Virtual Appliance Performance is comparable to the equivalent Physical Appliance until the latter use its own ASICs (for a good reason), e.g. Palo Alto with its new generation Firewall...
Let’s do a bit of math combined with a few minutes of Googling ;)
Palo Alto has numerous hardware models. The low-end ones provide ~1 Gbps of throughput, the flagship models go up to 20 Gbps of throughput. They also offer a VM-based product that they claim has 1 Gbps of throughput when running on four CPU cores.
High-end Cisco’s C-series servers have 4 processors with up to 8 or 10 cores per processor with prices “starting @ $7,950”. Pushing 1 Gbps of “Palo Alto throughput” through that server requires one half of one processor or less, and you can push up to 10 Gbps of “next-generation firewalled” traffic through a fully-loaded box (which just happens to have two 10 Gbps interfaces).
HP ProLiant DL980 G7 server has 80 processor cores, for 20 Gbps of “next-generation firewalled” throughput ... and a very reassuring price tag of “starting @ $33,585”. Nah, I’d go for two C460-M2s.
Interestingly, the licensing fee you have to pay for the Palo Alto VM appliances isn’t exorbitantly high. According to an online price list I found some people get the VM-200 for $4,050 while the price list for full-blown PA-5060 on same web site exceeds $130,000. Even when buying twenty individual VM-200 licenses I’d have ~$50,000 left to buy the hardware (and there seems to be a volume bundle with 25 licenses at ~$70.000, leaving ~$60,000 for the hardware). Hmmm, maybe I could afford the DL980 G7 after all.
Someone pointed out in one of my Interop presentations that you have to consider the increased power utilization when using multiple Intel servers instead of a single appliance - and he was absolutely right. For a complete picture, consider also related cooling costs and costs of the rack space.
Summary: From my naively ignorant perspective there’s no good reason for dedicated ASICs in network services appliances ... unless you want to filter a single 10Gbps stream, in which case you probably have a design problem to start with.