Palo Alto Networks VM-Series Reviews

Ours is an enterprise environment and some of the services are hosted in our private data centers and some of the servers are hosted on Azure. We have the IPSec tunnels from the firewalls to our own data centers and from the firewall to the cloud as well. It depends on the type of application being hosted.

We are using Panorama for centralized management of all our firewalls around the world, as well as for centralized management of security policies and network settings. We have not completely migrated to the cloud. We are in transit.

Palo Alto has many features for troubleshooting real-time scenarios. The troubleshooting, compared to other firewalls has been optimized in a way that saves a lot of time.

I like the UI. Most things are accessible from the user interface and it is quite user-friendly. With respect to both VM-based firewalls and physical firewalls, it's easy to create updates.

They have a centralized Palo Alto Customer Support Portal and if we require any licenses, such as a next-generation firewall license, we can easily download and integrate them with this solution. We can also schedule periodic updates. That is quite user-friendly.

In terms of functionality, we are using IPSec tunneling and Palo Alto's WildFire feature. We use the security policies, Panorama, and Prisma Cloud as well.

We use Panorama to manage our security policy model across on-prem and public cloud environments. It plays a key role with respect to centralized management, for physical enterprise firewalls and cloud-based firewalls. It gives you centralized control over all the infrastructure. Unified policies can be pushed from that centralized place with templates.

When you deploy VM-Series Firewalls, they are quite flexible. You just have to select the instances, storage, security policies, and firewall rules. Within minutes, you can deploy the firewalls.

We are also able to adjust firewall sizing on the fly, which is important. Initially, we decided on a firewall based on the throughput assumptions. But in peak hours or during a peak month for traffic, we need to scale the firewalls. That should be automatically done. AWS and Azure provide very good features and, by using them, within a second it automatically scales, based on the incoming traffic.

Palo Alto has launched different products, such as physical firewalls as well as cloud and VM-based firewalls. Recently, they introduced their Prisma Cloud solution. Compared to the previous technologies, like Panorama, which is used for centralized firewall management, or even individual firewalls, it's a bit challenging to integrate the traditional firewall policies into Prisma Cloud. And the Prisma Cloud interface isn't very user-friendly. 

Our organization has been using Palo Alto Networks VM-Series for more than five years, and I have worked on this solution for two years.

The solution is certainly stable. I have worked with many vendors' firewalls and Palo Alto's are definitely stable.

Obviously, it is scalable as long as you have the licenses and support with Palo Alto. You can implement the firewalls in high-availability mode or use the cloud functionality as well. For scalability, Palo Alto is optimized.

We have 30-plus sites around the world with more than 4,000 users.

Palo Alto has very good support. When you have a valid license, they can replace a device with a new one. They have the CSP portal and you can log in and see all the firewalls listed. You can raise TAC cases with a priority of low, medium, or high, and, based on the priority, they will send an email to you. They have live support as well. In case of an issue, you can call them directly and they will provide the required support.

Positive

Earlier, we were using many vendors' firewalls, per their suitability for our clients. Apart from Palo Alto, we were using Cisco ASA, Check Point, and Juniper. The network grew over the years and each site had its own set of firewalls. The issue was that we had to standardize things across the network. There was also a gradual change in the technology and features available. Our security team thought we needed a better implementation, for optimization and troubleshooting, and something that was friendly for daily operations.

We have both private cloud and hybrid. Some of the services are on the cloud and some are on-prem in our data center. Setting up Palo Alto firewalls is quite easy compared to other vendors.

Migrating our old infrastructure to Palo Alto took four to six months. 

We did some pilot project testing with Palo Alto. If, for example, we want to migrate from XYZ vendor to Palo Alto, the very first thing we had to do was capture all the existing security and NAC policies and all the NGFW functionality. Palo Alto has specific features. For example, you can capture the logs in an inline environment, such as what traffic is going to the network, what security policies are there, et cetera. We deployed the Palo Alto firewalls in that way to only capture the traffic. We then analyzed the traffic, and we worked with Palo Alto TAC to understand the security policies and the exact throughput to determine the hardware we were going to use. We monitored all of that for a few months and then we started the migration from other vendors to Palo Alto.

We had 10 engineers involved in the deployment, but each on-site location had its own team as well. Three were senior network architects and the other seven were staff network engineers.

If you want to keep up to date in the network, it requires quite a bit of patching. It has many features, like Unified Threat Management and antivirus that can be auto-updated by scheduling an update for them. But the major patching has to be done manually. In our organization, we do it quarterly.

