The biggest selling point of Check Point's software to me is the management.
NSX has deeply, deeply terrible rule lifecycle management tools. There's not a good way to find out who made a rule, when it was made, and so on. There's also no way to specify a source/destination/service of "None". New rules always start with "Any" in all those fields, and they're set to apply to Distributed Firewall. This all combines to form a "fun" problem: I have repeatedly found Any/Any/Any/Accept rules in my NSX policy, and nobody can tell me how they got there. Current speculation is somebody started making a rule, and some UI glitch dropped the modifications they were making to constrain the Any/Any/Any/Accept to the proper matching criteria. Check Point's audit logging is far more mature.
Last time I checked, each vCenter needs its own NSX manager, and you can't use dynamic matching criteria for VMs owned by another vCenter or for IP Sets. You can't say "All of this application's web servers should be able to talk to all of this application's database servers regardless of datacenter" in a simple way. It involves building a lot of manual objects and manually adding them to rules.
This next one is truly bizarre: in my testing, NSX has worse performance than sending frame out to a separate firewall then back to another VM on the same host. I have no idea how this can be the case, but my tests showed it very consistently. It's not a small performance gap either, it was something like half the throughput. I never got to dig very far into this, as I only got to test it after somebody else had already decided to purchase NSX.
