What is still missing or needs to be improved in PA Next Generation Firewalls ?

[mario.chancay]

Hi, will like to understand the oppinion from the PAN community about the features that are still missing or needs to be improved.

Will appreciate if you can specify by functionality like :

FIREWALL

Must Have : A,B,C

Nice to Have : D,E,F

Thks

Mario

[gfowler]

I would like to see a fat client for Log review.   Maybe a QT based executable.   Develop it once and compile for Windows, Mac, and Linux.   I would think such a feature would be exponentially faster than the Flash based log viewer I'm currently saddled with.

[wkirkland]

Must have:

B. Ability to quarantine malicious or infected devices/computers for a given period of time e.g. TippingPoint which blocks access.

When the time duration has expired access is granted until another threat is triggered.

(For DHCP clients the IP address can change to another device that is clean.)

This forces users with infected systems to call the HelpDesk for assistance.

Blocking access only on malicious activity does not resolve the root cause on a protected LAN.

[jambulo]

Must Have:

1) Ability to have collapsible tags/groups in Policies.  When we have dozens of Tags, it would be nice to be able to view them ALL at a higher level.

2) Better QA from Palo Alto.  We seem to find bugs in the software way more than we would like to.

[PANoJAM]

Well said TCPDump would be much less cumbersome than current approach.  BPF filter support would be nice too.

[mikand]

Nice to have:

1) Create rules based on MachineID as described in https://live.paloaltonetworks.com/thread/6589

[ericgearhart]

gfowler: we feed our PAs into a SIEM via syslog and it works wonderfully... I almost never have to log in to the appliance itself for the usual day to day log review.

On the cheaper side, you could have your PA feed into something like rsyslog or Splunk (up to 500 megs a day is free with Splunk!) and review logs that way

[ericgearhart]

Better Quality Assurance

It is honestly insane how many bug report tickets we have filed with PA for their devices... it seems like every time we go to take advantage of one of Palo Alto's many firewall features we are bitten by some bug or another. I like PA, I like the product line, I like the approach the company is taking, heck I like the smaller company atmosphere that seems to prevail there, but please for the love of packets improve your QA process! Test all the features in the product! Test all the features when every major release comes out!

And please test and improve GlobalProtect until it is to the point where it is rock solid!

Anyways, that's my .02 cents

[jared181920]

Palo Alto really should create an upgrade kit for the PA-500's. 

The amount of time that a commit takes to be processed is just ridiculous at this point.  We've had commits take upwards of 5 minutes at some points. 

This is not good when you need to suddenly make a change to revert a commit or tweak something.

Just put together a kit with some SSD storage, and more RAM and all would be well.  There have been plenty of threads on the slowness of the PA-500's, and while PA themselves admit it's because it's older hardware, they haven't really done much to rectify that. 

[oschuler]

5 minutes would be an "okay" time for a commit on our side. We're using a PA-2050 active/passive cluster and it usually takes 10 minutes to commit a change 😞

[CRHC]

We recently did a hardware refresh - replacing our 2050s with 3050s.  Our commits were also close to 10 minutes on the 2050s.  They are now about 10 seconds on the 3050s.

Cheers,

Mike

[jvalentine]

jared181920 wrote:
Palo Alto really should create an upgrade kit for the PA-500's.  

PAN-PA-500-UPG-2GB is a 2GB RAM Upgrade kit for the PA-500s.  

[jared181920]

I did not know this!

Does it actually make a noticeable improvement in commit times and overall responsiveness of the device?  It should in theory, but just wondering if there's a real-world difference.

[jvalentine]

I haven't had the chance to compare both 1GB and 2GB models under similar loads. There are some discussions here in the forum talking about experiences with the upgrade:

https://live.paloaltonetworks.com/message/24991#24991

[TNaami]

• SPEED.  Five minutes to COMMIT a URL to a filter?  Twenty minutes to reboot?  My Microsoft ISA 2004 booted faster.  A URL filter took ten seconds at most.
• Same request as others: Better documentation with real examples.
• Better logging for VPN!  I want to know when user JSmith logged on and when she logged off the VPN.
• REDUNDANT POWER SUPPLIES!!!  Over 99% of my servers have dual power supplies.  Edge switches have dual power supplies. Minimum is to have a modular power supply design with a secondary empty slot.  Those that don't need/want the supply simply don't order it.
• Solid State Hard Drives would be a good idea.
• Better interface into Active Directory.  The PAN-AGENT sucks.  If there are multiple users on a computer I cannot get reliable logs for Internet monitoring.

[thesa]

For 'A'

We use the 2000 series firewalls with 4.0.x code. The web based interface is so slooooooooooooooow it is painful and doing a commit takes 10 minutes.

For 'B'

We were also unlucky to have three DOA firewalls (2 had failed disks), you do not supply kit with solid state disks and would not entertain it, so again would like to see this included.

I would also second the post from TNaami.