We just finished migrating our edge firewalls from Juniper SRX to Palo Alto. The policy migration itself was... interesting.
I expected a straightforward port of rules, but the philosophies are different. Palo Alto's security policy model with applications at its core forced us to rethink everything. We couldn't just copy source/destination/service.
Has anyone else done this? My main questions:
* How did you handle the Juniper "application" aware rules? Did you just drop them and let Palo Alto App-ID take over?
* SRX address sets vs. Palo Alto address groups – any pitfalls?
* The biggest surprise for us was how implicit vs. explicit the policies felt after the move.
Senior DevOps at a mid-market SaaS. We ran SRX300 series for years before switching to PA-440s on the edge last year.
Fit - Palo Alto's model is enterprise first. If you aren't using App-ID and User-ID, you're paying for half the product. SRX is more network admin friendly.
Migration effort - Took us 4 weeks for 150 rules. The App-ID transition was the killer. You can't port a "junos-application"; you have to map it to Palo Alto's apps or custom app-IDs, which requires traffic analysis.
Hidden cost - Palo Alto support contracts are 20-30% of hardware cost yearly. SRX support was cheaper, but TAC was slower.
Where it breaks - Palo Alto's explicit model breaks lazy admin habits. No more 'any' services. That implicit feeling you mention is the security team finally getting what they paid for.
I'd pick Palo Alto if you have the staff to manage it and actually use the security features. For a straight packet filter, SRX is fine. Tell us your team size and if you have dedicated security engineers.
Just my two cents.
You're right about the cost, but gloss over the real kicker.
> actually use the security features
Most shops don't. They turn on App-ID, get flooded with alerts for 'unknown-tcp' on some legacy app, and create an 'any' app-override policy to shut it up. Now you're back to a packet filter that costs 3x more.
Four weeks for 150 rules? That's the audit you should've done on the SRX years ago. The tool didn't make your policies explicit, the migration project did. Could've done that in place with a spreadsheet and saved the capital budget.
-- old school
You're right about App-ID being the heavy lift. We saw the same thing migrating off an old Check Point box.
The traffic analysis piece is where most shops skip the real work. They'll map "junos-application ftp" to Palo's "ftp" app and call it done, missing that 80% of the traffic was actually sftp over a custom port that App-ID will flag as unknown-tcp. You need a proper log review from the old firewall first, not just a config dump.
Your point on staff is the deciding factor. No dedicated security engineer? Stick with SRX. Palo becomes shelfware without someone to tune the profiles and actually read the logs.
Integration is not a project, it's a lifestyle.