Direct answer: at official list prices on 9 November 2026 (USD, excluding tax/discounts), the three clouds bill firewalls very differently: Azure Firewall Basic $0.395/hour + $0.065/GB, Standard $1.25/hour + $0.016/GB, Premium $1.75/hour + $0.016/GB; AWS Network Firewall primary endpoint $0.395/hour + $0.065/GB, with a secondary endpoint in the same Region/AZ at $0.158/hour and data processing charged only on the primary; GCP Cloud NGFW Essentials is free, Standard is $0.0193/GiB evaluated, and Enterprise is $1.75/endpoint-hour + $0.0193/GiB. For one endpoint, 730 hours/month and 1 TB/month: Azure Basic about $354.91/month, Azure Standard about $928.88, AWS single endpoint about $354.91, AWS primary+secondary about $470.25, GCP Standard about $19.76, GCP Enterprise about $1,297.26. At 100 TB/month: Azure Basic about $6,944.35, Azure Standard about $2,550.90, AWS single endpoint about $6,944.35, GCP Standard about $1,976.32, GCP Enterprise about $3,253.82.
This guide is for cloud networking, security, SRE and procurement teams. It compares Azure Firewall, AWS Network Firewall and GCP Cloud NGFW: billing units, 1TB/100TB TCO, Basic/Standard/Premium vs Essentials/Standard/Enterprise tiers, HA/secondary endpoints, hidden costs and a 90-day checklist. Prices come from the three official pricing pages and the Azure Retail Prices API (all accessed 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Watch the billing shape: Azure/AWS charge an endpoint hourly fee + GB, while GCP Standard is pure per-GiB evaluated; at low traffic GCP Standard is extremely cheap, at high traffic Azure Standard's $0.016/GB can overtake. (2) Align tiers: Azure Basic/AWS base and GCP Standard are not feature-equivalent; L7/IDPS/TLS typically needs Azure Premium, AWS Advanced Inspection or GCP Enterprise. (3) HA is not free: AWS secondary endpoints, a second Azure deployment and a second GCP endpoint all add cost, and data-processing direction/count must be checked.
Billing model: endpoint hours vs per-GiB evaluation
Azure Firewall charges a per-deployment hourly fee plus GB processed, with different hourly/GB rates for Basic/Standard/Premium; Firewall Policy, Capacity Units and Premium add-ons (IDPS/malware/DLP) are extra. AWS Network Firewall charges per-AZ endpoint hours plus GB processed: primary $0.395/hour, secondary in the same Region/AZ $0.158/hour with no data processing charge; Advanced Inspection (TLS) and Active Threat Defense are extra. GCP Cloud NGFW has Essentials (free, L3/L4), Standard ($0.0193/GiB evaluated, FQDN/threat intelligence) and Enterprise ($1.75/hour per endpoint + $0.0193/GiB, L7 IDPS/URL filtering); hierarchical firewall policies are billed per VM/month.
| Item | Azure Firewall | AWS Network Firewall | GCP Cloud NGFW |
|---|---|---|---|
| Billing unit | Deployment hour + GB processed | Endpoint hour (per AZ) + GB processed | Standard: GiB evaluated; Enterprise: endpoint hour + GiB |
| Entry tier | Basic $0.395/h + $0.065/GB | Primary endpoint $0.395/h + $0.065/GB | Essentials free (L3/L4) |
| Standard tier | Standard $1.25/h + $0.016/GB | No separate “standard tier”; endpoint + data | Standard $0.0193/GiB (no endpoint fee) |
| Advanced tier | Premium $1.75/h + $0.016/GB + add-ons | Advanced Inspection / Threat Defense extra | Enterprise $1.75/h + $0.0193/GiB |
| HA/multi-AZ | Second deployment extra | Secondary endpoint $0.158/h | Second endpoint extra |
Sources: Azure Firewall pricing page and Azure Retail Prices API (eastus, 9 November 2026), AWS Network Firewall pricing page, Google Cloud NGFW pricing page (9 November 2026). Editorial summary; regions/currency/features/discounts follow the official pages.
Unit prices: official list prices
Azure (eastus): Basic $0.395/h + $0.065/GB; Standard $1.25/h + $0.016/GB; Premium $1.75/h + $0.016/GB; optional Capacity Units ($0.07/$0.11 per CU-hour); Firewall Policy $100/region-month. AWS (US East): primary endpoint $0.395/h, secondary $0.158/h, data $0.065/GB; Advanced Inspection/Threat Defense extra. GCP: Essentials $0; Standard $0.0193/GiB; Enterprise $1.75/endpoint-hour + $0.0193/GiB; hierarchical policy about $1/$1.5 per VM-month (≤500/>500 attributes).
| Item | Price (USD) | Note |
|---|---|---|
| Azure Basic | 0.395/h + 0.065/GB | Entry tier for small/medium traffic |
| Azure Standard | 1.25/h + 0.016/GB | L7/FQDN/threat intel; optional CU |
| Azure Premium | 1.75/h + 0.016/GB | IDPS/TLS/URL/malware/DLP add-ons extra |
| AWS primary endpoint | 0.395/h | Per AZ; data 0.065/GB |
| AWS secondary endpoint | 0.158/h | Same Region/AZ; no data processing |
| GCP Standard | 0.0193/GiB | No endpoint fee; per evaluated traffic |
| GCP Enterprise | 1.75/h + 0.0193/GiB | L7 IDPS/URL filtering; per endpoint |
| GCP hierarchical policy | About 1 / 1.5 per VM-month | By attribute count; 730-hour conversion |
Sources: Azure Retail Prices API (eastus, 9 November 2026), AWS Network Firewall pricing page (US East), Google Cloud NGFW pricing page (9 November 2026). Monthly prices use 730 hours/30 days; tax/discounts/logs/storage excluded.
