July 10, 202615 min read

FortiGate VM vs Palo Alto VM-Series vs Check Point CloudGuard: Cloud NGFW Comparison 2026

Sources:Fortinet FortiGate-VM deployment guides for AWS, Azure, GCP|Palo Alto VM-Series firewall deployment documentation|Check Point CloudGuard Network Security documentation|AWS Gateway Load Balancer architecture with virtual NGFW partners|Gartner Magic Quadrant for Network Firewalls 2025

Eric Bang

Founder & Cybersecurity Evangelist

Instance throughput

the primary constraint in virtual NGFW: unlike physical appliances with dedicated ASICs, VM-based firewalls are limited by the throughput of the underlying cloud instance type. A FortiGate VM on a c6n.8xlarge tops at ~20 Gbps; a VM-Series PA-VM-700 on equivalent hardware reaches similar limits. ASIC-accelerated throughput from physical appliances does not transfer to VMs

PAYG licensing

pay-as-you-go licensing from cloud marketplaces: VM-NGFW instances include the software license in the instance hourly rate, enabling hour-level elasticity without upfront license commitments. BYOL (bring your own license) is cheaper at sustained usage but requires managing license pools

Auto-scaling group

the cloud-native pattern for handling NGFW traffic bursts: new VM instances launch automatically when traffic exceeds defined thresholds and terminate when traffic drops. Auto-scaling requires stateless or state-synchronized firewall design -- FortiGate, PA, and CloudGuard all support this but with different implementation complexity

Gateway Load Balancer

AWS GWLB: the recommended architecture for inserting virtual NGFWs into VPC traffic paths using GENEVE encapsulation. All three platforms (FortiGate, PA VM-Series, CloudGuard) are AWS GWLB partners, enabling transparent bump-in-the-wire inspection without changing routing tables for individual VPCs

Cloud NGFW Architecture: How Virtual Appliances Fit Into Cloud Networks

Understanding traffic insertion architecture is the foundation for evaluating virtual NGFWs -- the deployment model determines performance, scalability, and operational complexity.

AWS Gateway Load Balancer (GWLB) architecture

GWLB is the recommended architecture for deploying virtual NGFWs across multiple AWS VPCs. A centralized security VPC hosts the NGFW auto-scaling group behind a GWLB. Spoke VPCs use GWLB Endpoints to steer traffic to the security VPC for inspection using GENEVE encapsulation -- traffic enters the NGFW, is inspected, and exits to its destination, all transparently. This architecture enables a single pool of NGFW instances to inspect traffic from dozens of VPCs without modifying each VPC's routing. FortiGate VM, PA VM-Series, and CloudGuard are all AWS GWLB certified partners.

Azure Route Server and hub-and-spoke with NVA

In Azure, virtual NGFWs (Network Virtual Appliances) are deployed in a hub VNet. Azure Route Server enables the NGFW NVA to advertise routes dynamically to spoke VNets, replacing the need for manual UDR (User Defined Route) management. The NGFW inspects east-west traffic between spoke VNets and north-south traffic to the internet. FortiGate VM integrates with Azure Route Server natively; PA VM-Series and CloudGuard both support Route Server as well. Azure's native Azure Firewall competes with these NVAs for simpler use cases at potentially lower complexity cost.

GCP Cloud Interconnect with internal load balancer sandwich

In GCP, virtual NGFWs are deployed in an ILB sandwich architecture: an internal load balancer on each side of the NGFW tier distributes traffic for HA and scale-out. Google's recent introduction of Network Connectivity Center (NCC) with integrated NGFW inspection (Fortinet and Palo Alto are first partners) is changing this architecture -- cloud-native insertion is available without the ILB sandwich complexity.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

FortiGate VM

Fortinet's FortiGate VM is the market share leader in cloud virtual NGFW deployments by volume, driven by Fortinet's broad enterprise installed base, competitive pricing, and tight integration with the FortiOS ecosystem.

Performance and instance sizing

FortiGate VM throughput scales with the underlying cloud instance. On AWS, the FGT-VM64 series supports multiple instance types up to c6n.8xlarge, achieving approximately 20 Gbps firewall throughput and 10 Gbps threat protection throughput with full UTM enabled. FortiGate VM supports SR-IOV on supported instance types for improved network throughput. The throughput numbers are honest -- Fortinet publishes performance by instance type rather than citing ASIC-accelerated numbers that don't apply in VM environments.

