Ready-to-deploy AWS and Azure reference architectures that drop the Enforza firewall and secure NAT into the hub of your network. Same egress, ingress and east-west control as the cloud-native firewall, at a flat per-firewall price with no per-GB data-processing tax. Deployed your team's way, in your own account.
Pick your cloud, then your size. Each tile jumps to its section, or deploys straight from here.
Four patterns, in Terraform and CloudFormation.
Dev, test or single-VPC small production.
One production VPC wanting basic resilience.
Multi-VPC or multi-account, one inspected edge.
Scale-out, transparent inspection, per-AZ isolation.
Four patterns, in Terraform and ARM.
Dev, test and single-zone small production.
Production HA across availability zones.
Multi-VNet, one inspected hub edge.
Horizontal scale, three gateways across zones.
Four real, validated patterns, in Terraform and CloudFormation and in two deploy flavours: single gateway, dual-AZ failover, TGW centralised egress, and a GWLB fleet. Each with its own diagram, deploy notes and a dated cost snapshot.
Four real, validated patterns, in Terraform and ARM and in two deploy flavours: single gateway, a zone-redundant pair across availability zones behind an internal load balancer with HA Ports, hub-spoke centralised egress, and a scale-out fleet. Each with its own diagram, deploy notes and a dated cost snapshot.
All the Terraform and CloudFormation lives in one public repository, AWS and Azure alongside each other. Clone it, pick a pattern directory and deploy in your own account.
Egress, ingress and east-west control with FQDN and SNI-based Layer 7 filtering, at a flat per-firewall licence with no per-GB data-processing tax. See pricing and the feature list.
The appliance source-NATs outbound, so it replaces the NAT gateway and filters egress in one hop. More on the secure NAT gateway.
It runs on a VM in your own account and streams logs to your own SIEM, never via Enforza's cloud. See how it works.
Priced against the cloud-native firewalls, the wedge is up to 60–80% on the firewall and NAT metering. Compare vs AWS Network Firewall and vs Azure Firewall.
If you operate a fleet of firewalls for clients, a sized, flat-priced landing zone is a partner-usable accelerator: the same inspected egress edge in every account you manage, at a price your clients can forecast.
A landing zone is the baseline network and account structure you deploy workloads into. Centralising egress through a firewall in the hub means one inspected, policy-controlled path to the internet for every workload, instead of a NAT gateway or firewall per VPC. Enforza sits in that hub slot as a network virtual appliance, doing secure NAT and Layer 7 egress filtering at a flat per-firewall price.
Both are ready to deploy. AWS has four validated patterns, from a single gateway to a GWLB fleet, in Terraform and CloudFormation. Azure has four validated patterns that mirror them, from a single gateway to a scale-out fleet: a single gateway, a zone-redundant pair across availability zones behind an internal load balancer with HA Ports, hub-spoke centralised egress, and a scale-out load-balancer fleet. The Azure set ships in Terraform and ARM, in a deployment-key and a marketplace-image flavour. All the templates are in the public repository. Pick your cloud from the two cards above.
Up to 60–80% on the firewall and NAT metering versus the cloud-native services, because Enforza is a flat per-firewall licence at $0/GB rather than a per-endpoint-hour, per-AZ, per-GB meter. It is a claim on the firewall and NAT charges, not your whole cloud bill: you still pay your cloud provider for the VM the appliance runs on and for cloud plumbing, which Enforza does not remove. Run your own numbers in the savings calculator.
Deploy the pattern that fits your estate on AWS or Azure, with the Enforza firewall and secure NAT in the hub. Flat per-firewall pricing, no per-GB tax. Start free, no card.
