Palo Alto Networks

[mrbios]

Anyone here using these guys for their firewall/filtering?

 

We're currently looking at all inclusive devices to do our firewall, filtering and spam filtering all in one, smoothwall and palo alto are currently on the list, i need a 3rd recommendation if anyone has one too? but main purpose for this thread was to see if anyone had used palo alto before and if they had anything to say about it?

 

http://www.paloaltonetworks.com/

[RabbieBurns]

we had one on demo a few weeks back. They told us it couldnt do spam filtering which is pretty much useless for us.

 

We're probably going to go with a fortinet, the FortiOS 5 looks great.

[timbo343]

@mrbios i am in the exact same boat as you at the moment, but i have a cisco ASA5510 and websense web filter. Looking at Websense Secure Gateway and keeping Cisco or have another product that does it all. I too have been told about PaloAlto and been told the filtering is a bit basic.

[mrbios]

@mrbios i am in the exact same boat as you at the moment, but i have a cisco ASA5510 and websense web filter. Looking at Websense Secure Gateway and keeping Cisco or have another product that does it all. I too have been told about PaloAlto and been told the filtering is a bit basic.

 

See i heard the opposite, when i asked how good the filtering was i was told "Bloody good" so now I'm not sure >_< haha

 

I do have my doubts about them though, I'm just having a look at the fortinet site at the moment, anything i go for will be a UTM sort of device but i want to make sure the last company i add to my list of "bidders" as it were, are going to strong contenders with the other two.

 

I might go back to the guy who recommended palo alto and see what else he has to say about the filtering....

[RabbieBurns]

http://www.computerlinks.dk/FMS/19821.gartner_magic_quadrant_for_unified_threat_manage.pdf

 

[mrbios]

http://www.computerlinks.dk/FMS/19821.gartner_magic_quadrant_for_unified_threat_manage.pdf

 

[ATTACH=CONFIG]16171[/ATTACH]

 

ahhh now that is interesting...because on friday when i was sent a bunch of PDFs from palo alto they sent me last years magic quadrant independent review....how funny that they didn't send me this years!

 

EDIT: oh i see this is for unified threat management only, in which case, massive thank you for that rabbie!

[john]

@Soulfish is a good man to poke he has a pair of Smoothie appliances complete with a shiny Palo Alto system supplied by @Net-Ctrl and I know he smiles continually

[Soulfish]

ahhh now that is interesting...because on friday when i was sent a bunch of PDFs from palo alto they sent me last years magic quadrant independent review....how funny that they didn't send me this years!

 

EDIT: oh i see this is for unified threat management only, in which case, massive thank you for that rabbie!

 

Be careful when looking at the magic quadrant stuff. Gartner/PA class the PA product set as a Next-Gen Firewall (NGFW), so it gets included in a different magic quadrant report (confusing! but read UTM vs NGFW - A Single Shade of Gray | Anitian Blog). We've got a PA-4020, which is shortly being replaced with 2 x PA-3020 (now they've finally been announced!). Love the feature set, App-ID/User-ID is amazing as is the whole blocking apps based on application profiles rather than ports etc. We did trial and look at several other appliances but nothing came close to the PA.

 

We don't use the filtering (although we did demo it and it seemed OK, not amazing, but comparable to other firewall companies) as we still use and will continue to use Smoothwall for that. Very happy with our SWG-1200's for filtering

[gshaw]

Palo = awesome App-level firewall that will stop P2P and multimedia hogging your network. Filtering has been OK for us so far but we're quite light users on that front. Spam filtering doesn't bother me, use a cloud service and save your bandwidth (note Microsoft give Forefront Online free with EES)

 

Smoothwall as far as I understand is a very good content filter but can't do the application level stuff.

 

In an ideal world you have both but I'd say get a Palo in on demo to analyse your network traffic then depending on what you find you'll know if you need the app-level control.

[m25man]

We are about to try out Gateprotect after our long and fond relationship with Sonicwall has faded since its marriage with Dell.

