Cloud NGFW for Azure Pricing
Table of Contents
Expand all | Collapse all
-
- Cloud NGFW for Azure
- Cloud NGFW Components
- Cloud NGFW for Azure Supported Regions
- Cloud NGFW for Azure Limits and Quotas
- Cloud NGFW for Azure Pricing
- Cloud NGFW for Azure Free Trial
- Cloud NGFW Credit Distribution and Management
- Start with Cloud NGFW for Azure
- Manage Cloud NGFW Roles for Azure Users
- Integrate Single Sign-on
- Monitor Cloud NGFW Health
- Create a Support Case
- Register Your Cloud NGFW Tenant with a Palo Alto Networks Support Account
- Cloud NGFW for Azure Certifications
- Cloud NGFW For Azure Privacy and Data Protection
-
- About Rulestacks and Rules on Cloud NGFW for Azure
- Create a Rulestack on Cloud NGFW for Azure
- Cloud NGFW for Azure Security Rule Objects
- Create a Prefix List on Cloud NGFW for Azure
- Create an FQDN List for Cloud NGFW on Azure
- Add a Certificate to Cloud NGFW for Azure
- Create Security Rules on Cloud NGFW for Azure
- Cloud NGFW for Azure Security Services
- Enable DNS Security on Cloud NGFW for Azure
- Set Up Outbound Decryption on Cloud NGFW for Azure
- Set Up Inbound Decryption on Cloud NGFW for Azure
-
- Panorama Integration
- Panorama Integration Prerequisites
- Link the Cloud NGFW to Palo Alto Networks Management
- Use Panorama for Cloud NGFW Policy Management
- Enable User-ID on the Cloud NGFW for Azure
- Configure Service Routes for On-Prem Services
- Use XFF IP Address Values in Policy
- View Cloud NGFW Logs and Activity in Panorama
- Strata Cloud Manager Policy Management
-
- Configure Logging for Cloud NGFW on Azure
- Cloud NGFW for Azure Traffic Log Fields
- Cloud NGFW for Azure Threat Log Fields
- Cloud NGFW for Azure Decryption Log Fields
- Enable Log Settings
- Disable Log Settings
- Enable Activity Logging on Cloud NGFW for Azure
- Multiple Logging Destinations on Cloud NGFW for Azure
- View the Logs
- View Audit Logs on a Firewall Resource
- View Audit Logs on Resource Groups
- What's New
- Cloud NGFW for Azure Known Issues
- Cloud NGFW for Azure Addressed Issues
Cloud NGFW for Azure Pricing
Cloud NGFW for Azure pricing.
Pay-As-You-Go
Cloud NGFW is available as a pay-as-you-go (PAYG) subscription in the Azure Marketplace. With this model, you pay
only for what you use each month, and also enjoy Azure Marketplace benefits such as
consolidated billing and credit toward an organization’s Microsoft Azure Consumption
Commitment (MACC).
You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of
traffic, billed by the gigabyte, processed by the NGFW resource. Additionally, you pay
an hourly rate and for the amount of traffic processed by your Cloud NGFW resource when
you configure security services add-ons (such as Threat Prevention, Advanced URL
Filtering, DNS Security, or WildFire®) or the centralized management add-on (Panorama
management).
Credit Pricing Model
You can procure and associate Cloud NGFW for Azure Credits to your tenant by paying an
upfront cost for a long-term contract from a one-year to a five-year time frame. You can
procure these credits directly from Azure Marketplace or at a private price from Palo
Alto Networks or its partners. By purchasing credits you can also take advantage of
Azure Marketplace benefits such as consolidated billing, MACC committed consumptions and
automated renewals. Cloud NGFW credits allow you to consume Cloud NGFW resources in your
tenant at a lower cost up to a specific capacity until your contract expires. See Cloud NGFW Credits Management and Distribution
for more information on how to manage and distribute credits.
If your average consumption per month exceeds the purchased credits, overages apply at
PAYG rates.
If you add Cloud NGFW credits during a free-trial period, your contract begins
immediately and overrides the free trial.
