We spent two weeks putting the Palo Alto Networks PA-4020 through a series of tests designed to measure its capabilities. During our testing, the PA-4020 was connected to the Internet and was able to download virus, threat and URL filtering updates. We also updated the software on the PA-4020 once during the test, from 2.0.1 to 2.0.3. We did encounter problems during the update, and had to have Palo Alto's technical support team apply fixes to our configuration to make it compatible with the new software version.

We started by installing the PA-4020 as a tap on an existing connection used to serve about 1,000 DSL users. During the initial installation, we looked at the management interface for the PA-4020 and evaluated the policy definition and visibility tools available in the PA-4020. Because the PA-4020 supports layer 2, layer 3 and tap mode, we were able to evaluate the capabilities of the system without interfering with existing traffic.

Once we were confident that we understood the operation, we installed the PA-4020 in-line as a layer 2 firewall with the same DSL connection, applying threat protections and some application blocking. We also waited for the phone to ring, possibly indicating that the PA-4020 was improperly blocking traffic. We did catch a few complaints and false positives at this point.

At the same time, we put the PA-4020 in-line with our live antispam/antivirus gateway to see how well it would catch viruses "in the wild". We let it run for a week, and then compared the logs of the PA-4020 to the logs of the antivirus scanner on the e-mail gateway to see which viruses the PA-4020 had caught, and which it had missed.

Next, we moved the PA-4020 to a more controlled environment, our own wireless network, and began to explore each of its capabilities in depth, including application identification, specific virus testing, SSL man-in-the-middle decryption, network address translation, firewall policy definition, URL filtering and intrusion-prevention/detection system (IDS/IPS) signatures. We ran numerous small tests to determine how well the PA-4020 performed each of these tasks. This part of the test also contributed to our evaluation of the policy definition tools and visibility tools in the PA-4020.