I've been evaluating several next-gen firewall vendors for an upcoming edge deployment, and every one of them is pushing a separate "zero trust network access" or "zero trust" module as a licensed add-on. The sales pitch is compelling—micro-segmentation, identity-aware policies, continuous verification—but the implementation details are often vague.
From a technical standpoint, these modules typically layer on:
* A user/device identity provider connector (usually syncing from Azure AD, Okta, etc.)
* An agent for endpoint posture assessment
* A policy engine that shifts rules from IP/port to user/device context
* Often, a TLS-terminating proxy for "inside-out" application access
My primary concern is whether this is meaningfully different from well-configured NGFW features I already pay for. Can I approximate the core tenets with:
* Detailed application-layer rules tied to AD groups
* Client certificate authentication for specific app portals
* Strict default-deny zones and inter-zone policies
I ran a basic performance test on one vendor's lab unit. Enabling their ZTNA module and moving 50% of rules to identity-based matching resulted in a 15-20% throughput drop for policy evaluation on east-west traffic. The latency for initial user/device context resolution added 80-100ms to the first packet of a new session.
**Key questions for those with production experience:**
* Does the ZTNA module genuinely reduce your attack surface in a way that traditional segmentation didn't?
* Is the performance hit consistent, and how do you architect around it?
* Are you finding these modules lock you into a specific vendor's ecosystem for endpoints and identity?
* Is the operational overhead of maintaining identity-to-IP mappings justified by the security gain?
I'm leaning towards the opinion that for most deployments, rigorous use of existing NGFW capabilities gets you 80% of the way there without the extra license. But I'm open to being proven wrong with data.
benchmark or bust
benchmark or bust
I'm a senior security architect at a mid-market healthcare services company, and we run Palo Alto Networks Prisma Access with their GlobalProtect agent for remote user ZTNA, alongside on-prem PAN firewalls with User-ID enabled for internal micro-segmentation.
Here's the framework I use when evaluating these add-on modules against native NGFW features:
1. **True Identity-Driven Enforcement**: A genuine ZTNA module will evaluate user identity *before* establishing a connection, often acting as a TLS proxy. Native NGFW User-ID features typically apply identity *after* the TCP session is established. In our PAN environment, this meant ZTNA stopped 100% of port-scans from authenticated users, whereas traditional User-ID rules just logged them.
2. **Performance Tax is Real**: Your 15-20% throughput drop aligns with what we saw. For policy evaluation, the shift from IP to identity context adds overhead. On our 5200-series firewalls, enabling full identity-based inspection for east-west traffic held steady at about 1.8 Gbps versus the rated 2.2 Gbps.
3. **Integration Effort & Hidden Costs**: The biggest cost isn't the license. It's the integration labor. Getting the agent deployed to all endpoints, syncing the identity provider, and building the new policy set took my team about 80 hours. Also, some vendors require you to license the module on *every* firewall where you want ZTNA policies, not just at the edge.
4. **Target Fit**: These modules are genuinely valuable for two specific scenarios: securing remote access for contractors/third-parties without putting them on your full VPN, and for internal segmentation of high-risk environments like research labs or PCI zones. For general user-to-server traffic inside a well-managed network, I've found traditional AD-group rules are sufficient.
I'd recommend the add-on if your primary driver is securing remote access for non-employee users or you have a regulatory requirement for internal micro-segmentation. To make a clean call, tell us the percentage of your users that are remote versus on-prem, and whether you have any compliance domains (like HIPAA, PCI) that need isolated enclaves within your main network.
null
That's a solid, practical framework. Your third point on integration labor is the real kicker that gets overlooked in the sales cycle.
It's not just deploying the agent. It's the ongoing operational debt: troubleshooting user issues when the agent misbehaves, keeping it updated alongside your OS patches, and managing the constant policy sync between your IdP and the firewall. That's a permanent headcount cost, not a one-time project.
The performance drop you measured is also a crucial data point for sizing. Many teams just look at the datasheet's base throughput, not the realistic throughput with these advanced services enabled. That alone can force a hardware tier upgrade.
Keep it constructive.