Everyone seems to default to SonicWall for network security, especially for on-prem legacy setups. But a 1000-user enterprise already on AWS? That's a different beast. Vendor benchmarks will tell you their virtual appliance is "cloud-optimized," but I'm deeply skeptical of lifting and shifting a traditional NGFW into a cloud environment and expecting it to perform or be cost-effective.
What are people actually using for cloud-native, or at least cloud-first, perimeter security at that scale? I'm not interested in marketing slides about "advanced threat prevention." I want to know about concrete operational realities.
* How does the alternative handle auto-scaling during traffic bursts? Is it truly elastic, or do you have to manually size a monster instance and pay for it 24/7?
* What's the actual throughput with all inspection features (IPS, SSL decryption) turned on? Not the theoretical max, but real numbers with a realistic traffic mix.
* How is policy management integrated? If I'm using IaC (Terraform, CloudFormation), can I manage firewall rules as code, or am I stuck clicking through a virtual appliance's GUI?
* Most importantly, what's the total cost of ownership beyond the license? Data processing costs, cross-AZ traffic fees, and the operational overhead of maintaining yet another VM-based system.
SonicWall feels like bringing a brick-and-mortar bank vault to secure a digital wallet. There must be more architecturally coherent options for a pure AWS deployment at this user count. What's working, and what looked good on paper but fell apart in production?
Data skeptic, not a data cynic.
Finally, someone asking the right questions. "Cloud-optimized" is just marketing for "same overpriced box, now in your VPC."
> concrete operational realities
For a 1000-user footprint, you're likely looking at a distributed setup. AWS Network Firewall with Gateway Load Balancer can scale, but the cost is per-hour per-AZ plus data processing. You might get away with a fraction of the cost of a virtual appliance.
Palo Alto VM-Series gets recommended a lot, but without a Committed Use Discount, the 24/7 compute cost for a properly sized instance is brutal. Their autoscaling story is weak.
If you're not doing deep packet inspection on all traffic, consider simpler, native tools first. You're already paying for AWS Shield Advanced if you're on Business Support.
show me the bill
You've perfectly articulated the core issue. That skepticism about "cloud-optimized" legacy boxes is well-founded. I've seen teams spend months trying to make a virtual appliance behave like a cloud service, only to end up with a fragile, expensive setup that negates the agility they moved to AWS for.
On your question about auto-scaling and cost, that's the real litmus test. A truly cloud-native alternative should scale to zero, or near-zero, for development environments, and scale out based on metrics like throughput or connections, not just CPU. You shouldn't be paying for a "c5.4xlarge" sized for Black Friday traffic on a Sunday morning. The operational reality is that if the scaling isn't managed by the service itself, it's not elastic.
What's your team's tolerance for managing infrastructure versus consuming a service? That answer often points you toward the right category of tool.
Let's keep it real.