I’ve been looking into setting up a virtual firewall for a couple of Azure-hosted projects, and SonicWall’s NSv keeps coming up. My team currently uses a mix of physical firewalls on-prem and we’re trying to standardize our cloud security approach.
I’ve read the overview docs, but I’m hoping to hear from anyone who’s actually running the NSv in Azure for production workloads. Specifically, I’d be curious to know how it compares to using Azure’s native firewall services, like Azure Firewall.
Some points I’m trying to weigh:
- How is the management experience compared to managing a physical SonicWall appliance?
- Are there any unexpected costs or performance quirks in Azure that aren’t obvious from the datasheet?
- For those who have used both, does the NSv feel like a true extension of the SonicWall ecosystem, or does it feel like a separate product with limitations?
I’m particularly interested in use cases involving application filtering and VPN connectivity for remote teams. Any insights on setup complexity or day-to-day administration would be really helpful.
Thanks!
Having deployed and managed NSv series appliances in Azure for about two years, I can share some concrete observations that align with your questions.
The management experience is nearly identical to the physical hardware, which is its primary advantage if your team is already skilled with SonicOS. The same GUI and CLI are there. However, this comes with a significant operational caveat: you're responsible for the underlying Azure VM, including its scaling, availability sets, and disk performance. An unexpected cost often overlooked is the data egress charges for all traffic inspected by the NSv, which can become substantial if you're filtering internet-bound traffic for heavy applications. Azure Firewall, being a native PaaS service, abstracts that VM management away and includes its own, different, cost structure.
Regarding your point about it feeling like a true extension, it does for core firewall and VPN functions. The configuration syncs and policy management are consistent. Where it begins to feel separate is in integration with Azure-specific services. For example, orchestrating dynamic updates to its internal IP based on a scaled application backend requires custom automation, whereas Azure Firewall can integrate more natively with service tags and managed identities.
For your use case of application filtering and remote team VPNs, the NSv is competent. The SSL VPN client experience is identical to on-prem. Just be prepared to design your own high-availability solution using Azure Load Balancers and to monitor VM series performance limits; the datasheet throughput numbers assume optimal VM sizes and aren't always sustainable under variable traffic patterns.