The price is comparable to most and the features are comprehensive.

So if you need a third comparator check out the product range.

[glennda]

I use Watchguard firewalls with most of my clients. Wouldn't cut the mustard in terms to filtering but thats what Smoothwall is for!

[mrbios]

Be careful when looking at the magic quadrant stuff. Gartner/PA class the PA product set as a Next-Gen Firewall (NGFW), so it gets included in a different magic quadrant report (confusing! but read UTM vs NGFW - A Single Shade of Gray | Anitian Blog). We've got a PA-4020, which is shortly being replaced with 2 x PA-3020 (now they've finally been announced!). Love the feature set, App-ID/User-ID is amazing as is the whole blocking apps based on application profiles rather than ports etc. We did trial and look at several other appliances but nothing came close to the PA.

 

We don't use the filtering (although we did demo it and it seemed OK, not amazing, but comparable to other firewall companies) as we still use and will continue to use Smoothwall for that. Very happy with our SWG-1200's for filtering

 

Out of interest how many Users/Computers do you have running behind yours to require two? or are they literally just for redundancy?

 

We'll likely be getting 1 x PA-3020 and then sitting either bloxx, smoothwall or lightspeed infront of it for content filtering, been researching for 2 days solid now with little interruptions so I'm getting a good handle on what i want to achieve.

 

I'm yet to find anyone say a single bad word about the PA firewall except for cost, but having checked out the costs they look reasonable for what it does so we're happy there too. I just need a content filtering solution that's going to cost us less than £4.5k per year ideally but that's looking like it may be a push.

 

Currently we've got an SWGFL supplied 30mb on a 100mb bearer connection and their shoddy filtering followed by a very long in the tooth ISA2006 firewall which is currently costing us around £16k per year, I've worked out by estimated/preliminary prices that if i had a smoothwall content filter on top of a palo alto firewall setup on a 100mb on 100mb bearer connection i can get that for £16.5k total per year, though like i say, purely preliminary/estimated prices so i'm hoping to try and save a bit of $$$ now.

[Soulfish]

Out of interest how many Users/Computers do you have running behind yours to require two? or are they literally just for redundancy?

 

We'll likely be getting 1 x PA-3020 and then sitting either bloxx, smoothwall or lightspeed infront of it for content filtering, been researching for 2 days solid now with little interruptions so I'm getting a good handle on what i want to achieve.

 

I'm yet to find anyone say a single bad word about the PA firewall except for cost, but having checked out the costs they look reasonable for what it does so we're happy there too. I just need a content filtering solution that's going to cost us less than £4.5k per year ideally but that's looking like it may be a push.

 

Currently we've got an SWGFL supplied 30mb on a 100mb bearer connection and their shoddy filtering followed by a very long in the tooth ISA2006 firewall which is currently costing us around £16k per year, I've worked out by estimated/preliminary prices that if i had a smoothwall content filter on top of a palo alto firewall setup on a 100mb on 100mb bearer connection i can get that for £16.5k total per year, though like i say, purely preliminary/estimated prices so i'm hoping to try and save a bit of $$$ now.

 

PA isn't cheap that's for sure!! I have heard it described as the Rolls Royce of the firewall world and I wouldn't disagree. If you can make use of its layer-7 feature set then it's definitely one to look at. We compared Fortinet, Watchguard, Sonicwall, Juniper and Cisco to Palo Alto and while plenty were much cheaper none worked anywhere near as well.

 

We have 1g on 1g, but the PA-3020s are a redundant pair. Both setup with the same config, but the licensing is setup so that only 1 can be physically firewalling/passing traffic at any time. We have the cold-spare (it's not automated as that costs £££ and requires it to be a hot-spare ) as we got a very good deal, and gives us peace of mind!

 

If you're doing 100/100 why not look at something like the PA-2020 up to the PA-2050? They're all designed to cope with 100mb - 500mb lines. Only downside with the PA-2000 series is the interface can be a bit slow as the management processor was underspecced in that range unfortunately! But by going for a slightly smaller box you'll probably find you save a fair few k on the box price and licensing.

