Worked example
Azure Firewall cost, worked line by line and cut about 72%.
Built from public pricing, 2026-07-27. No customer quoted. Check our maths.
A two-network hub-and-spoke workload pushing 20 TB a month through Azure Firewall Standard costs about $1,232.50/month. The same workload on Enforza is a flat $239 licence plus the VM you run it on, near $339/month all-in. Every figure below is a public list price with a dated source, so you can follow the arithmetic yourself.
20 TB/month egress, one firewall USD · 2026-07-27 · directional
| Option | What it does | Per month |
|---|---|---|
| Azure Firewall Standard | Filtering + its own SNAT | $1,232.50 |
| Enforza, all-in | Firewall + secure NAT, flat | $339 |
| You keep | Roughly 72% of the firewall bill | $893.50/mo |
Azure Firewall Standard at $1.25/deployment-hour + $0.016/GB, US list, dated 2026-07-04. Enforza is a flat $239/firewall licence ($199 from your sixth) at $0/GB, plus the $100 VM shown. Both directional. Full breakdown below.
One workload, two networks, 20 TB of egress a month
A standard hub-and-spoke on Azure: application workloads in a spoke network, routed out through a single Azure Firewall Standard in the hub network. That one firewall inspects egress for both networks, so we price it as one deployment — we are not inflating the Azure side with extra instances.
Spoke network Application VMs
Hub network Firewall + SNAT
Internet Outbound
Held constant across both sides
- 730 hours in the month (24 × 365 ÷ 12)
- 20 TB egress, counted as 20,000 GB (1 TB = 1000 GB)
- One firewall / secure-egress path
- USD list price, so there is no FX assumption
What Azure Firewall Standard bills for 20 TB
Two meters run in parallel: a fixed per-deployment-hour fee you pay even at idle, and a per-GB data-processing charge on every byte the firewall handles. Here they are, itemised.
Azure Firewall Standard — monthly, 20 TB egress
- Deployment-hours ($1.25 × 730)
- $912.50
- Data-processing ($0.016 × 20,000 GB)
- $320
- Azure Firewall Standard total
- $1,232.50
Premium raises the deployment-hour rate to $1.75 (the per-GB rate is the same $0.016), so the identical workload on Premium is about $1,597.50/month. The Basic SKU is a different rate card ($0.395/hour, $0.065/GB) and is not shown here — we never mix SKU rates. Figures exclude Azure VNet bandwidth / data-transfer, which applies to any egress path.
What the same workload costs on Enforza
One flat per-firewall licence at $0/GB, plus the Linux VM you run it on. We put our own VM cost on the bill, because leaving it out would flatter the number and the honesty is the whole point.
Enforza — monthly, same 20 TB egress
- Enforza licence, 1 firewall (flat, $0/GB)
- $239
- Your Linux VM (illustrative, 2-vCPU, on-demand)
- ~$100
- Enforza all-in total
- ~$339
The licence is a real, billable USD price ($239/firewall, dropping to $199 from your sixth) — not a currency conversion. The VM is your cost on your own cloud bill and the only extra line; a small-to-midsize Linux VM is typically $70–$150/month on-demand. The 20 TB slider does not move the Enforza licence at all — that is the point. At this throughput even a modest VM has ample headroom.
Same core job: stateful L3–L7 egress filtering, FQDN/SNI-based L7 without decrypting TLS, secure source-NAT and east-west inspection, in the same hub-and-spoke topology. Enforza's single-pass packet classification and verdict engine classifies each flow once, in microseconds (p99 ~49.5 µs, verified), then enforces in-kernel at line rate — and its control plane is outbound-only, so there is no inbound management port to expose.
Same egress control, about 72% off the firewall bill
Azure Firewall Standard → Enforza, 20 TB/month ~72%
about $893.50/month saved
· ~$10,722 a year, directional
On the Premium SKU the same workload is ~$1,597.50/month, so the
saving against Premium is about 79%.
