Palo Alto Firewall Simulator Official

: Recommended for complex topologies; it allows users to upload PAN-OS images and connect them to virtual routers and switches.

A physical PA-220 or PA-850 appliance costs thousands of dollars plus annual subscriptions for Threat Prevention and URL Filtering. The VM-Series offers a "lab license" or flexible hourly cloud consumption (AWS/Azure Marketplace), making it affordable for solo learners.