PA-5250 Migration to Virtual Appliance and EoL Status

[Redman]

Hello

I'm interested in the Palo Alto virtual or VM-series appliance that would be broadly equivalent to the PA-5250. I realise the product selection is best made based on requirements such as sessions security rules, dynamic ip addresses, security zones, ipsec vpn tunnels but that information is not available just yet.

What I can say is that the PA-5250 in place today on my customer site absolutely meets all technical requirements and performance criteria. However, there is an urgent but non-technical compliance requirement to migrate to a virtual appliance so customer is interested in replacing with as like-for-like a virtual alternative as possible.

Also, is the PA-5250 currently end of life? I've checked online and it does not appear to be - only the PA-5020, PA-5050 and PA-5060 have published notifications. However, my customer seems to believe the PA-5250 is either currently end of life or approaching end of life so just wanted to double check.

Thanks

Redman

[aleksandar.astardzhiev]

Hi @Redman ,

According to Palo Alto End-of-Life policy - https://www.paloaltonetworks.com/services/support/end-of-life-announcements/end-of-life-policy a hardware end-of-life date is 5 years from the end-of-sale date. And end-of-sale will be annouced with 6 months advance.

As you can see here - https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dat... PA-5200 series are not yet annouced to be end-of-sale, nor end-of-life. Even if they annouce it tomorrow you still will have 5,5 years before reaching end-of-life.

I am not sure how much you can count on this, but PA-5000 was annouced around 2011 and it was End-Of-Sale on 2019, which could means that PA-5200 series annouced around 2017, could be End-Of-Sale around 2024, giving it 2029 for end-of-life...But you never know how much power will be required for the next-next-gen firewall 🙂

You can use the compare tool to see how many resources you will need to reach similar performance as PA-5250
https://www.paloaltonetworks.com/products/product-comparison?chosen=pa-5250,vm-series%2520(22%2520vc...

As you can see PA-5250 is actually a beast and VM-series having hard time reaching the same performance.

I personally prefer hardware appliance for environmnet that will require performance that is suitable for PA-5200 series.

It would be better to gather some statistics and see at what level the current PA-5250 is utilized.

Here is relativley outdated video, but still giving some good basic guidance around the end - https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmvCAC

If you are using Panorama, it is the most easiest way to see performance trend Panorama >Managed Devices > Health > All Device

[Redman]

HI @aleksandar.astardzhiev 

Thanks for the super quick response. Really helps with the customer proposal I'm working on.