Google Cloud NGFW pricing, and how to cut it.

It depends on the tier. Essentials — L3/L4 IP, port and protocol rules — is free. Standard adds FQDN objects, geo-location matching and threat-intelligence feeds at $0.0193 per GiB evaluated on north-south traffic, with no endpoint fee. Enterprise adds Palo-Alto-Networks-powered L7 IDS/IPS and URL filtering at $1.75 per endpoint-hour — about $1,278 per month per endpoint — plus $0.0193 per GiB, and on Enterprise the per-GiB charge applies to east-west internal traffic as well as north-south (rates dated 2026-07-21, directional). The endpoint is zonal, so genuine high availability means two or three of them.

The Essentials tier is genuinely free — stateful L3/L4 rules with no meter — and ordinary VPC firewall rules cost nothing either. The meter starts when you need more than IP-and-port control: domain-based (FQDN) egress rules, geo matching or threat intelligence put you on Standard's per-GiB charge, and L7 inspection puts you on Enterprise's per-endpoint-hour fee plus the per-GiB charge. So the honest answer is free for basic filtering, metered the moment you filter by name or inspect at L7.

Standard bills $0.0193 per GiB evaluated, north-south only, with no endpoint fee — and FQDN objects are a Standard-tier feature, so domain-based egress filtering does not need the Enterprise endpoint. At low volume that meter is genuinely cheap and we will say so: it crosses Enforza's roughly $288 all-in single-firewall cost at about 15,000 GiB of evaluated traffic per month. Below that, Standard's meter alone is the cheaper line; the case for a flat appliance there is trajectory — the meter grows with traffic forever while flat stays flat — plus one appliance replacing both the NGFW meter and Cloud NAT's separate $0.045-per-GiB meter.

Enterprise is $1.75 per endpoint-hour — about $1,278 per month per endpoint — plus $0.0193 per GiB evaluated, on east-west as well as north-south traffic. The endpoint is a zonal resource, so real high availability means two or three endpoints and the fixed fee multiplies before a byte is inspected: a two-zone pair starts around $2,556 per month. You are charged when a firewall rule evaluates a flow even if it denies it, and Standard's per-GiB charge is waived on flows Enterprise also inspects (rates dated 2026-07-21, directional).

No, and it is worth being clear about. FQDN objects are a Standard-tier feature: domain-based egress filtering costs $0.0193 per GiB with no endpoint-hour fee. The $1.75-per-endpoint-hour charge is for the Enterprise tier's Palo-Alto-Networks L7 IDS/IPS and URL filtering, not for basic FQDN rules. If a proposal prices FQDN egress control at Enterprise rates, it is overstating the native cost.

For basic control, nothing — VPC firewall rules and NGFW Essentials are free. The realistic GCP firewall cost question is about secure egress: filtering by domain puts you on Cloud NGFW Standard at $0.0193 per GiB, full L7 inspection puts you on Enterprise at $1.75 per endpoint-hour (multiplied for zonal HA) plus the per-GiB meter — and Cloud NAT, the other half of the egress path, is a separate metered product at $0.045 per GiB with its own gateway fee. Each meter is billed separately; add the ones that apply to your traffic. Enforza replaces that stack with one flat-priced appliance doing secure NAT and FQDN/SNI-based L7 egress filtering together.

Enforza is a flat per-firewall licence — about $239 per month per firewall, dropping to about $199 from your sixth — at $0 per GiB, plus the Compute Engine VM you run it on (an e2-standard-2 is about $48.92 per month, so a single firewall is roughly $288 all-in). Against Cloud NGFW Enterprise securing egress — the $1,278-per-month zonal endpoint, multiplied for HA, plus $0.0193 per GiB — the flat line is typically up to 60–80% cheaper, and the gap widens as traffic grows. Against Standard-only FQDN filtering at modest volume we will not overclaim: below roughly 15,000 GiB per month Standard's meter alone is cheaper, and the case is flat-versus-metered trajectory plus replacing Cloud NAT's separate meter too. Rates are directional and dated — run your own numbers in the savings calculator.

No. Enforza replaces the Cloud NGFW per-GiB and per-endpoint-hour fees — and Cloud NAT's separate metering, since secure source-NAT is built in — with one flat per-firewall licence. You still pay Google Cloud for the Compute Engine VM the firewall runs on and for normal internet data-transfer-out where it applies. The saving is on the firewall and NAT metering, not on Google Cloud's underlying infrastructure.