It is worth the cost.

Palo Alto Networks VM-Series is notably cheaper than other firewall vendors, except Fortigate. Fortigate is number one in terms of pricing.

Our security team tested various firewalls and it came down to FortiGate and Palo Alto and they found Palo Alto was quite suitable for the network.

Everything is moving to the cloud and we need a solution that can support all the multi-vendor platforms and the new technologies as well. That is quite important for any enterprise organization or service provider nowadays. If we talk about moving existing loads from our own data centers or enterprise sites to the cloud, we need a solution that can take care of everything, such as security compliance, and that is easy to use. Palo Alto is good in those terms.

With the introduction of Prisma Cloud, Palo Alto is encouraging clients to migrate their infrastructure, such as VPN and security solutions to Prisma Cloud. It has been highly optimized compared to Panorama. Palo Alto is promoting it and asking their clients to use Prisma Cloud to improve their security infrastructure.

I would advise, when you deploy a new site, to manage it from the centralized Panorama solution. With Panorama, you have a local login, so even if the internet is down you have access to the firewall management.

We had a situation, when performing patching, where the firewall lost the remote connection via the internet and it had not been onboarded to Panorama. That mean we lost connectivity and we had to involve the onsite technicians. To avoid that scenario, all firewalls should be centrally managed by Panorama.

And for troubleshooting, each firewall should have syslog profiles activated.

The primary use case for the Palo Alto Networks VM-Series is real-time inspection for vendor security.

We have been using Palo Alto Networks VM-Series for three years.

I rate the stability a ten out of ten.

The product has good scalability. We have small to enterprise businesses as our clients for it.

As per premium support licenses, we received 24/7 support services. Apart from that, they join the calls quickly to resolve the issues for distributors' performance.

Positive

The initial setup is easy. We managed and configured it with the help of existing management tools and courses. We deployed it on the cloud and on-premises.

The deployment time depends on specific business requirements and bandwidth. It takes around one to two weeks to migrate and configure for large organizations. For small organizations, it takes one or two days to complete.

The product is costly but provides all essential security features. I rate the pricing a seven out of ten.

VM-Series enhances the security of our virtualized infrastructure. It ensures that every interaction, pre and post-loan processing, undergoes a thorough inspection, leveraging VPN features and comprehensive security protocols. It reviews the data for encryption and decryption before sending it to the server.

By applying Palo Alto's robust security measures, we enhanced the overall security posture of the cloud development process. Generally, it is challenging to scale hardware while increasing the bandwidth. When it comes to VM-Series, it is more scalable than other firewalls.

Certainly, the prevention capabilities can have an impact on bandwidth. Without the imposition of security profiles, the bandwidth can operate at its full capacity, reaching up to 100 Gbps. However, upon introducing security profiles, there may be a slight decrease in bandwidth due to the utilization of a software control plan and software data plan. The data plan involves a parallel processing mechanism, incorporating multi-scan and multi-action functions. While this may introduce a minimal latency, it efficiently prevents threats with lesser bandwidth. The operation efficiency is enhanced after the deployed VM-Series. We can easily fetch all licensing details, including serial numbers.

I rate it a nine out of ten.

We use this product to secure our entire network, for ZTNA structure, and for VPN purposes, allowing access to our servers behind the firewall.

Using this product has increased our security and has given us much better results in terms of security scans.

Palo Alto embeds machine learning into the core of the firewall to provide online real-time attack prevention, and I would rate that capability an 8 out of 10. It's definitely effective in terms of securing our network against threats that are able to evolve and morph rapidly.

This solution provides a unified platform that natively integrates all of the security capabilities, although we are not using parts of it. For example, we don't use the configuration tools like Panorama.

The most valuable feature is the CLI.

We have the firewall configured for zero-day signatures, which is very important to us. We must be HIPAA and PCI compliant, which means that we need those signatures immediately.

There is no noticeable trade-off between security and network performance. In fact, so far, we've not seen any negative network performance with it. We're very impressed in that regard.

The web interface is still slow, even after recent improvements. 

I have been working with the Palo Alto Networks VM-Series for three years.

This product is very stable. We have had zero problems with stability.

The scalability is fantastic. We're using the lowest-end product right now, and I don't foresee when we'll have to upgrade. We've got a long way where we can continue to scale up.

