Here is that post from Cisco forum in question (in case someone is too shy to click on the above link 😉 " thaer.ontabli 5 posts since Mar 20, 2011 Mar 13, 2012 7:35 AM (in response to david.tran@finra.org) ASA's vs Palo Alto firewalls? This is my experience with Palo Alto: A PA Engineer spec’ed out two 2050 for our environment of approx. 1000 user. Soon after the box was installed I discovered a couple of issues with their 3.x OS: 1 ) User activity report not giving accurate reporting, it’s all messed up and doesn’t match what’s in the log. Support confirmed it’s a bug and I filed three cases (every time I escalate or they tell me they have a fix I had to open another ticket ) case# 15350, 21993, 30788. The case took more than 5 months and was never fixed until OS 4 was released 2 ) QoS does not work when you filter application with application grouping. Alternate is you have to enter every application manually in a rule to filter out for example all P2P applications need to be entered in a rule instead of grouping all P2P in an object. Case was open for more than 5 months until it was fixed in OS 4. Case # 22967, 23047 3) Web, SSL VPN, captive portal services crashes. Service crash for some reason and the fix for it with OS 3 were for me to call support and have them login and restart the service for me. Was very frustrating as more than 6 months past with support and engineers having no idea what’s going on. A lot of cases were open and closed. Case # 32874 With OS 4 released: 1 ) still having issues with web, ssl, and captive portal service crashing. Now with OS 4 they made the services auto restart so I don’t have to call them, but now the problem the service is crashing in the back end three times a day causing the services to be unresponsive which I think is related to the next case 2 ) Gui or CLI interface very slow and impossible to apply any changes during daytime without having the commit job fail two or three times. Called support and they think it’s a bug with the software OS 4. Now its release 4.1.3 and still no fix or clue as to what is wrong. 3 ) VPN Global Protect is ridiculous. Client would act in a weird way by going into infinite state of trying to connect. On some client it will just not work until the client machine is formatted. Now its Global Protect release 1.1.3 and still no fix. There a lot more smaller issues not worth mentioning as there is a work around to them or you can ignore them. I had my sales rep involved with all these cases and was not able to do anything to expedite or get a firm ETA with Palo Alto support. My sales rep was able to get me a demo of PA4050 which seemed to resolve 80% of the problems, so I went back to support and told them if a PA4050 fixed the problem doesn’t that mean the engineer undersized the box for our environment. They kept refusing that idea and claiming there is a bug with the OS. Now after two years it got to a point where it’s just a waste of time to go back to support that I just closed all the cases and working on slowly replacing the system "
... View more
