PCI-DSS: Custom NGFW

Table of Contents§

• Problem Statement
• What is NGFW?
• Alternative Cloud Firewalls Economics
• Custom Solution Architecture

Problem Statement§

To pass PCI-DSS compliance you need Azure Premium Firewall with IDS/IPS subsystem. That will cost you at least $1300 per month.

What is NGFW?§

FW - firewall. NGFW - next-generation firewall.

A traditional firewall decides traffic based on IPs, ports, protocols; an NGFW inspects the full application and content inside the traffic, adds IPS, malware detection, and user-identity controls.

A traditional FW only sees Source IP > Destination IP. Port (80, 443, 22...). Protocol (TCP/UDP).

An NGFW sees what application is inside the flow. What user/identity generated it and what content is transferred.

NGFW = firewall + IPS + application control + threat prevention. Traditional FW = simple access control + state tracking.

NGFW can block/allow traffic like:

• Only "Finance" AD group may access internal payment API.
• Deny "unknown application" traffic regardless of port.

Traditional FW sees TLS as opaque. NGFW decrypts, inspects, re-encrypts and enforces IPS/malware rules.

NGFWs like Palo Alto, Fortinet, Barracuda, Cisco, etc., pull real-time threat intel. NGFW logs are much richer — essential for PCI-DSS, SOC, SIEM, IR.

Traditional firewalls were designed for a world where applications used standard ports, malware was rare, TLS traffic was low, IDS/IPS were separate physical appliances. Today most malicious traffic is encrypted. Applications run on any port. Cloud-native microservices obscure traditional boundaries. Attackers hide inside "allowed" ports like 443. NGFW solves these limitations.

Use a Next-Generation Firewall when:

• You need PCI-DSS, HIPAA, or regulatory compliance.
• You want to inspect encrypted traffic.
• You want IPS/IDS and anti-malware inline.
• You require fine-grained application control.
• You have modern workloads (cloud, container, SaaS).

Use a traditional firewall only when:

• You need basic L3/L4 filtering only.
• Traffic inspection is not required.
• Performance/latency must be extremely low.
• Cost must be minimal.

In cloud environments, NGFW is almost always the correct choice.

Alternative Cloud Firewalls Economics§

Let's analyze the costs of switching from Azure Firewall Premium SKU + IDPS to another PAYG solution.

Assumptions:

• Single NGFW resource, running 24x7 (720 h/month).
• Traffic to inspect: 5 TB/month (~ 5120 GB).
• All "Cloud-Delivered Security Services (CDSS)" add-ons enabled:
  • Advanced Threat Prevention
  • Advanced URL Filtering
  • WildFire (malware/sandbox)
  • DNS Security
  • (Optionally) central management — but assume minimal extra cost, or you skip Panorama-style central mgmt for now.
  • All traffic goes through inspection & CDSS, worst-case for cost, but ensures full PCI-DSS security.

The values below are the representative monthly costs we established earlier for a single firewall deployment, running 24x7, inspecting 5 TB/month, configured with PCI-DSS-relevant features (IPS/IDPS, TLS inspection, threat prevention, logging-ready). These are minimal approximate, based on publicly referenced pricing models. Different integrations with Azure Cloud services like Log Analytics Workspace can make this price much higher.

Custom Solution Architecture§

Solution components:

1. L3/L4 stateful firewall
2. Deep Packet Inspection (DPI)
3. IPS/IDS
4. TLS/SSL interception (optional)
5. URL/content filtering
6. Application identification / protocol detection
7. Logging, SIEM integration, dashboards
8. Routing, NAT, VPN
9. Optional: malware scanning (proxy-based)