Palo Alto Networks Firewalls

Sizing, and what the subscriptions actually cover

Palo Alto publishes throughput with threat prevention enabled. That is unusual, and it makes sizing straightforward, because the figure on the datasheet is close to what you will see in production. It is worth knowing when you are cross-shopping, since a raw firewall throughput number on another vendor's sheet is not the same measurement and will look considerably larger for the same real capacity.

The subscriptions are the other half of the decision. A PA-Series appliance runs PAN-OS out of the box, but threat prevention, URL filtering, file analysis, DNS security and remote access are licensed separately, and support is a separate contract again. Almost nobody runs one of these appliances without at least the threat subscriptions, which means the hardware line on a quote is not the budget.

That is the part we help with: sizing the appliance against the inspection you actually plan to run, and putting the subscriptions and support on the quote rather than after it.