In short: Check Point CloudGuard Network Security, now presented by Check Point as Check Point Cloud Firewall, provides virtual security gateways for AWS, Azure, Google Cloud and private clouds. It applies firewall, intrusion prevention, application control, VPN and threat prevention to cloud traffic, with policy, logging and reporting shared with on-premises Check Point gateways.
What CloudGuard Network Security is
Moving servers into the public cloud does not remove the need for a firewall. The provider secures its physical network, but filtering traffic into, out of and between your virtual networks is your job. Security groups help, but they filter by address and port and do not inspect content.
CloudGuard Network Security runs Check Point's gateway software as virtual machines inside your cloud. Check Point's website now lists the product as Check Point Cloud Firewall (also described as Cloud Network Security); CloudGuard remains the family name you will see in documentation, marketplaces and licences. It is available for public clouds including AWS, Azure and Google Cloud, for private clouds and software-defined data centres, and as a dedicated offering for Azure Virtual WAN.
If you are weighing it against the providers' own firewalls, our cloud firewall guide compares native and third-party options.
Security features
The gateway provides the same protections as a physical Check Point appliance:
| Capability | What it does in the cloud |
|---|---|
| Firewall and application control | Policy by network, user, application and service, for inbound, outbound and east-west traffic |
| Intrusion prevention (IPS) | Blocks exploit attempts against your published servers and between workloads |
| Antivirus and anti-bot | Stops malware downloads and blocks infected machines from contacting command-and-control servers |
| Threat Emulation and Threat Extraction | Sandboxes suspicious files and delivers sanitised copies of documents |
| URL filtering | Controls outbound web access from servers, which should rarely need open internet |
| IPsec VPN | Site-to-site tunnels between clouds and offices, and remote access |
| Data loss prevention | Inspects traffic for sensitive data leaving your network |
Because policy, logging and reporting are managed centrally across cloud and on-premises gateways, a rule written once can follow an application from the data centre to the cloud.
Deployment patterns
Check Point publishes architecture guidance for public cloud (its Cloud Security Blueprint). The common patterns are:
- Hub-and-spoke inspection: gateways sit in a central security hub network, and workload networks are peered to it, so traffic between the internet, workloads and offices all passes through inspection.
- North-south and east-west segmentation: separate inspection of traffic entering and leaving the cloud from traffic between internal application tiers, so a compromised web server cannot reach the database freely.
- Auto-scaling: Check Point's deployment guides cover gateways in AWS Auto Scaling groups, Azure virtual machine scale sets and Google Cloud managed instance groups, which add and remove gateways as load changes; the management server picks up new gateways and pushes policy to them automatically.
- Azure Virtual WAN: Check Point Cloud Firewall deployed inside Microsoft's Virtual WAN hubs for organisations that use Virtual WAN to connect sites and regions.
- Hybrid connectivity: VPN or private links from the cloud gateways to on-premises Check Point firewalls under the same management.
Deployments can be automated with infrastructure-as-code tools, CI/CD pipelines and APIs, so security is built into the same templates that create the networks.
Who it suits
CloudGuard Network Security is a good fit if:
- You already run Check Point firewalls at your offices or data centre and want one policy and one console everywhere
- You use more than one cloud and want consistent inspection across them
- You need full threat prevention, such as sandboxing and IPS, rather than the core filtering of a cloud-native firewall
- You must show auditors consistent controls between on-premises and cloud
If your estate is a single cloud and you do not use Check Point elsewhere, a provider-native firewall or WatchGuard Firebox Cloud may be simpler. For user and branch traffic rather than servers, look at firewall as a service within SASE.
Licensing and costs in general terms
There are two cost elements: the Check Point gateway licence (sized by capacity and the security features you enable) and the cloud provider's charges for the virtual machines, storage and data transfer. Gateways can be licensed by bringing your own licence or pay as you go through the cloud marketplace; for auto-scaling groups, where the number of gateways changes, Check Point's Azure guidance recommends pay as you go. Management can run on a management server you host or as a cloud-delivered service.
Because the right size depends on throughput with inspection switched on, not just internet bandwidth, ask us for a quote and we will size it with you.
How CloudGuard fits with the rest of Check Point
Check Point has passed its CNAPP customers to Wiz under a 2025 partnership, but cloud network security is one of the areas it said it would keep investing in; see the move to Wiz. In Check Point's current product structure, cloud firewalls sit in the Hybrid Mesh Network Security pillar alongside its office and data centre firewalls. For web and API protection in front of your applications, see CloudGuard WAF, and for the full range, our Check Point cloud security portfolio.
Contact us to discuss firewalls for your cloud networks.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is Check Point CloudGuard Network Security?
It is Check Point's virtual firewall for public and private clouds, now presented as Check Point Cloud Firewall. It deploys security gateways in AWS, Azure, Google Cloud and private clouds, with firewall, IPS, application control, VPN and threat prevention managed alongside on-premises Check Point gateways.
Is CloudGuard Network Security the same as CloudGuard CNAPP?
No. Network Security is the virtual firewall that inspects traffic. CloudGuard CNAPP was the posture and workload protection platform, whose customers are now being offered migration to Wiz. Network Security continues.
Can CloudGuard Network Security replace Azure Firewall?
It can do the same job and adds Check Point's full threat prevention and policy shared with your other Check Point gateways. Azure Firewall is simpler to run in a single Azure estate. The choice depends on whether you standardise on Check Point across sites and clouds.
Does CloudGuard Network Security support Azure Virtual WAN?
Yes. Check Point offers Check Point Cloud Firewall for Azure Virtual WAN, deployed inside Virtual WAN hubs.