Hello, Each ESXi host requires a licensed firewall so if you have 50 ESXi host you need 50 VM-Series licenses. VM-Series pricing is same for non-NSX and NSX integrated solutions, so you need to purchase perpetual licenses which are all paid up front with support and security update subscritions for specific time frame (1 or 3 years etc). Unfortunaltely PANW does not have rental license model for Service Providers like VMware (VCPP) and Microsoft (SPLA) have. However, 50 licenses would be rather big deal so there might be some good discounts or other options for such deal. As I understand Panorama capabilities, there is no such multitenancy support currently which would allow you to specificy user roles so that they could see and manage rules matching only specific zone. So I think answer to your last question is no.
... View more