Palo Alto NG Firewalls Other Solutions Considered

reviewer1232628
Solutions Architect at a comms service provider with 501-1,000 employees
As a solutions architect group, we are what you would call "vendor-agnostic." We evaluate any solution that seems like it may be viable to provide clients with some advantages. I will never go to a customer and say that these are the only products that we are going to support. However, if there is something that a client wants to use which I feel would be detrimental to their business or that doesn't fit their needs, I will encourage them to look at other solutions and explain why the choice they were leaning towards may not be the best. When a solution they want to use means that no matter what we do they are going to get broken into, I'll let them know. It isn't good for their business or ours. That said, some of the most requested or considered firewall solutions by clients beside Palo Alto are Fortinet, Firepower, and Meraki. Looking at each provides a background into how we look at solutions and how we evaluate options for clients. You have to look at the benefits and disadvantages. Cisco Firepower NGFW (Next-Generation Firewall) I think that Firepower can be simplified and can be made into a more viable product in the Cisco line. I think that Cisco has the ability to get into the Firepower management platform and trim it. They can trim it by breaking down all of the different areas of concern and configuration and categorize them into overviews, implementation across the board, and steady-state management. If they were to do that, then users could start at the top layer and drill down more as they see fit to customize to their needs. I believe that Cisco can do that with Firepower and make it a much better security tool. Firepower is not just a firewall, it is an SD-WAN. It is an application that Cisco sells that gets loaded onto an ASA 5500 series appliance (the appliance has to be the X platform). It is not a bad solution. I can use it to get into your network and protect a lot of your customers who will be running traffic through it. But a problem that you are going to get into as a result of using Firepower is that it is extremely difficult to configure. Security engineers that I have handed the setup after a sale came back from the service and asked me never to sell it again because it was very difficult for them to set up. However, it is also very secure. The difficulty is in using the GUI, which is the console that you would log into to set up your rules and applications. It can take about 10 times as long as Meraki to set up, and that is no exaggeration. Palo Alto is easier to set up than Firepower, but not as easy to set up as Meraki. But, the security in Palo Alto is phenomenal compared to Meraki. Firepower is pretty secure. If it was a little easier to operate, I'd be recommending it up one side and down the next, but ease-of-use also comes into play when it comes to recommending products. I'll support what Firepower has to offer considering the quality of the security. But I can't take anyone seriously who is proud of themselves just because they think their firewall is next generation. It might have that capability but it might not be 'next generation' if it is set up wrong. Some vendors who sell firewall solutions that I've spoken to admit to dancing their customers around the 'next generation' promise and they make amazing claims about what it can do. Things like "This firewall will protect the heck out of your network," or "This firewall has built-in SD-WAN and can save you lots of money." These things are true, perhaps, depending on the clients' needs and the likelihood that they will be able to properly manage the product. Firepower is a capable solution but it is difficult to set up and manage. Cisco Meraki NGFW (Next-Generation Firewall) Meraki was a horrible acquisition by Cisco and it is harming their name. All of us who are familiar enough with the firewall know how bad that firewall is and we know that Cisco needs to make changes. The acquisition is almost funny. The logic seemed to be something like "Let's buy an inferior security solution and put our name on it." That is a textbook case on how not to run a company. If Cisco wanted to improve Meraki, the first thing they need to do is simply activate the ability to block an unknown application. Start with that and then also improve utility by blocking every threat by default like other products so that users can open up traffic only to what they need to. That saves innumerable threats right there. There are situations where Meraki works very well as is. One example is at Dunkin Donuts. What Dunkin Donuts needed for their firewall solution was to have a firewall at every location for guests. The guests go there to eat their donuts, drink their coffee, and surf the internet. The company's need was simply to blockade a VLAN for guest access to the internet while maintaining a VLAN for corporate access. They need corporate access because they need to process their transactions and communications. All corporate devices can only communicate through a VPN to headquarters or through a VPN to the bank. For example, they need to process transactions when somebody uses their debit card at a POS station. It works great at Dunkin Donuts. It works great at Target as well. All employees have a little device on their hip that enables them to find what aisle a product is in when a customer asks them. If the store doesn't have the product on hand, the employee can do a search for another Target that does have it in stock right on the device. They can do that right on the spot and use that service for that device. For that purpose, they are not going across the internet to find the information they are searching for. They are forced into a secure tunnel for a specific purpose. That is something you can do with Meraki. If you don't let employees surf the web on the device as well, that is why Meraki will work. I can actually give you the methodologies in which hackers are able to completely hack into a Cisco customer's network and steal extremely valuable information. Meraki is the most simple of all firewalls to infiltrate in the industry. It is an extremely dangerous piece of hardware. What comes into play is that Meraki, by default, does