CrowdStrike Falcon vs Next-Generation Firewalls - PA Series

Likelihood to Recommend

It's a great solution with a massive deployment scenario with a lot of endpoints, and where the time is an issue and you need to be protected ASAP - thanks to its cloud-based architecture you will be up and running in almost 10 minutes (literally). There are no signatures, further refinements, or additional hardware and servers required. An always or almost always offline [scenario] is not well-suited for Falcon Pro.

Read full review

Victor Rivera

Senior Information Technology Manager

Grupo VinteConstruction, 1001-5000 employees

View all 20 answers on this topic

The Palo Alto device is well suited for a direct replacement for any traditional or other firewall. There is little room for error on this device, it will do exactly what you have it configured for. Between security zones, security policies, nat policies, policy based forwarding, and everything in between, you have to keep your head on straight when making big or small changes.

The Palo Alto does have one overall issue our users report more than anything. The Palo Alto is a strict NAT device, so unless you have the ability to 1 to 1 map IP addresses for your users who need something beside strict NAT limitations, the Palo Alto will cause you grief.

Read full review

Verified User

Administrator in Information Technology

Higher Education Company, 201-500 employees

View all 30 answers on this topic

Feature Rating Comparison

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

Anti-Exploit Technology

Endpoint Detection and Response (EDR)

Centralized Management

Hybrid Deployment Support

Infection Remediation

Vulnerability Management

Malware Detection

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

Identification Technologies

Visualization Tools

Content Inspection

Policy-based Controls

Active Directory and LDAP

Firewall Management Console

Reporting and Logging

VPN

High Availability

Stateful Inspection

Proxy Server

Pros

Ransomware protection. We ran a ransomware simulation with obfuscated executables to hide malware signatures and CrowdStrike found and stopped 15 out of 15.
Malware/adware detection. Packaged adware in official installers are instantly blocked without interfering with the install of the primary application.

Read full review

Randy Munroe

Information Security Analyst

Randall-ReillyMarketing and Advertising, 201-500 employees

View all 20 answers on this topic

AppID is able to see what the actual internet traffic is. For instance instead of port 443 just being "Internet traffic" we can define access to Facebook-base or all the other facets of facebook.
UserID allows us to define policies based on group or user access and integrates with our Active Directory. This helps to configure a least access privilege and if we find misuse of the network we can tighten specific users to a stricter policy.
GlobalProtect VPN connection helps our employee's connect from home remotely. This provides a very secure connection with minimal configuration.
Wildfire provides very up-to-date information regarding global attack mitigations and stopping techniques.

Read full review

Christopher St.Amand

Senior Network Security Engineer

PeoplesBankBanking, 201-500 employees

View all 30 answers on this topic

Cons

We get false positive detections when we run an email signature script for our users. These false positives can be a distraction. We've implemented a whitelist for those behaviors, but had some difficulty in figuring out how to configure CrowdStrike to recognize these executions since the file name and hash were always different (the executing file was firstname_lastname.exe, and that was too Vague to whitelist.

Read full review

Mark Sauer

Director of Information Technology

TransPakPackage/Freight Delivery, 1001-5000 employees

View all 20 answers on this topic

The CLI is a bit confusing, and it's difficult to find what you're looking for. Takes a lot of practice. Definitely not as good as the Cisco CLI.
Updating the firmware is often a very dangerous process, especially when jumping minor or major releases. More QA should be done to validate and ensure no issues during upgrades. I'll admit it's gotten better over time, but there is still room for improvement.

Read full review

Verified User

Engineer in Information Technology

Financial Services Company, 201-500 employees

View all 30 answers on this topic

Likelihood to Renew

No score

No answers yet

No answers on this topic

Next-Generation Firewalls - PA Series 10.0

Based on 1 answer

The PA5220s have far exceeded what we have expected out of them. It was a bit of a learning curve coming from another vendor, but everything falls into place now with ease. The capabilities of the solution still surprise us, allowing us to remove other costly hardware and providing a single point of management needed

Read full review

Verified User

Administrator in Information Technology

Higher Education Company, 201-500 employees

View all 1 answers on this topic

Usability

No score

No answers yet

No answers on this topic

Next-Generation Firewalls - PA Series 10.0

Based on 2 answers

In my opinion, the Palo Alto Firewall is the simplest firewall in terms of management interfaces; though it has more advanced options that apply to more advanced use cases. Configuring basic features on the firewall is nearly self-explanatory; configuring more advanced features can be met with very thorough vendor documentation.

