Only the bare metal ethernet ports reveal counters. On the Palo Alto, e.g., you can not monitor sub-interfaces. Many SNMP OIDs: There are many options to monitor the ASA via SNMP.VPN Session Monitoring: For a quick glance, the VPN session monitor is great to see all phase 1 and phase 2 security associations incl the TX/RX packet counts.Furthermore, the CLI on the ASA splits each ACL into the real objects with individual counters. On the Palo, you can only highlight the never used ones. It quickly reveals which entries are used very often and which ones are never used. ACL Hit Count: I like the hit counts per access list entry in the GUI.First, you must change the config-output format, and second, you cannot simply paste many lines into another device, since the ordering of these lines is NOT correct by default. This is not that easy on a Palo Alto firewall. Better CLI Commands at all: For Cisco admins, it is very easy to parse a “show run” and to paste some commands into another device.I know, Palo Alto also offers the “Preview Changes”, but it takes a bit more time to recognize all XML paths. On the Cisco ASA, they are quite easy to understand. Better “Preview CLI Commands”: I am always checking the CLI commands before I send them to the firewall.On the Palo, each entry to add, e.g., an application inside a security rule, takes a few seconds. You do not have to wait for the next window if you click on a certain button. Fast Management Suite: The ASDM GUI is really fast.

Download asdm image to cisco 5505 asa