TCO: 1 TB/month and 100 TB/month
For one endpoint, 730 hours/month and 1 TB = 1,024 GB/GiB: at 1 TB/month, Azure Basic 288.35 + 66.56 = $354.91; Azure Standard 912.50 + 16.38 = $928.88; Azure Premium 1,277.50 + 16.38 = $1,293.88; AWS single endpoint 288.35 + 66.56 = $354.91; AWS primary+secondary 288.35 + 115.34 + 66.56 = $470.25; GCP Standard 1,024×0.0193 = $19.76; GCP Enterprise 1,277.50 + 19.76 = $1,297.26. At 100 TB/month: Azure Basic about $6,944.35, Azure Standard about $2,550.90, Azure Premium about $2,915.90, AWS single endpoint about $6,944.35, AWS primary+secondary about $7,059.69, GCP Standard about $1,976.32, GCP Enterprise about $3,253.82.
| Option (one endpoint) | 1 TB/month | 100 TB/month |
|---|---|---|
| Azure Basic | 354.91 | 6,944.35 |
| Azure Standard | 928.88 | 2,550.90 |
| Azure Premium | 1,293.88 | 2,915.90 |
| AWS single endpoint | 354.91 | 6,944.35 |
| AWS primary + secondary | 470.25 | 7,059.69 |
| GCP Standard | 19.76 | 1,976.32 |
| GCP Enterprise | 1,297.26 | 3,253.82 |
Editorial calculation: hourly fee ×730; 1 TB = 1,024 GB/GiB; AWS primary+secondary = 0.395+0.158 hourly + primary data; GCP per evaluated traffic. Excludes logs, storage, TLS/IDPS add-ons, tax and discounts; GCP bidirectional evaluation may increase actual GB.
Break-even and HA: when to change tiers/clouds
Azure Basic vs Standard (also AWS primary vs Azure Standard) break-even = (1.25−0.395)×730 ÷ (0.065−0.016) ≈ 12,738 GB ≈ 12.4 TB/month: below 12.4 TB/month, Basic/AWS's “low hourly + high GB” is cheaper; above, Standard's “high hourly + low GB” wins. GCP Standard vs Azure Standard: GCP has no hourly fee at $0.0193/GiB, while Azure has $912.50/month fixed at $0.016/GB; break-even = 912.50 ÷ (0.0193−0.016) ≈ 276,515 GB ≈ 270 TB/month: below about 270 TB/month GCP Standard is cheaper; above, Azure Standard may overtake. GCP Enterprise costs a fixed +$1,277.50/month over Standard at one endpoint; it is justified only when L7/IDPS/URL is needed.
| Comparison | Formula | Conclusion |
|---|---|---|
| Azure Basic vs Standard | (1.25−0.395)×730 ÷ (0.065−0.016) | < about 12.4 TB/month → Basic; above → Standard |
| AWS single endpoint vs Azure Standard | Same (0.395/0.065 vs 1.25/0.016) | < about 12.4 TB/month → AWS; above → Azure Standard |
| GCP Standard vs Azure Standard | 912.50 ÷ (0.0193−0.016) | < about 270 TB/month → GCP; above → Azure |
| GCP Enterprise vs Standard | +$1,277.50/month (one endpoint) | Only when L7/IDPS/URL is required |
| AWS primary + secondary | +0.158×730 ≈ +$115.34/month | HA cost; secondary has no data charge |
Editorial calculation: 730 hours/month, GB/GiB at parity; excludes logs/storage/add-ons/tax/discounts; GCP bidirectional evaluation and regional differences change results.
Hidden costs: seven items beyond the hourly fee
Common add-ons: Azure Firewall Policy ($100/region-month), Capacity Units (Standard $0.07, Premium $0.11/CU-hour), Premium add-ons (malware $2.26/100K requests, app threat $0.30/100K, DLP $0.17/GB, AI Security $1/hour), AWS Advanced Inspection/Threat Defense (TLS/active threat defense extra), AWS secondary endpoints ($0.158/h), GCP Enterprise endpoints ($1.75/h) and hierarchical policies (about $1/$1.5 per VM-month), and logs/storage/insights (Firewall Logs, Flow Logs and SIEM storage are separate). These can materially change TCO at scale/multi-AZ/multi-VPC.
| Cost item | Trigger | Control |
|---|---|---|
| Firewall Policy | Azure policies/multiple subscriptions | Centralize policies; consolidate by region |
| Capacity Unit | Reserved throughput | Enable for peaks; avoid idle reservations |
| Premium add-ons | IDPS/malware/DLP/AI | Enable by business tier |
| AWS advanced inspection | TLS/active threat defense | Apply only to required traffic |
| Secondary endpoint | Multi-AZ/multi-VPC | Match HA needs; avoid blanket multi-AZ |
| GCP Enterprise/policy | L7/hierarchical policy | Upgrade on demand; size by VM count |
| Logs/storage/insights | Flow/Firewall Logs | Control retention/sampling |
Sources: three pricing pages and Azure Retail API (9 November 2026). Editorial summary; billing/availability follows official pages and bills.