[mrbios]

PA isn't cheap that's for sure!! I have heard it described as the Rolls Royce of the firewall world and I wouldn't disagree. If you can make use of its layer-7 feature set then it's definitely one to look at. We compared Fortinet, Watchguard, Sonicwall, Juniper and Cisco to Palo Alto and while plenty were much cheaper none worked anywhere near as well.

 

We have 1g on 1g, but the PA-3020s are a redundant pair. Both setup with the same config, but the licensing is setup so that only 1 can be physically firewalling/passing traffic at any time. We have the cold-spare (it's not automated as that costs £££ and requires it to be a hot-spare ) as we got a very good deal, and gives us peace of mind!

 

If you're doing 100/100 why not look at something like the PA-2020 up to the PA-2050? They're all designed to cope with 100mb - 500mb lines. Only downside with the PA-2000 series is the interface can be a bit slow as the management processor was underspecced in that range unfortunately! But by going for a slightly smaller box you'll probably find you save a fair few k on the box price and licensing.

 

ah interesting, the guy at PA i spoke to gave us the spec sheet for the 3020/40 and didn't mention any other devices, do you know how much they cost? We'd been told it'd was in the region of 3k, which we were happy enough to pay.

[RabbieBurns]

@Soulfish Can the fortinet devices do app control, as their web filtering seemed great when we had a demo?

[Net-Ctrl]

@mrbios i dont know if this would be of any interest but we have done a few PaloAlto installs into education over the past six months, i could try and find one of them thats able to speak with you about the solution?

 

Alternatively, we have Robert Needs, one of our engineers who is fully trained on the Palo solution and has a great knowledge base on the technical side, and Mark Power who is able to talk through all your sales options etc. Hopefully a combo of the two could help answer some questions you may have

[phreak]

I currently have 2 Palo Alto boxes running on my setup. They are the older 2020 models and not the newfangled 3000 or 5000 series. But essentially they all have the same basic settings.

 

For a firewall it is top notch, allows for a great in depth configuration to allow only what you want in and our of your network as well as allowing certain users, regardless of where they are logging in from, higher or lower access to the internet and/or network. The Anti-Spam thing isn't such a big deal for us as we have a 3rd party doing that for us before the mails even make it to our system.

 

There are a couple of drawbacks, but from what I have heard this is largely down to A. these lower level boxes we have and B. down to the amount of rules we have setup (203 just on the security rules). The problems I mentioned are very slow commit changes time, can take upwards of 5-10 minutes to apply changes. And some slow navigation of the web GUI, again down to the amount of rules we have.

Although I will be over Christmas doing a tidy up of the rules and removing redundant ones. So hopefully it will pick up.

 

Lastly, I will just say that it depends on what you want/need the box to do. If you don't need such tight control over your network traffic as well as being able to identify what kind of traffic it is and having that added layer of protection with the Anti-virus and Application threat detection, then you probably don't need a Palo Alto box and you will probably be able to get away with using a Equiinet Cachepilot or something like that.

[jubei]

Excellent firewall, web filtering not as stellar.. doesn't deal with granulated controls of social networks, doesn't support YouTube for schools, etc...

[Net-Ctrl]

If there is anything i can do to help regarding Palo or if you have any questions please feel free to let me know. We can set-up a tech call with an SE at Palo or look at getting some trial equipment out to you.

 

If you're already dealing with someone, i apologise for the intrusion

 

Ignore this post. Someone else has posted on my behalf already haha

Edited August 2, 2013 by Net-Ctrl

[gshaw]

Would be interested to hear about anyone using their Palo with Bloxx or Smoothwall hanging off it for web filtering, particularly if the filtering runs in transparent proxy mode...

[john]

Would be interested to hear about anyone using their Palo with Bloxx or Smoothwall hanging off it for web filtering, particularly if the filtering runs in transparent proxy mode...

@Soulfish has as PA F/W with Smoothie filtering