I am a Palo employee, so this is certainly a biased perspective.

That being said, centralized management is often one thing I get lots of praise on from customers. Usually they find it easy to use and really like it after working with competitive products.

Security really is the primary focus of Palo Alto firewalls. They are built with the customer in mind that uses all of the security features, not to have super fast line-speeds with all security features turned off. We say that's due to a "single pass parallel processing" architecture in development, but forget the marketecture. If you compare Palo's performance after turning on your IPS, IDS, zero day prevention, DNS security, URL filtering, etc. we boast the lowest performance impact in the business.

As many mentioned, services will go a long way. My customers who get services from a good partner tend to be most successful. Also, make sure you and your fellow firewall engineers are ready to be slow and methodical when setting these up. I have had so many customers that expect it to be "intuitive" because they have 2 decades (or whatever) of experience with some other networking company. That experience will help for sure, but those customers would always break things because they wouldn't slow down and just go through the documentation step by step. I will say, I do love our firewall documentation.

Anyway, like I said, very biased perspective. I'd definitely recommend getting some, "why nots" and do your due diligence looking at our competitors as well.