Read full review

Verified User

Engineer in Information Technology

Government Administration Company, 1001-5000 employees

View all 2 answers on this topic

Support Rating

CrowdStrike Falcon 8.6

Based on 13 answers

When I receive support, it is always useful and informative. However, the support doesn't get back to me in the most timely manner. Often, by the time I hear back from support I have already resolved the issue. But for bigger issues, that need more in-depth help the support team has been incredibly valuable.

Read full review

Verified User

Analyst in Information Technology

Telecommunications Company, 1001-5000 employees

View all 13 answers on this topic

Next-Generation Firewalls - PA Series 8.5

Based on 12 answers

We've run into a couple undocumented bugs, but that seems to happen with every brand and technology. Any time we've had to engage Palo Alto support they've always been professional, knowledgeable and prompt. In almost all cases we've been able to resolve our issues without having to escalate our tickets.

Read full review

Paul Luchini

Network Engineer

Kentucky Administrative Office of the CourtsGovernment Administration, 1001-5000 employees

View all 12 answers on this topic

Alternatives Considered

Overall I found CrowdStrike Falcon's EDR capabilities superior to their competitors. Also, the user interface has taken its time to mature and is very intuitive and has a natural flow. Policy configuration and assignment as well as the features and settings within the config were more complete and met all our requirements. Lastly, the agent plays nice with everything else running on systems. We hardly ever have issues of Falcon interfering with users or services, and false positives are kept at a minimum.

Read full review

David Reyes

Sr Systems Engineer

InnovaSystemsComputer Software, 201-500 employees

View all 20 answers on this topic

I have used Cisco & Sonicwall primarily in most of my 23+ years of network security experience. Over the years all of these platforms have matured, but Palo Alto beats them all in terms of user interface.

The ability to run reports, get access to data immediately, and have the data be extremely accurate and granular is what sets Palo Alto apart from the others. Deployment of the VPN client(s) on multiple platforms is simple to manage and doesn't break other applications like many other VPN client software does. The performance of the firewall from a throughput and monitoring standpoint is second to none.

Read full review

Verified User

C-Level Executive in Information Technology

Consumer Goods Company, 201-500 employees

View all 30 answers on this topic

Return on Investment

CrowdStrike has cut our security costs.
Has given us more insight into our end points.
It has helped with our older PC's CPU usage.
Cut our cost and time from managing multiple platforms down to managing one platform with better insight than what we had with multiple security platforms.

Read full review

Verified User

C-Level Executive in Information Technology

Security & Investigations Company, 1-10 employees

View all 20 answers on this topic

Utilizing Panorama to manage all of our Firewalls Policies by creating device groups is a real time saver. We only need to configure policies once and push them to the appropriate firewalls saving a lot of time.
Having the added security feature protection is good peace of mind in an ever-increasing threat landscape.
Monitoring traffic by IP, URL or username provides excellent insight into our traffic.

Read full review

Verified User

Analyst in Finance and Accounting

Financial Services Company, 1001-5000 employees

View all 30 answers on this topic

Pricing Details

General

Free Trial

Yes

Free/Freemium Version

—

Premium Consulting/Integration Services

Yes

Entry-level set up fee?

No

CrowdStrike Falcon Editions & Modules

Edition

Falcon Pro	$6.99¹
Falcon Enterprise	$14.99²
Falcon Premium	$17.99²

per endpoint/month (for 5-250 endpoints, billed annually)
per endpoint/month (minimum number of endpoints applies)

Additional Pricing Details

—

General

Free Trial

—

Free/Freemium Version

—

Premium Consulting/Integration Services

—

Entry-level set up fee?

No

Next-Generation Firewalls - PA Series Editions & Modules

—

Additional Pricing Details

—

Rating Summary

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

CrowdStrike Falcon

Next-Generation Firewalls - PA Series

Likelihood to Recommend