Predictika · Palo Alto next-generation firewall quotes

An AI sales agent's firewall quote, checked before it goes out

An AI sales agent drafts a quote for Palo Alto next-generation firewalls in the PA-400, PA-1400, PA-3400 and PA-5400 series, in a standalone or high availability deployment, with security subscriptions or bundles and support. Before the quote goes out, the agent sends it to Predictika, which checks it against a declarative model, compares the total and the usable capacity the agent states with the ones it computes, and returns every finding together with the line-item quote.

Scope: Palo Alto PA-400, PA-1400, PA-3400 and PA-5400 series firewall quotes, with HA, subscriptions or bundles, support and discount authority. See everything this validator covers

This validator covers quotes for Palo Alto Networks PA-400, PA-1400, PA-3400 and PA-5400 series next-generation firewalls, their HA deployment and their Threat Prevention, Advanced URL Filtering, WildFire and DNS Security subscriptions or bundles. It does not cover Palo Alto's Prisma cloud or SASE products, or firewall series outside this range.

  • HA mode and capacity — firewalls quoted in pairs for HA, active/active restricted to PA-3400 and above, and usable capacity computed by HA mode against the required threat prevention throughput, then compared with the capacity the agent states.
  • Subscriptions and bundles — individual Threat Prevention, Advanced URL Filtering, WildFire and DNS Security subscriptions against the Core and Advanced bundles that replace them, the Threat Prevention prerequisite, and the security exception needed when no Threat Prevention is quoted.
  • Support and channel rules — Partner Enabled support sold only through certified partners, support priced by type and not discounted, and 1, 3 or 5 year terms.
  • Lead time, discount authority and stated total — delivery lead time against the need-by date, rep discount authority raised by deal registration, and the total the agent states.

Any PA-400 through PA-5400 quote that combines these models, HA modes, subscriptions, support types and discounts runs through this validator, not just the seven scenarios shown on this page. It is an illustrative model built from public information about the product series; prices, capacities, lead times and discount limits are fictional, and it does not use Palo Alto Networks' internal rules.

The AI sales agentBuilds the firewall quote from the conversation and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 4 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Usable capacity that depends on the HA mode (full for standalone, half for active/passive, 80 percent for active/active) compared with the required throughputOnly with care
Needs a calculated field per HA mode and a check against the requirement, kept in step with each model's rating; a quote that changes HA mode can quietly keep the old figure.		Capacity is computed from the model, the count and the HA mode on every call, and checked against the requirement and against the capacity the agent states.
Bundles that replace individual subscriptions, with prerequisites that switch off when a bundle is chosenOnly with workarounds
Each bundle needs its own product rules and exceptions, and prices must be kept consistent between bundle and individual paths; mixed selections slip through.		Bundles and subscriptions are data on one model; a mixed selection is a finding, and the quote is priced consistently either way.
Discount authority that rises with deal registration, on a discount base that excludes supportOnly with care
Approval thresholds and the discount base are separate rules; the deal-registration ceiling and the support exclusion must be set up and tested by hand for each combination.		The rep limit, the maximum with and without deal registration, and the undiscounted support line are all computed together.
A stated total or stated capacity that does not match the computed figuresOnly with care
A validation rule can compare a stated figure with a calculated field, but only if the stated figure is a field on the quote, which it rarely is.		The stated total and stated capacity travel with the quote and are compared with the computed ones on every call.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1High availability needs firewalls in pairs.
2Active/active high availability is not supported below the PA-3400 series.
3Usable capacity in the chosen HA mode is below the required threat prevention throughput.
4A bundle is quoted together with individual subscriptions.
5URL Filtering, WildFire or DNS Security is quoted without Threat Prevention or a bundle.
6No Threat Prevention is quoted (approval: security exception).
7Term other than 1, 3 or 5 years.
8Partner Enabled support sold direct.
9Firewall lead time longer than the need-by date.
10Discount above the maximum (40 percent, or 50 percent with deal registration).
11Discount above the 20 percent a rep may give alone (approval).
12The agent's stated total does not match the computed total.
13The agent's stated usable capacity does not match the computed capacity.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Usable capacity and term: Active/passive pair that falls short of 10 Gbps

    
The agent's request. Please quote 2 Palo Alto PA-3410 firewalls in an active/passive high availability pair for Harbor Point Logistics, with the Core security bundle, Premium support, a 2-year term and a 15 percent discount, sold direct. The pair must handle 10 Gbps of threat prevention traffic and is needed in 10 weeks. The quote states a usable capacity of 12.0 Gbps and a total of $70,040.00. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Not enough usable capacity. Usable capacity is 6 Gbps in active/passive mode, below the 10 Gbps of threat prevention throughput required.
    • 
      
  • Term not offered. Term must be 1, 3 or 5 years; 2 requested.
    • 
      
  • Quoted capacity does not match. Stated capacity does not match: the agent stated 12 Gbps; the validator computes 6 Gbps.
    • 
    

    
2. Usable capacity and term: The agent resubmits after fixing the errors

    
The agent's request. Please quote 2 Palo Alto PA-3440 firewalls in an active/passive high availability pair for Harbor Point Logistics, with the Core security bundle, Premium support, a 3-year term and a 15 percent discount, sold direct. The pair must handle 10 Gbps of threat prevention traffic and is needed in 10 weeks. The quote states a usable capacity of 11.0 Gbps and a total of $149,240.00. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Total $149,240.00: hardware $47,600.00; subscriptions $71,400.00; support $30,240.00.
    • 
    

