Palo Alto next-gen firewall stacks up well