A customer with a legacy firewall architecture is focused on port and protocol level security,...

A common misconception about next-generation firewalls (NGFWs) is that they open all ports by default. The appropriate rebuttal to this is that Palo Alto Networks' NGFWs have default policies that block all interzone traffic. The firewalls only open ports based on policies that specify which applications are allowed. This approach enables precise control over network traffic by allowing administrators to define policies that control applications by their default ports or a list of approved ports, thus enhancing security compared to legacy firewalls that focus only on port and protocol.

References:

Palo Alto Networks Next-Generation Firewall Features

Palo Alto Networks Security Policy Configuration Guide