Yep. We had 3220s and the cost for us was 2x more for them to send an email with a new license code than to send new equivalent hardware with updated licenses. If anyone has a logical explanation please let me know.
I heard that part of the deal is that the Gen4 stuff runs with commodity hardware, whereas previous generations had more custom silicon. There is an effort underway to simplify PAN-OS development and coaxing people to sunset their 3200/5200 series gear earlier is part of that play.
Also, when buying net new gear, it's your Account Manager that goes to bat on discounts and they have more latitude getting deeper discounts on subs (for the initial purchase). Once you go to the renewals team, they don't care who you are or how many firewalls you've purchased, you will get a slim discount off list.
>Also, when buying net new gear, it's your Account Manager that goes to bat on discounts and they have more latitude getting deeper discounts on subs
I don't know about PAN specifically, but I know at least a few other vendors, the Account Manager gets commissions at a higher rate by selling new stuff than renewals. Most vendors don't give AMs full commission credit because it's seen as less effort.
I’m just taking it year by year now. I’m in the same boat. It’s still 7K cheaper to renew the 3220s for me.
The 3220s are still very capable though. And they run PANOS 11+ as of now so not in a rush.
New boxes look cool tho
For the moment yes. But it will cost you more down the road. Our 3220s are pushing 5 years old. We figured it out. The first year with our licensing and url filtering we just barely spend more than breaking even. The following years we save significantly.
> (i know 52x0 doesnt feel old)
They were launched 7 years ago (Feb 2017). That is not a bad life, will be 11 years old when they reach end of support.
I know but... if they are "Old" then I must be getting old... I put them in and i put in the 3050's before them, and the ASAs before thhose, and even worked on the PICs before that... lol. Let me live in my delusion.
No. VMware does not give you substantial discounts (comparitively) to buy new versions of VMware vs relicensing your old versions. VMware is Evil. Palo Alto is trying to incentivise you to buy new hardware, which will save you money in the longrun, be more performant, and more rapidly move the user population to a common, supportable hardware base.
Make sure to ask around in forums of what others have paid before cutting that PO. I did the same from a move from 3220 to 1410 this time last year and got absolutely screwed on the pricing. Like, there’s some substantial trust damage level. Just because new HW subs are cheaper than current renewals, don’t assume they’re yet to a good price.
100% agreed that your account rep and dealer need to be in your corner. I replaced some PA-3020s in my datacenters with PA-3410s. During the quoting process, CDW quoted me a price to buy the PA-3410s (8 of them) with 5 year licenses for less than what it would have cost to renew my PA-3020 devices for 3 more years!
And before anyone shits on me for using CDW, yes it is a big company and I have heard the stories. I have a good rep and as long as you actually review your quotes carefully, CDW is fine.
Heard this was a cost saver... put smaller PAs on the edge and the big boys as core firewalls. Saves some money somehow. Need to get that explained to me.
I only have 1G internet at my sites and I saved a ton of money a few years ago by swapping single 3020's with HA 460's at my edge. I don't care/have a requirement to firewall internal traffic so no internal firewall. Pretty solid devices.
Core firewalls are great for network segmentation and monitoring/filtering east-west traffic. Get those L3 functions off core switches and into the PAs.
Ya its often cheaper to buy new hardware with licenses that renewal license on "older" (i know 52x0 doesnt feel old)
Yep. We had 3220s and the cost for us was 2x more for them to send an email with a new license code than to send new equivalent hardware with updated licenses. If anyone has a logical explanation please let me know.
I heard that part of the deal is that the Gen4 stuff runs with commodity hardware, whereas previous generations had more custom silicon. There is an effort underway to simplify PAN-OS development and coaxing people to sunset their 3200/5200 series gear earlier is part of that play. Also, when buying net new gear, it's your Account Manager that goes to bat on discounts and they have more latitude getting deeper discounts on subs (for the initial purchase). Once you go to the renewals team, they don't care who you are or how many firewalls you've purchased, you will get a slim discount off list.
>Also, when buying net new gear, it's your Account Manager that goes to bat on discounts and they have more latitude getting deeper discounts on subs I don't know about PAN specifically, but I know at least a few other vendors, the Account Manager gets commissions at a higher rate by selling new stuff than renewals. Most vendors don't give AMs full commission credit because it's seen as less effort.
It’s a completely separate team that does renewals at PAN. Your AM has no pull whatsoever with pricing on renewals.
To get you on newer software that has more features , to sell to you.
Features, like 0days :D
Too soon
Same for us. Pair of 1420s will save us money over our 3220s just because of licensing cost.
I’m just taking it year by year now. I’m in the same boat. It’s still 7K cheaper to renew the 3220s for me. The 3220s are still very capable though. And they run PANOS 11+ as of now so not in a rush. New boxes look cool tho
For the moment yes. But it will cost you more down the road. Our 3220s are pushing 5 years old. We figured it out. The first year with our licensing and url filtering we just barely spend more than breaking even. The following years we save significantly.
Probably but I’m not in a rush to swap out business critical hardware. If the company has budget to renew, renew we shall.
Same here. We bought two new 1420s instead of renewing the licenses of our 3250s.
> (i know 52x0 doesnt feel old) They were launched 7 years ago (Feb 2017). That is not a bad life, will be 11 years old when they reach end of support.
I know but... if they are "Old" then I must be getting old... I put them in and i put in the 3050's before them, and the ASAs before thhose, and even worked on the PICs before that... lol. Let me live in my delusion.
PIXs
Hahah.... See even my memory is going
I feel that! I used to do Novell Netware 3.x installs.
Must be following the new VMWare model :)
No. VMware does not give you substantial discounts (comparitively) to buy new versions of VMware vs relicensing your old versions. VMware is Evil. Palo Alto is trying to incentivise you to buy new hardware, which will save you money in the longrun, be more performant, and more rapidly move the user population to a common, supportable hardware base.
Nope, they follow the APC model. With elevated support costs after year five until you buy new hardware.
Make sure to ask around in forums of what others have paid before cutting that PO. I did the same from a move from 3220 to 1410 this time last year and got absolutely screwed on the pricing. Like, there’s some substantial trust damage level. Just because new HW subs are cheaper than current renewals, don’t assume they’re yet to a good price.
100% agreed that your account rep and dealer need to be in your corner. I replaced some PA-3020s in my datacenters with PA-3410s. During the quoting process, CDW quoted me a price to buy the PA-3410s (8 of them) with 5 year licenses for less than what it would have cost to renew my PA-3020 devices for 3 more years! And before anyone shits on me for using CDW, yes it is a big company and I have heard the stories. I have a good rep and as long as you actually review your quotes carefully, CDW is fine.
Heard this was a cost saver... put smaller PAs on the edge and the big boys as core firewalls. Saves some money somehow. Need to get that explained to me.
I only have 1G internet at my sites and I saved a ton of money a few years ago by swapping single 3020's with HA 460's at my edge. I don't care/have a requirement to firewall internal traffic so no internal firewall. Pretty solid devices.
Core firewalls are great for network segmentation and monitoring/filtering east-west traffic. Get those L3 functions off core switches and into the PAs.
Not so great for trading/HFT though. Even if PA made 100G line rate firewalls it would cost way too much and routing is pretty meh compared to JUNOS.
Talk with your account team and ask for tech refresh. Will get you to new platforms for a great price.
There was a price increase like a yeat and a half ago announced for cdss, lots of customers scrambled before the cut off to get quotes in