We currently have multiple people that use it for VPN purposes, to access our servers behind the firewall. It is not used nearly as extensively as it should be. However, next year, we're going to start flowing all of our internet traffic through it.

We're all working remotely, and we're going to be connecting through the firewall. This means that our traffic is going to greatly increase, meaning that our usage will also increase. We'll also be using many more of the features.

The technical support from Palo Alto is good, overall. However, their response times could be a little quicker.

We have not really had any big complaints with the technical support and I would rate them a seven out of ten.

Neutral

Prior to using Palo Alto, we were using an on-premises solution by Juniper. When we switched from onsite to the cloud, we changed products.

We made the switch because Juniper became unbearable regarding complexity and performance. It was getting very bad; we couldn't manage it well, and the performance was quite poor. 

The initial setup is quite complex. There is a steep learning curve and we failed at it a couple of times.

Our final deployment took between three and four hours.

Our in-house team was responsible for the deployment.

We have absolutely seen a return on our investment. We are definitely more secure. With the features that are in Palo Alto, we do not have to worry about people busting into our network. Even just out of the box, with the base features, it's really solid. The default configurations are very secure.

Our return on investment comes from the fact that we're not having to spend hours monitoring stuff the way we did before. We've saved man hours and we've saved stress. I can't put a monetary value to that, but that would be the return.

This is not the cheapest firewall but it's not the most expensive of the options on the market.

There's a new licensing structure coming in that we're really trying to understand, so I would suggest studying up on it. I recommend getting a partner involved for purchasing the product.

Beyond Palo Alto, we evaluated two or three other products. Two of them that I can recall are Fortinet and the Microsoft Azure Firewall.

We did some extensive reviews and some extensive testing and what we found is that for the price, Palo Alto gave us the best options. It had the best set of security features. It wasn't the cheapest product but it was the best solution that fit our requirements.

We have not yet implemented the DNS security features. However, we will likely be doing so next year.

If one of my colleagues at another company were to say that they were just looking for the cheapest and fastest firewall, I would suggest that they be careful. Palo Alto has a great balance. It's not super expensive compared to other options on the market, and it's quite quick when it comes to throughput and performance.

In summary, this is a good product but I do suggest that people shop around a little bit.

I would rate this solution an eight out of ten.

We use the solution for network protection. Previously, I worked for a physical organization, but last year we moved to a Proof of Concept. Following the POC, we had to deploy the solution in three different geographical locations. We deployed all of the Palo Alto solutions in the hub environment and connected them to another node.

VM-Series allows us to maintain consistent next-generation firewall protection across virtual, private, and public cloud infrastructures using a unified policy model. We can use the provided templates to generate policies based on both global and local rules.

Panorama plays a vital role in allowing us to maintain a consistent security policy model across on-premises and various public cloud environments. Presently, we utilize Panorama exclusively in the cloud, spanning three different geographical locations: East Asia, Eastern U.S., and Western Europe.

Once we were able to configure Panorama's centralized management system we were able to have uninterrupted connections with no security issues.

Using Panorama helped us streamline our security policies in a cloud-based environment, saving us time. With Panorama, we no longer need to log in and manually adjust the template before transferring data, which increased our comfort level.

Palo Alto Networks VM-Series' security features are all good.

Centralized management is valuable because it allows us to configure settings in one location and apply them across all three locations.

The migration of workloads to the cloud is difficult because the cloud provider and Palo Alto Networks are different platforms. We had to research many articles online and after our research and development were completed we were able to deploy. The migration of data to the cloud can be more user-friendly and has room for improvement.

The utilization monitoring and GUI have room for improvement.

Sometimes we encounter licensing issues where our licenses are not activated, and as a result, we are required to redeploy. This problem could be related to VM-Series or the template image and how they are integrated with Azure Marketplace.

I have been using the solution for one year.

The solution is stable.

The technical support is good.

Positive

Previously, we utilized Azure Firewall, but we found it to be less mature compared to Palo Alto, prompting us to switch to the latter.

The initial setup is straightforward but the deployment portion is complex. We require 15 minutes for one VM deployment.

I give the solution a nine out of ten.

We are using the solution for IDS, IPS, and security.

We need a perimeter firewall to expose anything on the internet. Our inbound and outbound traffic is controlled via Palo Alto. It has multiple features. We have Palo Alto in every location and have a central console where we control all the firewalls.

IDS, IPS, web filtering, and URL filtering are valuable features. Palo Alto is a good product. We have become a major reseller of the product. The tool is beneficial to us. The solution strengthens our IT posture.

