PA-2000/4000 trade-in

[dieter_b]

Did anyone do a trade-in for their PA-2000/4000 series device (under the so called Customer Care Upgrade Program) ?

What about current subscriptions ? Is the remaining value completely reimbursed ?

As in 1 year of the 3 year contract to go, so 1/3rd of the initial contract value reimbursed ?

At least I would expect so, because:

• when trading in a PA-2000 series to a PA-3000 series, the contract value for Palo Alto is higher
• new commitment for the higher contract value for a new contract period of eg. 3 years (as opposed to the remaining period under the old contract).
• the main reason for Palo Alto is to get rid of old hardware platforms. They no longer want to support them... the sooner, the better. (keeping the "known" issue regarding lack of memory for the PA-2000 in mind...)

Can anyone share their experience ?

[hshah]

Hi Dieterb,

Even I have heard of such program, best person to answer is SE for the account.

Regards,

Hardik Shah

[dieter_b]

Well, the matter of fact is I already have a quote. I even had contact with the regional Palo Alto account manager about this...

The issue (and reason for asking here) is in fact not that attractive:

• ok, there is a discount for the new device when trading in the old one, but
• remaining value of old contracts is not entirely reimbursed. That cancels out the discount for the new device

So from a financial point of view, this is not interesting.

Sure, we would benefit from the better functionality of a PA-3000, but it's not like we really need it performance wise.

We'd be happy if Palo Alto would recognise the actual issue with the PA-2000 and offer a remedy. But instead they are just trying to sell us a new box...

[cmateam]

@dieterb and all.

I too received a call yesterday from a Palo Alto Networks Business Development representative and they were asking about my PA-2020 experience and I mentioned that particularly after upgrading to PAN OS 6 that commits failed somewhere between 60% to 75% of the time and it took about 15 to 20 minutes to actually commit things - which becomes really frustrating when you only need to commit one change. I was then offered by the rep (the customer care upgrade program  - there is nothing Customer Care about this!) this idea of being able to upgrade for new hardware (the PAN-3020) - they would give support and other license credit to move over to the new platform. It was also eluded to that PAN knew of some hardware defect/issue (whether it is a inferior management plain, RAM, or something else? I didn't get any other details.)  that caused these issues and wasn't going to be resolved with a simple OS patch. This lead to me explaining to them that they can't expect me to upgrade when we are only a little bit under halfway of the life cycle we expect from the devices. I work for a non-profit that doesn't have endless amounts of money to fix a issue that Palo Alto created (I spoke with our VAR and it will cost us $65k to $70k to upgrade 4 firewalls we have - that are only 2.5 years old). Needless to say I am quite frustrated and ready to cut my losses and buy firewalls that are 1/6th the cost of these things that have like and/or similar features. PAN is a leader in these new features, but they aren't the only ones doing it.

So I am waiting to hear back from the VAR/PAN regional rep, and yet to hear from them about what are my options.  It's also interesting that my support renewal is coming up next month, so this might be the open door to jump ship. As @dieterb said, a remedy, or a upgrade for the customer with no cost to the customer would be the right approach from PAN, but they are more interested in making the customer pay for the inferior product they created and sold.

Also to note: In the PAN-OS 6.0 document, I did not see anything about the PA-2000 or 4000 series not being supported. This seems that either they didn't test their OS out well enough, or knew there was issues, but allowed people to install anyway. Seems a little fishy to me.

[dieter_b]

As stated in other topics in the past: I'd be happy to pay a reasonable price for a memory upgrade kit (which IS available for the PA-500).

But they don't offer one for the PA-2000...

[cmateam]

Just got off the phone with a Sales Engineer and Sales Rep and he is going to look into the issue, but believes that the upgrade to 6.1 resolves these issues with poor commit times and failures at commits.  He is going to research that.  It would be helpful if they just communicated that, rather then trying to sell you something. I'll let you know what I find out.

[dieter_b]

Release notes for several versions had something in them regarding commit times, but for us upgrading never really improved much (true, just after upgrading and the inherent management server restart, commits would be ok. But that doesn't last long.)

So right now I'm in rather reluctant to upgrading (now on 5.0.11).

[cmateam]

I agree...so interesting that you see similar issues on 5.0.11.  I am on 6.0.6 - they were saying 6.1.x potentially fix the issues. Hmmm guessing not.  5.x.x. seemed to be bearable and the occasional failure was ok, but moving forward it has been horrible.

[dieter_b]

Been a month, time to get back on topic: I'd really know some end user experiences about a trade in. Don't want to hear our account managers story all over again.

Did anyone do a trade in ? What conditions/discount did you get ? How much of your running subscriptions was paid back ?

[cmateam]

Company ended up going with another vendor all together.  Have one more set to swap out - but washing we're washing our hands of Palo Alto. Sadly I can't recommend them to anyone. Based on their customer support (lack of) in trying to help resolve the issue. It seems like it's the bottom dollar, not the customer they care about.