than Checkpoint. So, pricing wise, it is right in the middle.

I would rate this solution at eight on a scale from one to ten.

We use the solution to filter URLs.

The tool blocks URLs.

Support needs to be enhanced.

I have been using Palo Alto Networks URL Filtering with PAN-DB as a partner for six to seven years.

The solution is scalable but limited by the firewall's throughput. The URL filtering can scale effectively to meet the demands of the network, provided that the PAN-DB service is configured correctly and maintained.

Negative

The solution is pretty simple to set up. Configuring PAN-DB with a firewall can involve more than other vendors, especially for single-site deployment. Depending on the project's scope and desired features, it could take one person around two to three days

The solution is based on a subscription for the firewall. The subscriptions and the hardware have more than quadrupled in the last three years. They are pricing themselves out of the K-12 markets.

PAN-DB allows you to set it to auto-update on a schedule. It categorizes newly created sites and recognized sites. If a site becomes infected, it can be moved to another category. This helps block harmful sites and effectively manage new sites. Regular auto-updates are essential for maintaining its effectiveness.

With PAN-DB, it's more about user identification for filtering based on user categories. In K-12 environments where Chromebooks are prevalent, obtaining user IDs from Chromebooks for firewall purposes is challenging. Therefore, setting URL filters based on student names or groups they belong to can be difficult when using Chromebooks

In most cases, organizations maintain their Palo Alto Networks URL Filtering with PAN-DB themselves. Schools are responsible for managing them. Our role is more like a support tier. If they encounter issues, we assist them and collaborate with our Palo Alto representatives to create and escalate tickets for resolution with the Palo Alto Networks team. Typically, it requires just one person to maintain the solution.

You can go to the Palo Alto Networks URL Filtering site and request a site to be recategorized. I have not seen a whole lot of false positives.

Overall, I rate the solution a nine out of ten.

We require a firewall to deploy URL filtering or to enforce this URL filtering solution to our users. It is actually cloud-based, deployed on a cloud, and is URL Filtering as a service, which requires a firewall. The firewall, therefore, will then enforce the URL filtering options on my users' traffic.

We are using this for preventing the user's access to malicious websites, or access to inappropriate adult websites or porn websites or even the P2P tunnels or tunnels or domains they should not access. This is our main priority and main use case.

The URL filtering is excellent. It ensures our users can't access certain sites. 

The multiple categorizations of URLs are quite helpful. For example, if a URL is, a social media website, such as facebook.com, it can be classified at a certain risk level - from high to low.  

The solution offers credential phishing, which is a helpful feature. 

The initial setup is easy.

The solution scales well, according to the firewall.

The stability is very good.

Everything that is available with the firewall is provided to the user.

It would be ideal if this solution could be a separate product rather than have to have it deploy through a firewall. If it was a separate product, many of our customers would be happier as most just require a URL filtering option. They do not require a firewall. They do not require any threat prevention or anything. 

If it was a separate product, we could deploy it to branch offices or any of our customer locations in which different firewalls are being used. 

The solution is a bit expensive.

We've been using the solution for more than three years at this point.

The stability is excellent. We've never had to raise any technical issues. There have been no bugs or glitches. It doesn't crash or freeze. 

The scalability depends on the firewall. The URL Filtering does not have any limitations. For example, any number of firewalls is supported. It is not dependent on that. It is just dependent on the firewall. Therefore, if a firewall supports 1,000 users, then it will provide support for protection for 1,000 users as well.

We have 700 users on the solution currently.

We do not plan to increase usage at this time.

We have never had a technical call raised to customer care or the tech team or anyone to resolve the URL Filtering issues. It's been so reliable we haven't really dealt so much with technical support. Any local issues have been small and have been handled by our internal team.

The initial setup is not complex. It's easy and pretty straightforward. There are no configuration options. You use it as it is. A company shouldn't have any issues with it. 

We pay a yearly licensing fee.

It's a bit expensive if I were to rate it from one to five, with one being the cheapest, I'd rate it at a four. That said, I would argue that it is worth the price.

We're Palo Alto partners.

There isn't an exact version number associated with the product. It's a SaaS.

I'd recommend the solution to other users and companies.

I'd rate the product at a ten out of ten.