The solution must improve Zero Trust integration and use cases. The Zero Trust solution has limitations.

I have been using the solution for four years.

The stability is good. The vendor communicates about the releases in advance. We keep updating the operating systems based on compliance and security notifications.

Scalability might be an issue for large organizations. The throughput is a challenge. Multiple segregations need to be done. More than 40 customers are using the solution. We don't face challenges in deployment and maintenance.

The support is responsive.

The setup is not complex, but it is not simple. We get everything from Microsoft Marketplace. We buy the license outside Microsoft Marketplace because it is more cost-effective. All our VMs are deployed on the cloud.

The license fee is slightly high. We must choose the right licensing.

Palo Alto’s compatibility and integrations are better than Juniper's. Zscalrer’s Zero Trust solution is better than Palo Alto’s. We recommend Palo Alto over Fortinet, Juniper, or Check Point. Palo Alto is less complicated.

Palo Alto is a straightforward solution. The solution does not have any negative impacts on our organization. Overall, I rate the product a nine or nine and a half out of ten.

We use Palo Alto Networks VM-Series primarily for security purposes. It helps us with URL filtering, domain blocking, threat analysis, and detecting vulnerabilities.

We can monitor the traffic manually and detect threats. Additionally, we can block different IP addresses and URLs.

There could be dynamic DNS features similar to Fortinet in the product.

We have been using Palo Alto Networks VM-Series for six years.

I rate the product's stability a nine out of ten.

I rate the product's stability a seven out of ten. It could be better. We have four users for it at the moment. We plan to increase the number of devices.

We receive technical support from a local partner rather than directly from the vendor. The support team requires more training.

Positive

We have used Cisco Adaptive Security Appliance (ASA) before. Compared to Palo Alto, Cisco devices are not feasible regarding hardware. They are very slow and complicated to find the granular level of results. Sometimes, even a technical expert is unable to fetch a proper report.

I rate the initial setup process an eight out of ten. It takes eight hours to complete and requires one security engineer to execute the process. The deployment involves setting up security policies. The on-premise installation is simple. However, VM installation is complicated in terms of the network interface.

It is an expensive product. I rate the pricing an eight out of ten. We purchased a three-year license for it.

I rate Palo Alto Networks VM-Series an eight out of ten.

Azure Firewall is a cloud-native solution. It's only for netting and simple source-destination blocking. The client wanted everything, so they wanted us to implement a third-party solution. Palo Alto was the leading solution. It's easy to install. 

Palo Alto is dynamic regarding protocol rules, and it is classless. The client also wanted a third-party solution between their on-premise environment and Azure, so they went for Palo Alto. Palo Alto VM-Series is deployed on the Azure Cloud.

We previously had a hardware solution. With VM-Series, you don't need to purchase the hardware. You can deploy it in the cloud, or they have a PaaS, SaaS, and IaaS version. You connect your network to their cloud and get the traffic filtered. 

The most valuable feature is the proxy write. It's called the Write Fill process. It's in a bundle of everything. Palo Alto has everything, including CAD management, malware protection, and a file management system. There is a bundle of packages. This is not in the latest edition of Azure Firewall.

The VM-Series reports how much bandwidth a particular IP is using. You don't need to regularly log into a website, like a Cisco command, to see what kind of ACL it's getting. There isn't an ACL use portal event. You can go there and see how much my ACL has been getting me.

It automatically tells what rules are in place, like scheduled and additional rules. You don't need to create new rules every time. It will automatically tell you that this rule exists. 

Palo Alto's next-generation firewall is classless, and it's a bundle of everything, including malware management, bandwidth utilization, and how much each IP is costing you. It offers bandwidth utilization, DDoS protection, a next-generation firewall, and everything I need in one bundle.

You can integrate fully automated virtual firewall deployments and provisioning into existing DevOps workflows if you are a good developer. Palo Alto offers help for it, but you should have developer knowledge.

It's easy to migrate workloads to the cloud. They expose the API also. In two days, I can implement two firewalls in different regions. It's flexible. That is a feature of Azure and Palo Alto. This kind of integration is why I am able to do the migration in two days.

There's room for improvement in terms of integration with the load balancer. It isn't like Fortinet, which has a load balancer built into its firewall. It is effortless to integrate within the load balancer-plus-firewall solution. 

Palo Alto doesn't have much ability to load balance, so you must purchase a third-party load balancer. It would be great if they did these kinds of changes to integrate the solution with the load balancer.

