3

Work got a couple of Palo Alto boxes that will be used for a customer. No real gameplan has been issued yet, but I was wondering what exactly sets these boxes apart from, say, an ASA?

It appears to me to just be a linux machine with their custom overlay. I'm sure there's a lot I'm not seeing as I haven't done much with them, but I can't help but be wary.

What I'm asking is:

  • What are the strengths of Palo Alto Firwalls(specifically the 3000 series)
  • In what cases would you use one over a Cisco ASA?
  • The part about the CLI being strange is too subjective... let's remove that part. I am undecided about the comparison with ASA. We can reopen after you edit the question. – Mike Pennington Sep 6 '13 at 2:24
  • As far as I know, Palo Alto devices (just like Check Point they originated from) should be configured via GUI (Panorama). CLI is used for basic ip-address assignment and hardcore troubleshooting, but not for security configuration. – Pavel Glushkov Sep 6 '13 at 9:21
  • "model/product line features/differences" are specifically on topic... I think this should be re-opened. Thoughts? – Craig Constantine Sep 6 '13 at 13:46
  • The CLI of the Palo Alto is fully featured and is similar to that of a Juniper's CLI hierarchy. – one.time Sep 6 '13 at 14:20
  • Maybe after I play around with Juniper more, I'll be able to gain a solid opinion on it then. I have edited the question as requested. – coxley Sep 7 '13 at 1:05
7

Most network vendor software (IOS included) is *nix based, I don't see why this is an issue.

Palo Alto has a number of strengths over an ASA primarily based on an application-based rather than TCP focus:

  • L7 Application awareness, allowing you to restrict application functions rather than just IPs and port numbers. This provides protection where applications (such as Skype) use dynamic ports.
  • Agent-free user awareness, allowing you to restrict access and functions based on a user's credentials and AD group membership for instance.
  • Comprehensive user directory support.
  • An advanced GUI
  • A virtual edition
  • A REST API
  • BGP Support
  • Data Loss Prevention features
  • Additional modes of operation (L1 transparent, Tap) that I don't believe the ASA provides

This Packetpushers Podcast provides a good overview and further information.

| improve this answer | |
6

L7 awareness is the big differentiator. The canonical example everyone gives is allowing Facebook news feeds but blocking Facebook games. A conventional firewall like the ASA that just blocks or allows port 80 or 443 can't do that. There are lots of other examples, such as allowing certain URLs, allowing Google Chat but blocking video transfer, etc.

Palo Alto was very early in this market if not the first. There are also other application-aware firewalls shipping from Check Point, Dell/Sonicwall, and Fortinet, and this list is surely incomplete.

| improve this answer | |
  • The real strength is the comprehensiveness of the package and policy management. – SpacemanSpiff Sep 20 '13 at 16:40
  • Yes, there's a lot to that. NGFWs compete on the number of application signatures, same as in the IDS/IPS space. There's also a functional aspect to this, with ease of application configuration a big difference among products. – user8162 Sep 25 '13 at 0:12
0

Palo Alto is a next generation firewall and they are the first to introduce the user and application identification in the firewalls. They have set the standards for the next generation firewalls by being the first to introduce the concepts. The firewalls work on layer 7 compared to layer 4 by the conventional firewall.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.