topic Re: Palo Alto PA-3400 Series degraded specs vs 3200 Seires in Next-Generation Firewall Discussions

Palo Alto PA-3400 Series degraded specs vs 3200 Seires

AlexNC — Mon, 12 Dec 2022 16:24:04 GMT

Dear Palo Alto Community

Is it just me, or did Palo Alto drop the ball on the new PA-3400 Series, while almost all specs gained an improvement over the old 3200 series. There is the value of Security-Zones that has me deeply confused/puzzled.

For the sticker price (whether it is list price or street price). Having a PA3410 with a max of 40 Security-Zones seems completely out of line. Especially compared to the rest of the new PA-x400 lineup.
If we look at the old PA-3200 they all have 200 Security-Zones supported and if we look at this comparison. There just seems to be a 0 missing with all PA-3400 firewalls. Now I know in most deployments 40 should be fine. But then again. We are talking a Firewall that can easily be used in deployments where 40 Zones can easily be reached. Not to forget that we always talk about an investment that needs to run for 5+ years in most cases.

I hope there is just a 0 missing in the spec sheets.
Also according to the spec sheet the PA-3400 series does not have any DoS Protection profile support.

And it looks like the performance values for HTTP and appmix are swapped (not sure about that one)

Anybody else thinking there is something off?

Regards

Alex

Re: Palo Alto PA-3400 Series degraded specs vs 3200 Seires

stevebaumenegtris — Tue, 27 Dec 2022 18:24:05 GMT

I have the same issue max. of 40 security zones seems like this would be fixed in a future release. It is causing me a lot of grief I was told by the account team in was way higher. Turns out only 40 on the PA-3420. I can not seem to get any real answers out of Palo support or account team.

Re: Palo Alto PA-3400 Series degraded specs vs 3200 Seires

AlexNC — Fri, 13 Jan 2023 12:32:12 GMT

Yes I hope they can fix this in the future and at least give us the 200 form the 3200 Series.

Also the comparison tool and summary spec sheet are still not updated to show the new PA-1400 Firewalls
UPDATE: I stand corrected: the new PA-1400 and the new PA-415/445 are now in the comparison tool finally:
https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-3410,pa-3430,pa-3420,pa-1410,pa-1420,pa-415,pa-445

It's great that we can order them already, but I'd appreciate if I'd now what I buy before I pull the trigger. Especially since we learned from the PA-3400 Series, we might get a cutback in specs compared to the previous models. So knowing what we are actually spending our money on becomes even more important.

Re: Palo Alto PA-3400 Series degraded specs vs 3200 Seires

PavelK — Wed, 15 Feb 2023 04:05:57 GMT

Hello @AlexNC

today, the PAN-OS 10.2.3-h4 was released. It looks like this issue is getting addressed:

PAN-202535
(PA-3410, PA-3420, and PA-3430 firewalls only) Increased the maximum number of security zones to 200.

Kind Regards

Pavel

Re: Palo Alto PA-3400 Series degraded specs vs 3200 Seires

AlexNC — Wed, 15 Feb 2023 05:46:50 GMT

Hi PavelK

Yes I've just read it this morning.
Guess their creative licensing department realised what a big stir fry they caused with their decision to reduce the number of security-zones from the top model downwards.

Glad to see we are back to previous PA3200 specs when it comes to security-zones.

Now all they need to do is get off their subscription chaos bandwagon and come back to earth again.