FortiWeb vs. Palo Alto Networks Next-Generation Firewalls - PA Series

Regarding my experience, I prefer to deploy FortiWeb in a reverse proxy to have the full features and protection. The other mode will be useful for special cases as will it will not have the full range of features and protection. Like offline Sniffing, it will be used in special cases.

Incentivized

Anywhere where high performance and application-specific rules are necessary would be a great fit. Palo Alto NG firewalls are exceptionally well suited to doing application-based rules, rather than service-based rules, although they can still easily do those. The cost might make it less well-suited for smaller installations or where the more complicated setup procedures are too much for a user with limited proficiency to handle.

Incentivized

• API protection
• Bot mitigation
• Web application protection
• Application delivery

Incentivized

• The PA handles VPN connectivity without missing a beat. We have multiple VPN tunnels in use for redundancy to cloud-based services.
• The PA has great functionality in supporting failover internet connections, again with the ability to have multiple paths out to our cloud-based services.
• The PA is updated on the regular with various security updates, we are not concerned with the firewall's ability to see what packets are really flowing across the network. Being able to see beyond just IP and port requests lets you know things are locked down better than traditional firewalls.
• It is a great overall kit, with URL filtering and other services that fill in the gaps between other solutions without breaking the bank.

Incentivized

• Built-in vulnerability scanner should be better in next release
• Predefined security policies for other web application not listed

Incentivized

• The interface is a little complicated at first. This is common for all firewall products I've used but Palo Alto could definitely update the UI.
• Firewall rule audits are cumbersome. I have been using third-party tools to assist with the management. It would be great if Palo Alto could build out this functionality within Panorama.
• Best-Practice Assessment (BPA) is not well advertised. These are very useful but require reaching out to your rep. Palo Alto should look at automating this and building it into QBR touchpoints with their customers.

Incentivized

The PA5220s have far exceeded what we have expected out of them. It was a bit of a learning curve coming from another vendor, but everything falls into place now with ease. The capabilities of the solution still surprise us, allowing us to remove other costly hardware and providing a single point of management needed

Incentivized

PA Series firewalls provides good value for the price spent on them. Specially the 3K and 5K series devices contains hardware which keeps the management access smooth even during the peak hours of data traffic. The next gen firewall filtering services does function well (except for some bugs).

Incentivized

We've run into a couple undocumented bugs, but that seems to happen with every brand and technology. Any time we've had to engage Palo Alto support they've always been professional, knowledgeable and prompt. In almost all cases we've been able to resolve our issues without having to escalate our tickets.

Incentivized

Most of them have the same features but not for FREE. The second point was the total cost of ownership for 3 and 5 years. Fortinet supported us with the best prices for 3 years and 5 years as well with advanced hardware replacement against the others.

Incentivized

We are using Cisco ASA before in our environment but when it comes to deep scanning & layer 7 security it doesn't have that capability. After using Palo Alto Networks Next-Generation Firewall we are using sandboxing & advance malware protection that provides high-level end-user security. Also after implementing it we can easily monitor user-level traffic.

Incentivized

• ROI for last three years was 60%

Incentivized

• We used to outsource our Firewall and it's management. Not only did we find their SLA's to be lacking, in general, but communication between us was horrible. Many times we could not understand them and that resulted in less than desirable rule creation or troubleshooting.
• Since we no longer have to pay a company for 24/7 management (and SLOW SLA's) we are saving a ton of money each year. Also our fellow employee's are much happier that things can be resolved in a timely manner.

Incentivized