3

Work got a couple of Palo Alto boxes that will be used for a customer. No real gameplan has been issued yet, but I was wondering what exactly sets these boxes apart from, say, an ASA?

It appears to me to just be a linux machine with their custom overlay. I'm sure there's a lot I'm not seeing as I haven't done much with them, but I can't help but be wary.

What I'm asking is:

  • What are the strengths of Palo Alto Firwalls(specifically the 3000 series)
  • In what cases would you use one over a Cisco ASA?
Improve this question
9
  • The part about the CLI being strange is too subjective... let's remove that part. I am undecided about the comparison with ASA. We can reopen after you edit the question.
    – Mike Pennington
    Commented Sep 6, 2013 at 2:24
  • As far as I know, Palo Alto devices (just like Check Point they originated from) should be configured via GUI (Panorama). CLI is used for basic ip-address assignment and hardcore troubleshooting, but not for security configuration.
    – Pavel Glushkov
    Commented Sep 6, 2013 at 9:21
  • "model/product line features/differences" are specifically on topic... I think this should be re-opened. Thoughts?
    – Craig Constantine
    Commented Sep 6, 2013 at 13:46
  • The CLI of the Palo Alto is fully featured and is similar to that of a Juniper's CLI hierarchy.
    – one.time
    Commented Sep 6, 2013 at 14:20
  • Maybe after I play around with Juniper more, I'll be able to gain a solid opinion on it then. I have edited the question as requested.
    – coxley
    Commented Sep 7, 2013 at 1:05

3 Answers 3

Reset to default
7

Most network vendor software (IOS included) is *nix based, I don't see why this is an issue.

Palo Alto has a number of strengths over an ASA primarily based on an application-based rather than TCP focus:

  • L7 Application awareness, allowing you to restrict application functions rather than just IPs and port numbers. This provides protection where applications (such as Skype) use dynamic ports.
  • Agent-free user awareness, allowing you to restrict access and functions based on a user's credentials and AD group membership for instance.
  • Comprehensive user directory support.
  • An advanced GUI
  • A virtual edition
  • A REST API
  • BGP Support
  • Data Loss Prevention features
  • Additional modes of operation (L1 transparent, Tap) that I don't believe the ASA provides

This Packetpushers Podcast provides a good overview and further information.

Improve this answer
1
6

L7 awareness is the big differentiator. The canonical example everyone gives is allowing Facebook news feeds but blocking Facebook games. A conventional firewall like the ASA that just blocks or allows port 80 or 443 can't do that. There are lots of other examples, such as allowing certain URLs, allowing Google Chat but blocking video transfer, etc.

Palo Alto was very early in this market if not the first. There are also other application-aware firewalls shipping from Check Point, Dell/Sonicwall, and Fortinet, and this list is surely incomplete.

Improve this answer
2
  • The real strength is the comprehensiveness of the package and policy management.
    – SpacemanSpiff
    Commented Sep 20, 2013 at 16:40
  • Yes, there's a lot to that. NGFWs compete on the number of application signatures, same as in the IDS/IPS space. There's also a functional aspect to this, with ease of application configuration a big difference among products.
    – user8162
    Commented Sep 25, 2013 at 0:12
0

Palo Alto is a next generation firewall and they are the first to introduce the user and application identification in the firewalls. They have set the standards for the next generation firewalls by being the first to introduce the concepts. The firewalls work on layer 7 compared to layer 4 by the conventional firewall.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.