

They are so often stateful and fall over when some scanner comes by, or if a light DNS DoS attack happens, compromising the entire access link, when the scanned systems or the DNS server weren’t even bothered by the amount of requests.
They introduce weird unexpected restrictions, like preferring to blackhole our customers traffic rather than accepting some asymmetric routing. And then we get blamed for their setup, which they don’t even know.
They ossify protocol development in general, requiring things like header encryption in QUIC to force them to ignore things that aren’t their business anyway.
They are apparently also expensive as hell, multiple customers have declined upgrades because they don’t have fast enough firewalls and not enough budget to buy faster ones.
Those are the ones that come to mind right now. There are also occasional bugs that make our or our customers lives difficult, but I can’t recall a clear one at the moment.
Yeah I’d second that. It’s good for discovering valid settings as you get start, and then once you want to do more complicated stuff, the XML option view becomes useful, and then if you want to try on CLI after all you can start using virsh to administer the same VMs.
At least that’s how I progressed through the stages as I started messing with a Windows VM for a game that doesn’t lend itself to hosting on Linux natively.