FortiOS consistency

Organizations running FortiGate physical appliances get consistent FortiOS behavior in the VM: the same CLI, the same policy syntax, the same FortiGuard threat intelligence feeds, and the same FortiManager/FortiAnalyzer integration for centralized management. This consistency reduces the operational learning curve for organizations extending from on-prem to cloud. FortiGate VM is often the lowest-friction path for Fortinet-centric shops moving workloads to cloud.

Licensing and marketplace

FortiGate VM is available on AWS, Azure, and GCP marketplaces in PAYG (license included in hourly instance price) and BYOL (bring your own license) models. PAYG licenses scale with instance size -- a larger instance type costs more per hour. FortiGate VMs are also available via Fortinet Flex-VM, a license portability system that allows organizations with physical FortiGate licenses to run equivalent VM licenses in cloud without additional purchase, up to the licensed throughput.

Auto-scaling

FortiGate VM auto-scaling is supported in AWS and Azure using cloud-native auto-scaling groups. Fortinet provides CloudFormation templates (AWS) and ARM templates (Azure) for auto-scaling deployments with GWLB integration. The auto-scaling implementation includes a FortiGate auto-scaling master that coordinates license activation for new instances and synchronizes configurations. Setup is more complex than manual HA pair deployment but production-ready with the provided templates.

Weaknesses for cloud deployments

FortiGate VM's advanced threat inspection features (sandboxing, FortiSandbox) require integration with FortiSandbox Cloud, adding latency for inline inspection of unknown files. FortiOS's SD-WAN features, while mature in physical appliances, have some limitations in pure cloud deployments where SD-WAN underlays are cloud provider connections rather than MPLS or broadband. FortiGate VM management requires FortiManager or FortiCloud -- the cloud console experience is adequate but not cloud-native in the way AWS-native services are.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Free daily briefing

Briefings like this, every morning before 9am.

Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.

Palo Alto VM-Series

Palo Alto's VM-Series firewall brings PAN-OS, App-ID, and User-ID to virtual deployments with tight integration into the Cortex and Prisma ecosystems.

Performance and instance sizing

PA VM-Series instances are named by throughput tier: PA-VM-50 (1 Gbps), PA-VM-100 (2 Gbps), PA-VM-300 (4 Gbps), PA-VM-500 (8 Gbps), PA-VM-700 (20 Gbps). The throughput numbers are with App-ID and threat prevention enabled -- meaningful because PAN-OS does not separate throughput numbers by feature (unlike some vendors that cite firewall throughput separately from UTM throughput). In AWS, the VM-Series runs on C5 and C5n instance types; the VM-700 requires a c5n.18xlarge or similar for maximum throughput.

App-ID and User-ID in cloud contexts

PAN-OS App-ID (application identification by behavior, not just port) and User-ID (associating network traffic to user identities from LDAP/Active Directory) work in cloud deployments with the same fidelity as physical appliances. For east-west traffic inspection between cloud workloads, App-ID provides visibility into application behaviors that IP-and-port policies miss. User-ID integration with cloud identity providers (Okta, Azure AD via GlobalProtect) works in cloud deployments but requires the same infrastructure overhead as on-prem.

Panorama and Strata Cloud Manager

Panorama (on-prem or cloud-delivered) provides centralized management for VM-Series deployments alongside physical NGFWs in a unified policy and logging framework. Strata Cloud Manager (the cloud-native replacement for Panorama) provides a cloud-first management plane with AI-powered policy recommendations and health monitoring. Organizations deploying VM-Series in cloud can manage them from the same plane as Prisma Access ZTNA deployments, enabling consistent policy and logging.

Weaknesses for cloud deployments

PA VM-Series is significantly more expensive per throughput-unit than FortiGate VM -- the licensing model (support tier plus VM-Series software license) adds up quickly at scale. Auto-scaling with PA VM-Series requires deploying the VM-Series Plugin for AWS/Azure, which adds operational complexity. License activation for new auto-scaled instances requires integration with Panorama or the Strata License Manager. For organizations without existing PAN-OS expertise, the investment required to operate VM-Series correctly is non-trivial.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Check Point CloudGuard Network Security

Check Point CloudGuard Network Security (formerly vSEC) brings Check Point's Infinity architecture, Threat Prevention technologies, and unified SmartConsole management to cloud virtual firewall deployments.

Architecture and deployment

CloudGuard Network deploys as a Security Gateway VM in AWS, Azure, and GCP. The management server (Check Point Security Management or CloudGuard Smart-1 Cloud) is separate from the enforcement gateway, following Check Point's traditional architecture. In AWS, CloudGuard works with GWLB using the GWLB Integration solution. In Azure, CloudGuard supports Route Server integration for dynamic routing. High availability in cloud uses ClusterXL (active/passive or active/active) or Maestro auto-scaling for larger deployments.