the opposite of what all of the other firewalls do. Every firewall not called Meraki will block every means of attack until you start saying to permit things. The Meraki solution is the opposite. Meraki, by default, blocks nothing, and then you have to go in and custom key everything that you want to block. This is dangerous because most people don't know everything in the world that they need to block. With Meraki, you have to get hacked in order to be able to find out. That is not a good methodology. An example of this is that Meraki cannot block an application it doesn't know about, which means that all unknown applications are forever allowed in by Meraki. If I am a hacker and I know that you are using a Meraki firewall, I can write an application to use for an attack. When I do, it is unknown because I just wrote it today. If I load it up on a website, anybody that goes to that website using a Meraki firewall has this application loaded onto their computer. Meraki can't block it. That application I wrote is designed to copy everything from that person's computer and everything across the network that he or she has access to, up to a server offshore in a non-extradition country. I will have your data. Now I can sell it or I can hold you for ransom on it. Customers love it because it is simple to configure. I don't even need to be a security architect to sit down at a Meraki console and configure every device across my network. It is an extremely simple device and it's extremely cheap. But you get what you pay for. You are generally going to suffer because of the simplicity. You are going to suffer because of the low cost and "savings." All I can say about Meraki is that it is cheap and easy to use and fits well in niche situations. If you need broader security capabilities, spend a few bucks on your network and get a better security solution. Fortinet FortiGate NGFW (Next-Generation Firewall) I'm supportive of Fortinet because it is a decent next-generation firewall solution. It is not as secure as Palo Alto, but it is a cost-effective and reasonably reliable product. I have customers choose it over Palo Alto. But if they decide to use this solution, I want to charge them to manage it for them. The reason for that is, if anything goes wrong in the network and they get hacked, my client will likely get fired and replaced. If anything goes wrong in the network and I am paid to manage their firewall, I am the one in trouble if they get hacked — not the client. I charge for my services, make sure everything is working as it should and give them my business card. I tell them that they can give the business card to their boss if anything goes wrong because the guy on the card is the one to blame. That way I remain sure that nothing will go wrong because of poor administration. Fortinet is sort of middle-of-the-road as a solution. It has a relative simplicity in setup and management, it has a lower price and provides capable security. Fortinet FortiGate still gets some of my respect as a viable alternative to Palo Alto. Comparing the Complexity of Setup Firepower is the most complex to set up. The second most complex is Palo Alto. The third is Fortinet. The fourth is Meraki as the simplest. Rating the Products On a scale from one to ten with ten being the best, I would rate each of these products like this: * Meraki is a one out of ten (if I could give it a zero or negative number I would). * Fortinet is seven out of ten because it is simple but not so secure. * Firepower is seven out of ten because it is more secure, but not so simple. * Palo Alto is a ten out of ten because it is the best product I know by comparison with any other firewall for security and control. An Aside About Cisco... View full review »
Mahmoud Salaheldin
Security Unit Manager at EEMC
Yes, was fortinet View full review »
InfTech4985
Head, Information Technology at a construction company with 501-1,000 employees
We called in proposals for different products, bigger players, like Check Point, Fortinet, Cisco. We set the criteria we need and had them make proposals. We found, based on the submissions, that Palo Alto seemed to be the one that had the most complete solution. We did a proof of concept to prove that whatever they said they can do, they can do. Once we passed that stage we proceeded with the purchase of the Palo Alto unit. It came down to the technical evaluation we did. They did well in terms of performance. In addition, we liked the support terms that were proposed by the reseller. We also looked at certifications and reviews, at the NSS Labs reports, and other industry ratings. Palo Alto seemed to be up there. Also, looking toward the future, we can actually subscribe to sandboxing services in the cloud. There are also options for us to integrate with endpoint security solutions. View full review »
Find out what your peers are saying about Palo Alto Networks, Fortinet, Sophos and others in Firewalls. Updated: January 2020.
397,082 professionals have used our research since 2012.
Bachir Elsitt
Network Security Engineer at Data Consult
Palo Alto, Cisco. View full review »
reviewer1132443
User
We looked at Cisco Meraki, but I wasn't really all that happy with it. View full review »
Rakesh Rawat
Network Engineer at Acliv Technologies Pvt Ltd
We also evaluated Check Point and Fortinet solutions. View full review »
Kumar_Rajesh
Vice President & Head Technology Transition at a tech services company with 10,001+ employees
We actually did not but we were using two or three other products already, so we had a good idea of what to expect. View full review »
Jean Maurice Prosper
Chief Executive Officer at a tech services company with 11-50 employees
We previously had Check Point and eventually compared it with the Palo Alto screening, which proved that Palo Alto was the best. It was not a difficult choice. View full review »
Aleksandar Jovanovic
System Engineer with 51-200 employees
We evaluated Sophos, SonicWall, and Fortinet. View full review »
NGfrwall677
Sales Engineer at a wholesaler/distributor with 51-200 employees
I didn't look at any other vendors. View full review »
Find out what your peers are saying about Palo Alto Networks, Fortinet, Sophos and others in Firewalls. Updated: January 2020.
397,082 professionals have used our research since 2012.