First, I want to say that I love my Palo Alto firewall, a PA-220.  It is a tiny box with a ton of features and owning a "lab" unit is perfect for being on a budget.  It is a very inexpensive annual subscription and gives me the ability to play with all those cool new features I should not try on the company firewall at work in production.  Now to the meat...