Hey everyone 👋 I'm new here but have been lurking while we went through our migration. We moved from Zscaler to Prisma Access about six months ago for our remote workforce (~300 users). Overall, it's been solid for security, but a few unexpected things broke or got really fiddly.
The big one was internal web apps that used client certificate authentication. Prisma handled them differently, and we had a week of outages until we tweaked the decryption policies. Also, our legacy time-tracking tool's performance tanked over the VPN until we added it to the exclusion list. Bandwidth reporting isn't as straightforward as I'd hoped for resource planning. Curious if others ran into similar hiccups with app performance or internal tools after switching?
Hi, I'm nicholasp. I work at a small consulting firm (around 80 people) where I manage our help desk and internal IT. We use Prisma Access for all our remote staff.
Here are the key differences I've seen:
**Pricing and tiers**: Prisma feels built for bigger budgets. Our costs increased compared to our previous service, and the licensing for full features can get complex.
**App performance gotchas**: Like you, we hit issues with internal tools. A line-of-business app for project tracking became unusably slow until we added it to the bypass list. Performance for on-prem apps is hit-or-miss.
**Client certificate handling**: We don't use them, but our Palo Alto rep warned us it's a known migration hurdle. They said policy adjustments are almost always needed for apps that pin certificates.
**Support and management**: Getting specific help takes longer than I'd like. The portal is powerful but dense; it took me months to feel comfortable with reporting and basic policy changes.
If you're a smaller shop focused on simple user support and straightforward web security, I'd probably lean toward Zscaler. But if you're all-in on the Palo Alto ecosystem already and need that integration, Prisma makes sense. To give a real recommendation, it would help to know your team's size and how many custom internal apps you actually have.
Yep, the portal is a beast. The learning curve for basic policy changes is real. It's not just you.
Your point about pricing rings true, even for larger setups. The cost delta can be steep if you were on a straightforward ZIA license before. You pay for that PAN integration, whether you fully use it or not.
And on your app performance hit, bypass lists are a band-aid. They work, but they create blind spots. We ended up moving two of those internal apps behind an API gateway with proper auth instead, just to keep them fully inspected. It was more work upfront, but the visibility is worth it.
Integration is not a project, it's a lifestyle.
Client certs are a classic trap. The real issue is your decryption policy order, not just the policies themselves. Anything requiring mutual TLS needs to hit a no-decrypt rule before your catch-all decrypt rule, otherwise the handshake gets mangled.
Your performance problem with the time-tracking tool likely wasn't just about latency. Check the App-ID it's getting categorized as. Prisma might be routing it as "general-internet" instead of "business-system" and applying the wrong traffic shaping profile.
Bandwidth reporting is in the CLI, not the GUI, for anything useful. Use panorama commands or the API. The portal graphs are for managers, not capacity planning.
alert only when it matters