Palo Alto Networks Panorama Reviews

The primary use case is the centralized management of our firewalls.

It provides a quicker response time to vulnerabilities and more visibility into traffic flows.

I think it increases staff productivity.

Its automatability: You need it to automate things. We have used it for URL blocking. For example, if there is a threat out there, and we needed to immediately block a new malicious URL across a global enterprise, this is pretty difficult. With Panorama, we can automate this easily with their API. 

My pain point is the automation process is not well-documented. There are some things that they could improve on there.

If you go in the system to search for something, it is not intuitive. They could really improve that.

There is a concept of device groups and a concept of templates. The templates can allow for inheritance, but the device groups do not.

It is fairly stable. We do pretty heavy bug testing. We have a rigorous code review process that we go through for each version. Therefore, stability is on the top of our list of things that we look at. So, I haven't ran into any issues where it's flaking out altogether. 

It's fairly scalable. We probably have 12 to 16 of them spread across the globe to help with regional redundancy, because we don't want our firewall talking to Panorama across a slow land link. So, we've split them out globally, but it seems pretty scalable.

The technical support is pretty good. We do have a resident engineer from Palo Alto who sits right next to me. 

The initial setup is easy, but I have done it like a thousand times before with a bunch of other products. The product is not much different than anything else.

We outsource a lot of our boots on the ground, which is actually a lot by design. With every company, when you have two different organizations working together, there is always a little bit of tension. They don't have the same reporting structure, but everything went out smoothly. 

Typically, I'll design the solution, then I'll have somebody else implement it. This is sort of how it works for everything.

With the URL filtering, we probably went down from around four hours in response time to about five minutes.

The licensing is not cheap. There are always hidden costs. You have support costs, or maybe you need to buy more optics on how the solution fits into the rest of your environment. It is possible some of the rest of your environment will need to change too.

I think we're getting AlgoSac, which is another firewall automation tool. However, I wasn't involved with the decision for that one so I'm not too sure on the specifics, but I know we are going with them.

If you are looking at getting a Palo Alto firewall, then you should probably at least look into Panorama. Because if you start out just putting in firewalls and you don't have this, you will be kicking yourself that you didn't have this from day one. 

If you have just one firewall out there, maybe you don't need it. However, if you have two or three, then you should probably get it to be in front of a lot of the features which you will want eventually.

It is pretty solid product. Our security program is fairly immature compared to other enterprises, and this product has definitely helped us lock down things.

We have a rigorous code review process. Therefore, we are always back a bunch of versions. If the latest version came out today with new features on it, we probably wouldn't get to that for quite a while.

There are only certain things that you can do within the Panorama solution.

Panorama: Provides a central management capability for all of the firewalls. It has the ability to manage the devices in groups based on their use. We use the firewalls in two primary functions and the ability to provide management of the different groups of firewalls is very useful.

Firewalls: The application ID capabilities have been very useful for things like Active Directory, and not having to identify every port that Microsoft has decided to use.

I can’t say that it has significantly improved the functions of the organization over the firewalls that we were previously using. The addition of a good central management capability has helped improve the management of the firewalls, but the functions for the service that is provided to the users has not significantly changed.

Panorama: The ability to add scheduled jobs would be a significant improvement. Panorama has the ability to push out OS updates, but it would be nice to be able to schedule those updates so not to affect the site during normal business hours.

Firewalls:

• (1) App-ID is good, but could be better. We use off ports for some common services and App-ID does identify the application correctly, but the rule allowing the traffic does not allow the traffic without adding the ports to the rule. This negates the need for App-ID in the rule. If App-ID worked as I think it should, we would use it and then block the common port.
• (2) Integration with Microsoft Active Directory incurs significant additional traffic across the WAN circuits. We have a number of GCs across our environment and the configuration of Active Directory in the firewalls requires significant communications to all of the GCs across our environment. We were seeing the firewalls generate around 500kb of WAN traffic communicating with all of the GCs. After reviewing the configuration with Palo Alto support, the config was correct. While we do want to be able to use the User-ID functionality of the firewalls, that kind of overhead is not acceptable.