Why the gap widens as you grow
| Monthly egress | Azure Firewall Standard | Enforza licence |
|---|---|---|
| 10 TB | $1,072.50 | $239 flat |
| 20 TB (this example) | $1,232.50 | $239 flat |
| 40 TB | $1,552.50 | $239 flat |
Firewall metering only (the VM is constant for this workload class). Azure's per-GB meter climbs with every terabyte; the Enforza licence does not move. That divergence is the whole argument.
AWS NAT Gateway at 20 TB, for the NAT-cost crowd
If your bill is a NAT Gateway rather than a managed firewall, the same 20 TB tells a similar story. We keep this one deliberately conservative: a plain NAT Gateway, connectivity only, and we leave data-transfer-out off both sides because it applies to any egress path.
AWS NAT Gateway — monthly, 20 TB
- Gateway-hours ($0.045 × 730)
- $32.85
- Data-processing ($0.045 × 20,000 GB)
- $900
- NAT Gateway total — connectivity only
- $932.85
Plain plumbing — no filtering, no policy. Verified against the AWS VPC pricing page, US East, 2026-07-27.
Enforza — same 20 TB
- Enforza licence, 1 firewall (flat, $0/GB)
- $239
- Your EC2 VM (illustrative, 2-vCPU, on-demand)
- ~$100
- Enforza all-in total
- ~$339
Secure NAT and a full L3/L4/L7 firewall — about 64% less than the NAT Gateway that only does connectivity, about $7,126 a year, directional.
What we deliberately do not claim: AWS no longer double-charges here. Since 6 February 2026, AWS waives the NAT Gateway's own hourly and per-GB fee once it is service-chained behind an AWS Network Firewall endpoint, so filtered egress on AWS is one metered product, not two. The honest wedge is that Network Firewall's own $0.065/GB rate is higher than the $0.045/GB NAT fee it replaces, and it still runs a per-endpoint-hour fee per Availability Zone. We also leave data-transfer-out ($0.09/GB) off both sides, because Enforza's own VM would pay it too.
What we left out, and why
A worked example is only worth trusting if it says what it does not count. Here is exactly what sits outside these numbers, so nothing is hiding.
-
Cloud bandwidth / data-transfer-out
Charged by every provider on egress regardless of the firewall you pick — including Enforza's own VM. Counting it would inflate both sides equally, so it is out.
-
Reserved / committed-use discounts
Both the cloud firewall and the Enforza VM can be discounted with commitments. We price on-demand list on both sides so it stays like-for-like.
-
Per-Availability-Zone multipliers
We price one firewall. AWS Network Firewall adds a per-endpoint-hour fee per AZ; Enforza's resilience is your choice of how many VMs to run. One-for-one here.
-
High-availability doubling
Run two Enforza VMs for HA and the compute line roughly doubles (near $140), and you still save around 68% versus Azure Firewall Standard. Your call, shown honestly.
Method: 730 hours a month, 1 TB = 1000 GB, one firewall, US public list price, USD end-to-end. Every rate is dated and linked below. Change any input in the savings calculator to model your own estate.
Azure Firewall cost example — common questions
Is this a real customer, or a made-up number?
Neither a customer nor a made-up number. This is a worked example built entirely from public list prices, with a dated first-party source for every figure. No customer is quoted or implied anywhere on this page. We publish worked examples precisely so you can check the arithmetic yourself, line by line, rather than take a case study on trust.
How much does Azure Firewall cost for 20 TB a month?
On the Standard SKU, a single Azure Firewall in a hub-and-spoke network handling 20 TB of egress a month works out at about $1,232.50/month: $912.50 in deployment-hours ($1.25/hour × 730 hours) plus $320 in data-processing ($0.016/GB × 20,000 GB). On the Premium SKU the deployment-hour rate is $1.75/hour, so the same workload is about $1,597.50/month. Rates are US list price, dated 2026-07-04, directional and subject to change.
What does the same workload cost on Enforza?