    
3. Bundles and subscriptions: Core bundle plus separate subscriptions

    
The agent's request. Please quote 2 Palo Alto PA-3440 firewalls in an active/active high availability pair for Cedar Valley Credit Union, with the Core security bundle plus individual Advanced URL Filtering and WildFire subscriptions, Standard support, a 3-year term and a 10 percent discount, sold direct. The pair must handle 15 Gbps of threat prevention traffic and is needed in 10 weeks. The quote states a usable capacity of 17.6 Gbps and a total of $146,160.00. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Bundle quoted with separate subscriptions. The Core bundle replaces the individual subscriptions; remove the individual ones.
    • 
    

    
4. Bundles and subscriptions: The agent resubmits after fixing the errors

    
The agent's request. Please quote 2 Palo Alto PA-3440 firewalls in an active/active high availability pair for Cedar Valley Credit Union, with the Core security bundle, Standard support, a 3-year term and a 10 percent discount, sold direct. The pair must handle 15 Gbps of threat prevention traffic and is needed in 10 weeks. The quote states a usable capacity of 17.6 Gbps and a total of $146,160.00. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Quote summary. Total $146,160.00: hardware $50,400.00; subscriptions $75,600.00; support $20,160.00.
    • 
    

    
5. Channel, discount and delivery: Partner Enabled support sold direct, 45 percent discount, 8-week need

    
The agent's request. Please quote 2 Palo Alto PA-5410 firewalls in an active/passive high availability pair for Lakeshore Regional Health, with the Advanced security bundle, Partner Enabled support, a 3-year term and a 45 percent discount, sold direct. The pair must handle 20 Gbps of threat prevention traffic and is needed in 8 weeks. The quote states a usable capacity of 25.0 Gbps and a total of $326,825.00. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Support type not sold direct. Partner Enabled support is only sold through a support-certified partner.
    • 
      
  • Firewall cannot arrive in time. PA-5410 ships in about 12 weeks; needed in 8.
    • 
      
  • Discount above the maximum. Discount of 45 percent is above the 40 percent maximum; deal registration raises it to 50 percent.
    • 
    

    
6. Channel, discount and delivery: The agent resubmits after fixing the errors

    
The agent's request. Please quote 2 Palo Alto PA-5410 firewalls in an active/passive high availability pair for Lakeshore Regional Health, with the Advanced security bundle, Partner Enabled support, a 3-year term and a 45 percent discount, sold through a certified partner with deal registration. The pair must handle 20 Gbps of threat prevention traffic and is needed in 16 weeks. The quote states a usable capacity of 25.0 Gbps and a total of $326,825.00. It is ready to send.

    
Verdict: Needs approval.

    
    
      
  • Discount needs approval. Discount of 45 percent is above the 20 percent a rep may give alone.
    • 
      
  • Quote summary. Total $326,825.00: hardware $93,500.00; subscriptions $182,325.00; support $51,000.00.
    • 
    

    
7. Stated total: Stated total leaves out support

    
The agent's request. Please quote 2 Palo Alto PA-3440 firewalls in an active/active high availability pair for Summit Ridge Manufacturing, with the Core security bundle, Premium support, a 5-year term and a 10 percent discount, sold direct. The pair must handle 15 Gbps of threat prevention traffic and is needed in 10 weeks. The quote states a usable capacity of 17.6 Gbps and a total of $176,400.00. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Quoted total does not match. Stated total does not match: the agent stated $176,400.00; the validator computes $226,800.00.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent drafts a quote for Palo Alto next-generation firewalls in the PA-400, PA-1400, PA-3400 and PA-5400 series. Before the quote goes out, the agent sends it to Predictika, which checks it against a declarative model, compares the total and the usable capacity the agent states with the ones it computes, and returns every finding together with the line-item quote.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote 2 Palo Alto PA-3410 firewalls in an active/passive high availability pair for Harbor Point Logistics, with the Core security bundle. The pair must handle 10 Gbps of threat prevention traffic and is needed in 10 weeks. The rest of the request is on screen. The quote states a usable capacity of 12.0 Gbps and a total of $70,040.00.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with three findings, all in one answer. Usable capacity is 6 Gbps in active/passive mode, below the 10 Gbps of threat prevention throughput required. Term must be 1, 3 or 5 years; 2 requested. Stated capacity does not match: the agent stated 12 Gbps; the validator computes 6 Gbps.
    6. 
      
  6. The validator returned three blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for usable capacity that depends on the HA mode (full for standalone, half for active/passive, 80 percent for active/active) compared with the required throughput, a rules-based CPQ is error-prone for this.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the firewall model to PA-3440, the term to 3 years, the quoted usable capacity to 11 Gbps and the quoted total to $149,240.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. The validator also returns the line-item quote. It starts with PA-3440 and Core security bundle (Threat Prevention; the other line is on screen.
    13. 
      
  13. All three earlier findings are cleared, and the validator's total, $149,240.00, matches the quote.
    14. 
      
  14. Three problems caught in one call, fixed in one pass, and a clean $149,240 quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    15.