I have used Palo Alto VM-Series for one year.

VM-Series is highly stable. One of our clients has been using it for one year, and we've been using it for a year and a half. There were some bugs initially, but in the past two years, it has gotten more stable. 

I give VM-Series six out of 10 for the scalability. It's one area where they need to improve. Scaling up requires a lot of effort because it's cloud infrastructure. You need to change a lot of settings and ask them to customize before it starts working. 

There are still some issues after a customer has customized the solution. Scalability is something they are working on. I am hoping that we'll see some decent scalability within a year and a half. 

I rate Palo Alto support nine out of 10. Palo Alto technical support is excellent. When you raise a ticket, you get a support call in 10 minutes. They will contact you by phone and follow up on WhatsApp to see if the issue hasn't been resolved. 

Positive

Setting up VM-Series is completely straightforward. You have to download the VM, and there is a free interface for internal and external management. You configure the interface and the root table within Azure, then the device is good to go. Lastly, you need to activate your license, and Palo Alto is integrated into Azure.

We had to purchase the license from the vendor and download the VMs from the Cloud market. You can download VM-Series from the Azure marketplace, it is a simple process. You configure everything in the management interface. Once that's done, you configure the access list so that others cannot access it from anywhere. 

After you purchase the license, you have to put the license in Azure VM. There's a similar license you have to implement in the Palo Alto portal. Your Palo Alto is ready to use once that goes through. It took us one week to deploy. An issue came up, and we had to raise a ticket, so it took seven days to complete the implementation within Azure Cloud. One person is enough to deploy it. I deployed two firewalls within seven days, so I didn't need anyone's help. One or two people are enough to manage it.

The price is fair enough. The most expensive is Cisco, followed by Fortinet, then Palo Alto. Palo Alto is very much within the range. We use Software Next-Generation Firewall Credits for licensing and consuming VM-Series. They have a cloud solution using their portal. You can go in and put it through the license.

We can't use the credits on the fly. It is not possible because they acquire new CPU RAMs. We cannot change this on the fly. It will take one day of downtime. It is not easy. This is planned downtime. You have to plan for it outside of business hours. If you do the downtime during the business day, you can't do anything. 

The Software Next-Generation Firewall Credits enable us to protect ourselves without going through a long procurement cycle. The licensing part plus implementation is very easy. You just create the firewall, and it can do everything.

I rate Palo Alto Networks VM-Series eight out of 10. Palo Alto is easy to use, and the price is fair compared to the other solutions on the market. I recommend Palo Alto, but you should also consider the other solutions out there. Some solutions have lots of bugs like FirePOWER. Also, the price for FirePOWER is quite high. That is not the case with Palo Alto. It has fewer bugs, requires minimum effort, and the price is fair. Everything is accessible within the same portal.

I've mainly worked with the VM-Series, and a few features have been really effective for threat prevention in our networks, like McAfee training, Accountant ID, and apps ID. These features integrate well with our existing environments and tools, such as Panorama. 

 The VM-Series scalability is fast and easy to implement, improving our security posture as our Azure network grows. The only minor issue we've faced is with the apps ID configuration, which requires specific matching for application filtering. Tools like Loopback help us identify open or denied flows between two firewalls and manage the servers effectively. The Palo Alto system easily identifies rules and objects within roles, making maintenance straightforward.

No other major concerns, just the specific issue with Apps ID configuration. Otherwise, overall stability, VPN, IPSec, VRF, and flow management with the VM-Series have been very stable and reliable.

I have been using Palo Alto Networks VM-Series for 2 years.

I've had a positive experience with Palo Alto's support. They usually respond within a few hours, which is satisfactory

Positive

In my experience, Palo Alto and Fortinet offer similar quality and high-level security compared to other vendors like Cisco and Forcepoint. They stand out in terms of reliability and security features. Other vendors may not match their level of performance and security.

It is easy to maintain because we have various tools to manage and monitor the system. 

The pricing for Palo Alto is quite high compared to FortiGate, which is more affordable. I don't have the exact figures as my manager handles that, but from my research, Palo Alto's licensing costs are significantly higher.

I would rate Palo Alto Networks VM-Series as an eight overall. My recommendation for others considering this tool would be to ensure they have the budget for it, as it can be expensive compared to alternatives like FortiGate. Also, they should be prepared to understand and document their application metrics thoroughly to implement the firewall correctly.