Use the Cloud NGFW for Azure pricing estimator to help you determine Azure pricing for
your Cloud NGFW tenant.
Metering and Billing
Cloud NGFW consumption translates to PAYG hourly pricing or as Cloud NGFW credits as
described in the tables below.
Base NGFW Resource Consumption
You pay an hourly rate for each Cloud NGFW resource. You also pay for the amount of
traffic, billed by the gigabyte, processed by the NGFW resource.
Dimension | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Base NGFW Resource Usage | $1.25 | — | 104.17 |
Traffic Secured per GB per Tenant | — | $0.016 | 1.33 |
Add-ons | $0.12 per 10 Cloud NGFW Credits | — | See below for specific billing information for each add-on. |
Azure Networking Charges | — | $0.010 cents per GB | — |
Cloud NGFW for Azure bills the Egress usage (inbound, outbound, and east-west
traffic) under Azure Networking charges dimension, and then the Azure Marketplace
receives the consumption details. Azure virtual network pricing determines these
charges. For more information, see Virtual Network Pricing.
Each NGFW resource you deploy meters usage hours. Traffic is metered across all
NGFW resources deployed in your Cloud NGFW tenant.
Cloud-Delivered Security Services (CDSS) Consumption
Cloud NGFW for Azure bills the usages of these security services using the add-ons
dimension. Cloud NGFW for Azure measures usage in $/hour and $/GB as
detailed in the following table.
Advanced Threat Prevention Add-On | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour* | $0.375 | — | 31.25 |
Traffic Secured | — | $0.005 | — |
Advanced URL Filtering Add-On | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour* | $0.375 | — | 31.25 |
Traffic Secured | — | $0.005 | — |
Advanced WildFire Add-On | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour* | $0.375 | — | 31.25 |
Traffic Secured | — | $0.005 | — |
DNS Security Add-On | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour* | $0.250 | — | 20.83 |
Traffic Secured | — | $0.003 | 0.27 |
WildFire Add-On | Price (Per Hour) | Price (Per GB) | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour* | $0.250 | — | 20.83 |
Traffic Secured | — | $0.003 | 0.27 |
*Usage hour is metered on each NGFW resource with CDSS add-ons enabled.
Centralized Management Add-On
You can use a Panorama virtual appliance to manage policy rules in your
Cloud NGFW tenant. Centralized management add-on consumption is metered on each NGFW
resource for each hour you have associated with a Panorama appliance and for the
amount of traffic processed by that NGFW. The rate you’re charged for the traffic
also depends on the aggregate traffic processed by all NGFWs in the tenant during
the month (referred to as tiered traffic pricing).
You don't pay for additional device licenses for managing policy rules in Cloud
NGFW resources. Panorama does not count these NGFW resources against its managed
device license count.
Traffic Secured
|
Price per Hour
| Price per GB | Equivalent Cloud NGFW Credits |
---|---|---|---|
Usage Hour | $0.250 | — | 20.83 |
Traffic Secured
| — | $0.001 | 0.05 |
Azure Networking Charges
Palo Alto Networks incurs the VNet peering costs associated with the network
interfaces used to expose the Cloud NGFW Resource in the customer's subscription.
The customer incurs these costs based on the Azure virtual network peering pricing.
Migrate to the New Pricing Plan
Complete the following procedure to migrate your existing Cloud NGFW for Azure
resources to the new pricing plan (described above).
Complete the following
steps, regardless of the payment mode (PAYG or Private Contract), to take
advantage of the new pricing option.
Complete this procedure on each Cloud NGFW for Azure firewall.
- Log in to the Azure portal.
- Select your Cloud NGFW for Azure firewall deployed in your tenant and navigate to the Overview page.
- Click Change Plan.
- Select the new pricing plan. The new pricing plan does not have tiered pricing based on the amount of traffic secured.
- Click Change Plan to confirm.
- You can verify the plan change on the firewall Overview
page. The Plan ID will state
cloud-ngfw-payg. Moving to the new pricing plan requires no additional actions after completing the above procedure.