Deploy Enforza from the Azure Marketplace.
Now live on the Azure Marketplace. A cloud-managed firewall and secure NAT gateway, delivered as a VM you launch in your own Azure network. Bring-your-own-licence — free through Azure. Get It Now from the portal, enable IP forwarding, and claim it in the console. You can be filtering in minutes.
- Azure VM offer
- BYOL — free through Azure
- Any x86_64 VM size
Also on the AWS Marketplace. Questions? support@enforza.io.
Up to 60–80% cheaper than Azure Firewall.
You bring the licence and pay Azure only for the VM — but the reason to run Enforza is the cost of the alternative. Azure Firewall bills a per-hour deployment fee plus a per-GB data-processing charge on every byte, forever. Enforza is one flat per-firewall line with no per-GB tax.
- 60–80% less, typically than Azure Firewall's per-hour deployment floor plus its per-GB data-processing charges, at modest egress
- $0/GB data-processing tax no per-gigabyte inspection charge — the appliance cost never grows with your traffic
- Flat per firewall one predictable licence line — never metered by vCPU, VM size, IPs or throughput
Savings of 60–80% are typical at modest egress; you still pay Azure's own compute and data-transfer charges, which apply to any appliance. Rates are directional and dated — run your own numbers in the savings calculator.
A firewall you own, managed like a service.
The Marketplace VM is the same Enforza firewall NVA used everywhere else — egress, ingress and east-west control with FQDN/SNI-based L7 and secure NAT — running on a VM in your subscription, managed from the Enforza console.
-
Firewall and secure NAT in one VM
Egress, ingress and east-west control with FQDN/SNI-based L7 filtering and source NAT — a single lightweight Linux VM in your own Azure network, not a metered managed service.
-
Bring-your-own-licence — free through Azure
The Marketplace offer is BYOL: Azure charges you nothing for the software. You pay only for the VM you run it on, and your Enforza plan is handled in the Enforza console — including a genuine free tier.
-
Self-registering, no key to paste
The image self-registers to your Enforza account using Azure's signed instance metadata (the attested document from the Instance Metadata Service). There is no registration key to copy — you simply claim the firewall in the console.
-
Managed from the console — nothing inbound
The firewall connects outbound-only to the Enforza cloud. There is no inbound management port and no admin UI to expose, so the security device adds no attack surface of its own.
Prerequisites
A short checklist. If you can create a VM and edit a route table in Azure, you have everything you need.
- An Azure subscription with permission to create a virtual machine, a network interface and (if the firewall is your egress point) a public IP.
- A target virtual network (network) and subnet — typically a subnet the firewall's interface sits in, with the workloads you want to inspect routed through it by a user-defined route.
- An Enforza account to claim the firewall in. You can create one free at the console — no card required for the free tier.
- A few minutes. The flow is deploy the VM → enable IP forwarding → claim → push policy.
Get it now, launch, claim — in five steps.
Deploy the VM from the Marketplace, flip on IP forwarding so a forwarding firewall actually forwards, then claim it in the console and push policy.
-
Get the Enforza offer on Azure Marketplace
Find "Enforza Secure NAT Gateway & Firewall (BYOL)" on the Azure Marketplace and choose Get It Now. It is a bring-your-own-licence VM offer, so Azure charges nothing for the software — you pay only for the VM you run it on.
-
Launch the VM and enable IP forwarding
Deploy the offer from the Azure portal (Get It Now → Create) or from your own ARM / Bicep template. Pick the virtual network, subnet and VM size — and optionally set an Enforza claim tag. Then do the one switch a forwarding firewall needs:
- Lets the VM forward packets that are not addressed to itself — mandatory for a forwarding firewall, or Azure silently drops every forwarded packet.
- Applies at the Azure network-interface level; the image already forwards at the OS level, so the NIC toggle is the one manual switch.
- Pairs with a user-defined route (UDR) whose next hop is the firewall's private IP, so your workload subnets exit through the appliance.
Key step Enable IP forwarding on the firewall's network interface (portal: the NIC's
IP configurations→ IP forwarding: Enabled, oraz network nic update --ip-forwarding true). Without it, Azure silently drops every forwarded packet. If the firewall is your egress point, also associate a static public IP so it keeps one outbound address. -
It self-registers — no key needed
On first boot the firewall registers itself to the Enforza control plane using Azure's signed instance metadata (the attested document from the Instance Metadata Service). There is no registration key to copy or paste. The connection is outbound-only — there is no inbound management port to open.