A flat $239/month per firewall (USD, the real billable price; $199 from your sixth), plus the Linux VM you run it on. We put a conservative $100/month VM line in the example so we are counting our own compute cost, not hiding it — so the Enforza side lands near $339/month all-in. That is roughly 72% less than Azure Firewall Standard for the same 20 TB, and the gap widens as your traffic grows because the Enforza licence never moves with volume.
Why do you include the cost of your own VM?
Because leaving it out would flatter the comparison, and the honesty is the whole point. Enforza runs as a network virtual appliance on a Linux VM in your own cloud account, so you pay your cloud provider for that VM. We show it as a line item. Note that Azure Firewall's own managed compute is already baked into its per-hour fee, so this is a like-for-like read of the firewall's cost plus the single VM we ask you to run.
How did you calculate the saving?
Azure Firewall Standard total ($1,232.50) minus the Enforza all-in total ($339) is $893.50/month, which is 72% of the Azure bill — about $10,722 a year, directional. We use 730 hours a month, 1 TB = 1000 GB, one firewall, and public US list prices. Change any input and the number changes; run your own figures in the savings calculator.
Is this a fair comparison — does Azure Firewall do more?
We keep it fair both ways. On the core egress job — stateful L3–L7 filtering, FQDN/domain allow-listing, outbound source-NAT and east-west inspection in a hub-and-spoke network — Enforza and Azure Firewall are at parity, and Enforza filters SNI/FQDN without decrypting TLS. Azure genuinely wins on deep Azure-native integration, being fully Microsoft-managed, Microsoft threat intelligence and the Premium signature IDPS. The full, row-by-row breakdown, including where Azure wins, is on the Enforza vs Azure Firewall comparison.
What about AWS NAT Gateway at 20 TB a month?
A single AWS NAT Gateway pushing 20 TB is about $932.85/month for connectivity alone: $32.85 in gateway-hours ($0.045/hour × 730) plus $900 in data-processing ($0.045/GB × 20,000 GB), and it does no filtering. Enforza does secure NAT and a full firewall for about $339/month all-in, roughly 64% less — while adding the egress filtering a NAT Gateway can't do. AWS rates verified 2026-07-27, US East, directional.
Why don't you count AWS data-transfer-out in the NAT example?
Because it is not a fair part of the wedge. AWS charges data-transfer-out to the internet at $0.09/GB on top of the NAT Gateway's data-processing charge, but that transfer-out charge applies to any egress path, including the VM Enforza runs on. Including it would inflate both sides equally and overstate the difference. We compare the NAT Gateway's own $0.045/GB data-processing charge against Enforza's $0/GB, and leave transfer-out out of it. Keeping AWS claims conservative is deliberate.
Doesn't AWS double-charge you once you add a firewall?
Not any more, and we won't claim it does. Since 6 February 2026 AWS waives the NAT Gateway's own hourly and per-GB fee when it is service-chained behind an AWS Network Firewall endpoint, so filtered egress on AWS is one metered product, not two stacked meters. The honest wedge is that Network Firewall's own $0.065/GB data-processing rate is higher than the $0.045/GB NAT fee it replaces, and it still runs a per-endpoint-hour fee per Availability Zone. Either way, Enforza replaces the whole stack with one flat licence at $0/GB.
How current are these prices?
Azure Firewall rates were re-verified live on 2026-07-04; AWS NAT Gateway rates were verified against the AWS VPC pricing page on 2026-07-27; the Enforza price is the live, real billable USD price. All figures are directional and subject to change — if any source has moved since, tell us and we will fix it fast. Every source is linked and dated at the foot of this page.
The maths checks out. Now run yours.
Cut the Azure Firewall bill, flat, no per-GB tax.
Same egress, ingress and east-west control with FQDN/SNI-based L7 filtering and secure NAT in one appliance, at a flat per-firewall price with no data-processing charges and no per-deployment-hour fee. Start free, no card.