Threat Prevention depth

Check Point's threat prevention capabilities (IPS, Anti-Bot, Anti-Virus, SandBlast threat emulation) are consistent between physical and virtual deployments. SandBlast Zero-Day Protection provides inline sandboxing -- traffic is held for emulation before being allowed, which is meaningful for high-security environments willing to accept the latency tradeoff. The Infinity Threat Prevention package bundles these capabilities with a single subscription.

Weaknesses for cloud deployments

CloudGuard has historically trailed FortiGate VM and PA VM-Series in cloud marketplace maturity and ecosystem partner breadth. Auto-scaling complexity with Maestro is significant -- CloudGuard's auto-scaling is more complex to implement than FortiGate VM's templates. Pricing is competitive with Palo Alto but above FortiGate. SmartConsole (the Check Point management UI) is Windows-only, which creates operational friction in Linux-centric DevOps environments.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

Decision Framework: Selecting a Cloud Virtual NGFW

The right choice depends on your existing security ecosystem, throughput requirements, cloud provider, and operational model.

Choose FortiGate VM if...

You have existing FortiGate physical deployments and want consistent FortiOS management across on-prem and cloud. You are cost-sensitive and need the best throughput-per-dollar. You want Flex-VM license portability between physical and virtual. You are primarily on AWS and want the most operationally mature GWLB integration with provided CloudFormation templates.

Choose PA VM-Series if...

You are committed to the Palo Alto ecosystem (Panorama, Cortex XDR, Prisma Access) and want unified policy management across physical, virtual, and cloud-native NGFWs. App-ID application visibility is a core requirement for east-west traffic inspection. You are deploying Prisma SD-WAN alongside NGFW and want integrated management.

Choose CloudGuard if...

You are a Check Point shop extending existing on-prem security policies to cloud with consistent threat prevention. You need SandBlast inline sandboxing in cloud environments. You have existing SmartConsole/SmartCenter expertise and want to manage cloud gateways from the same console.

Consider cloud-native alternatives first

Before deploying any virtual NGFW, evaluate whether cloud-native services meet your requirements: AWS Network Firewall or Azure Firewall Premium for east-west inspection of cloud workloads may be sufficient and significantly simpler to operate. Virtual NGFW is most justified when: you need advanced threat prevention (AV, IPS, sandboxing) that cloud-native services do not provide, you have compliance requirements for specific NGFW certifications, or you need unified policy management with on-prem physical NGFWs.

Subscribe to unlock Remediation & Mitigation steps

Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.

The bottom line

Cloud virtual NGFW selection comes down to ecosystem alignment: Fortinet shops choose FortiGate VM, Palo Alto shops choose VM-Series, Check Point shops choose CloudGuard. The platforms are more similar than different when running in cloud environments -- all are bounded by instance throughput, all support GWLB and cloud auto-scaling, and all have production-deployable marketplace solutions. The real decision is whether you need a virtual NGFW at all versus cloud-native firewall services, and that answer depends on your threat prevention requirements and compliance obligations, not on the specific virtual appliance vendor.

Sources & references

Fortinet FortiGate-VM deployment guides for AWS, Azure, GCP
Palo Alto VM-Series firewall deployment documentation
Check Point CloudGuard Network Security documentation
AWS Gateway Load Balancer architecture with virtual NGFW partners
Gartner Magic Quadrant for Network Firewalls 2025

Free resources

Free download

Critical CVE Reference Card 2025–2026

25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.

Free download

Ransomware Incident Response Playbook

Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.

Free newsletter

Get threat intel before your inbox does.

50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, daily, no spam.

Unsubscribe anytime. We never sell your data.

Author

Eric BangCISSP

Founder & Cybersecurity Evangelist, Decryption Digest

Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.

View profile →LinkedIn

Black Hat Giveaway

Win a $2,495 Black Hat pass.

Full-access to Black Hat USA 2026 in Las Vegas. Subscribe free to enter.

FortiGate VM vs Palo Alto VM-Series vs Check Point CloudGuard: Cloud NGFW Comparison 2026

Cloud NGFW Architecture: How Virtual Appliances Fit Into Cloud Networks

FortiGate VM

Palo Alto VM-Series

Check Point CloudGuard Network Security

Decision Framework: Selecting a Cloud Virtual NGFW

The bottom line

Sources & references

Critical CVE Reference Card 2025–2026

Ransomware Incident Response Playbook

Get threat intel before your inbox does.

Subscribe to enter the giveaway