-
Claim the firewall in the console
In the Enforza console at console.enforza.io, open "Claim a firewall" and enter your Azure Subscription ID + Virtual Machine ID. The firewall binds to your account and appears in your fleet. To skip this step entirely, pre-set the
enforza:claimtag at deploy time and it binds automatically. -
Build & push policy — done
Author egress / NAT / L7 policy in the console (or through a GitHub pipeline) and push it to the firewall. Point a user-defined route at the appliance and you're filtering. Rollback is a route change away.
Which Azure VM size?
The Enforza licence is flat per firewall — never per vCPU or VM size — so size the VM for your throughput, not your bill.
- Architecture
- Any x86_64 (amd64) VM size. The image is amd64, so Arm-based VM families (Cobalt / Ampere Altra) are excluded by architecture — pick an Intel or AMD size.
- Production
- Use a general-purpose or compute-optimised family — Dsv5, Fsv2 and similar. A firewall carries sustained load, and the price does not change with VM size, so size for your throughput, not your licence.
- Evaluation
- A B-series burstable VM is fine for a quick eval, but avoid it in production: banked CPU credits throttle the box under sustained traffic. Move to a non-burstable size before you route real workloads.
- Not size-metered
- Enforza is licensed flat, per firewall — never by vCPU, VM size or throughput. Running a bigger VM costs you only the Azure compute difference, never more Enforza.
Self-patching, on your schedule.
The image keeps its own OS security updates current — you don't patch it by hand. When an update needs a reboot to take effect, Enforza surfaces a "reboot pending" badge passively in the console.
Enforza never reboots your VM for you. You choose the change window.
Common questions
What does Enforza cost on the Azure Marketplace?
The Marketplace offer is bring-your-own-licence (BYOL), so Azure charges nothing for the Enforza software. You pay Azure only for the virtual machine the firewall runs on. Your Enforza plan — including a genuine free tier — is handled in the Enforza console, separate from Azure billing.
Do I need a registration key or licence key to activate it?
No. The firewall self-registers to the Enforza control plane using Azure's signed instance metadata (the attested document from the Instance Metadata Service), so there is no key to copy or paste. After it registers, you claim it in the Enforza console by entering your Azure Subscription ID and the Virtual Machine ID — or pre-set the enforza:claim tag at deploy time so it binds automatically.
I deployed the VM and no traffic is being forwarded. What's wrong?
Almost always IP forwarding is still disabled. A forwarding firewall must have IP forwarding ENABLED on its Azure network interface, otherwise Azure drops every packet that isn't addressed to the VM itself. Enable IP forwarding on the NIC in the Azure portal (or with the CLI), then confirm your user-defined route sends the workload traffic to the firewall's private IP as the next hop.
The firewall registered, but I can't see it in the console.
A registered firewall still has to be CLAIMED into your account before it appears under your fleet. In the Enforza console open 'Claim a firewall' and enter the Azure Subscription ID plus the Virtual Machine ID of the firewall. If you set the enforza:claim tag at deploy time it binds automatically; otherwise the manual claim takes a few seconds.
Which Azure VM sizes are supported?
Any x86_64 (amd64) VM size — the image is amd64, so Arm-based families are excluded by architecture. For production use a non-burstable general-purpose or compute-optimised size such as Dsv5 or Fsv2; B-series burstable VMs are fine for evaluation but their CPU credits will throttle a firewall under sustained load. The Enforza licence is flat per firewall, so a larger VM only costs you the Azure compute difference.
Will Enforza reboot my VM to patch it?
No. The image self-patches its OS security updates. When an update needs a reboot to take effect, that is surfaced passively in the console as a 'reboot pending' badge — Enforza never reboots your VM for you. You choose when to reboot, on your own change window.
Where does the firewall send its management traffic and logs?
The control plane is outbound-only to the Enforza cloud — there is no inbound management port and no admin UI to expose. Log export streams to your own SIEM; logs never pass through Enforza's cloud.
Launch the VM. Claim it. Push policy.
Bring-your-own-licence on the Azure Marketplace, self-registering, managed from the console. Start free — no card — and be filtering in minutes.