We have been using Panorama and the PAN FWs for just over one year.

So far we have not seen any issues with stability.

We have not run into any issues with scalability.

Technical support with Palo Alto has been very good and responsive.

We previously were using Cisco ASA devices. The switch was made based on central management and the NGFW functions. The timing was in the middle of Cisco delivering their NGFW functionality. The other issue that led to the move was when Cisco presented their recommended replacement for the existing devices, they recommended their Meraki line with Internet management, which was not in line with our requirements for many of our more sensitive firewalls.

Initial setup is very easy. After working with a few new installations we were able to put together a script to apply the new firewalls to setup the management access, Panorama location, high availability (HA) configuration and the initial IP stack. This makes it easy to start the OS updates and initial rules from Panorama. By having the HA setup scripted, it also makes the OS updates a single download instead of a download for each device. The HA connection allows the firewalls to copy the OS over to the other firewall with the single download. That is important because there are several large downloads necessary to update the OS to the current OS levels.

Pricing is high compared to other vendors in the same space. Licensing is also fairly high for different functions to be added on, like Intrusion detection/prevention, user VPN, URL filtering. Some firewall vendors offer the “additional” licensing/functions as part of their license for the device and then others offer it like Palo Alto.

The original decision was made by a different group within the company. The re-evaluation included Cisco ASA, Cisco Meraki, Fortinet and Palo Alto.

Talk to other customers. Start with the ones recommended by the vendor, but also in forums as well. Everyone understands that recommended customers are handpicked and forums can be contain spurned customers. But if you look for information regarding specific functions that you need, you can find more useful information. Make sure if you hear something glowing from a vendor recommended customer about a function, check on that function online.

We use the solution for centralized monitoring. 

Clients need to have an alarm and alert system from which they can forward the trigger. The product needs to improve its integration as well. 

I have been working with the tool for seven years. 

I would rate the product's stability a seven out of ten. 

The product is scalable. 

The product's support needs to improve. 

The product's deployment was simple. 

The product's pricing is high but flexible. It now follows the pay-per-use pricing model. I would rate the tool's pricing a five out of ten. 

I would rate the product a seven out of ten. 

We use Palo Alto Networks Panorama to monitor and have centralized control.

The most valuable features of Palo Alto Networks Panorama are centralized management. We can manage all our firewalls.

Palo Alto Networks Panorama could improve by making the solution less expensive.

I have been using Palo Alto Networks Panorama for one year.

Palo Alto Networks Panorama is a stable solution.

I have found Palo Alto Networks Panorama to be scalable and it is easy.

We have two engineers that use the solution.

I have previously used Fortinet FortiGate, but we found Palo Alto Networks Panorama had a lot more features and this is why we switched.

The initial setup of Palo Alto Networks Panorama was simple. The time of the implementation depends on the environment.

We used an integrator for the implementation of Palo Alto Networks Panorama.

The price of Palo Alto Networks Panorama could be lower.

I rate Palo Alto Networks Panorama an eight out of ten.

We are dealing with Palo Alto Networks as a firewall.

Panorama provides management functionalities.

Integration between Panorama and the Edge Firewall has a lot of issues, like different configuration assets, configuration object templates, lack of flexibility, and not a good browser. It needs improvement in saving and synchronization.

We have been dealing with Panorama for one year.

There is no issue about performance. However, keeping the communication between Panorama and the Edge Firewall is a big issue if there is a different configuration version between both Panorama and Firewall.

We are not working over a complex network, but Panorama manages about six to eight firewalls. We may face a lot of issues when scaling up.

The first layer of support is not very good. The second layer is better.

Neutral

We switched from a different solution.

Panorama has a lot of issues accessing and configuring the firewall or deploying the firewall from Panorama. I'd rate the solution five out of ten.