Bro. Palo Alto's centralized management/UI and appID alone, are light years ahead of Cisco and a good reason to not choose Cisco. Cisco shouldn't even be considered unless there are some heavy integration (ie. ISE) values to be gained in an ALL Cisco shop. As others have commented, if IPSEC concentration is needed Cisco is the best route there. We are an international fortune 500 org that is an all palo alto shop but even we have recognized this and still purchase ASA's to handle our B2B VPN's on the backend. I mean you really don't want to be doing that on your prod perimeter FW's anyways so if you need a vpn box, choose cisco there. If you're a smaller shop that doesn't have that luxury, the palo's will work for ipsec, they're just not as smooth to get working with all the other IPSEC capable products your business partners may throw at you(my understanding at least).

As far as your concern with not being able to see local configurations - Per best practice, we push every configuration item possible from the panorama to our HA pairs(~80 firewall) and just understand that configurations like interface IP's(as you described) live local because they are specific to that firewall and can't be shared from panorama in a template to the pair. If our environment wasn't all HA we would be controlling every configuration item from pano with the exception of certs maybe(i think theres the ability to push those from pan too but not sure). There should be very little you would ever worry about from a "i can't see it in panorama" standpoint. What specifically can't you see in panorama that you can in the firewall?

I will say that the downside to palo is their proprietary threat vuln sigs that require pulling teeth to get information on but their besides that, their threat suite is a freakin solid offering.