The firewall is excellent, the licence stack is the cost
3.6/5overall, average of the five axes
Deployment effort3
Support quality4
Features vs promises5
Pricing transparency2
Return on investment4
What happened
PAN-OS does what we need and App-ID is still the best in class for policy that survives an audit. Budget honestly though: the appliance is a fraction of the total once you add subscriptions. After CVE-2024-3400 we also treat GlobalProtect as an internet-facing crown jewel with its own patch SLA rather than as part of the general firewall estate.
Worked well
App-ID and policy clarity. Panorama for multi-site. Threat prevention quality.
Did not
Subscription stack drives the real cost. Feature velocity means regular PAN-OS upgrades. GlobalProtect needs its own patch discipline.
12 found this helpful