Tiers and selection: feature alignment beats unit price
The tiers are not one-to-one: Azure Basic is entry/L3-L4, Standard adds L7/FQDN/threat intel, Premium adds IDPS/TLS/URL/malware/DLP; AWS Network Firewall organizes around stateful/stateless, IDS/IPS, TLS inspection and Active Threat Defense, with Advanced Inspection/Threat Defense extra; GCP Essentials is free (L3/L4), Standard adds FQDN/threat intel, Enterprise adds L7 IDPS/URL. Define requirements first (L4 vs L7, TLS/IDPS, multi-AZ/multi-VPC, cross-cloud), then compare the same tier; do not compare GCP Standard's $0.0193/GiB with Azure Premium's $1.75/h directly.
| Scenario | Prefer | Check first |
|---|---|---|
| Low traffic/L3-L4/budget-sensitive | GCP Essentials/Standard, Azure Basic, AWS single endpoint | Traffic direction, feature gaps |
| 1–10 TB/month, L7/FQDN | Azure Standard, GCP Standard | GB rate, logs |
| High traffic (>12.4 TB/month) | Azure Standard ($0.016/GB) | Actual GB, regions |
| L7/IDPS/TLS/URL filtering | Azure Premium, AWS Advanced, GCP Enterprise | Add-on hourly/request fees |
| Multi-AZ/multi-VPC/HA | AWS secondary, dual Azure deployments, dual GCP endpoints | Secondary/HA billing |
| Existing cloud/compliance | Same-cloud managed firewall | Migration/operations/audit cost |
Editorial selection framework, not a vendor recommendation; features/compliance/regional availability follow official docs and business requirements.
90-day checklist
Use the first 90 days to close “traffic baseline → feature requirements → like-for-like pricing → pilot → cutover → review.” Weeks 1-2: north-south/east-west traffic, peaks, AZ/VPC counts and existing rules; weeks 2-4: define L4/L7, TLS/IDPS, log retention and HA; weeks 4-6: quote the same tier across three clouds and calculate 1TB/100TB plus HA; weeks 6-8: pilot, rule migration and performance testing; weeks 8-10: cutover, failover and log validation; weeks 10-12: cost review, rule cleanup and renewal. Do not compare only hourly or per-GB rates.
FAQ
How is Azure Firewall billed?
Per-deployment hourly fee + GB processed. Basic $0.395/h + $0.065/GB; Standard $1.25/h + $0.016/GB; Premium $1.75/h + $0.016/GB; Firewall Policy, Capacity Units and Premium add-ons are extra.
How is AWS Network Firewall billed?
Per-AZ endpoint hours + GB processed. Primary endpoint $0.395/h, secondary $0.158/h, data $0.065/GB; secondary has no data processing charge; Advanced Inspection/Threat Defense extra.
How is GCP Cloud NGFW billed?
Essentials free; Standard $0.0193/GiB evaluated (no endpoint fee); Enterprise $1.75/endpoint-hour + $0.0193/GiB; hierarchical policies about $1/$1.5 per VM-month.
What does 1 TB/month cost?
Editorial estimates: Azure Basic/AWS single endpoint about $354.91/month; Azure Standard about $928.88; GCP Standard about $19.76; GCP Enterprise about $1,297.26; AWS primary+secondary about $470.25. Excludes logs/add-ons/tax.
What about 100 TB/month?
Azure Basic/AWS single endpoint about $6,944.35; Azure Standard about $2,550.90; GCP Standard about $1,976.32; GCP Enterprise about $3,253.82; AWS primary+secondary about $7,059.69. GB rate dominates at high traffic.
When is Basic cheaper than Standard?
At Azure prices, below about 12.4 TB/month Basic's “low hourly + high GB” is cheaper; above 12.4 TB/month Standard's $0.016/GB wins. AWS single endpoint has the same break-even vs Azure Standard.
How much does HA cost?
AWS secondary endpoint +$0.158/h (about $115.34/month) with no data charge; Azure typically needs a second deployment; GCP Enterprise needs a second endpoint. Multiply by AZ/region count.
Can we compare per-GB prices directly?
No. GCP Standard has no endpoint fee but a different feature tier; Azure/AWS have hourly fees; L7/IDPS/TLS add-ons differ. Align features first, then compare total cost at the same traffic/HA.
Research method and limitations
This article separates “official price facts” from “editorial calculations.” Azure Basic/Standard/Premium, Firewall Policy, Capacity Units and Premium add-ons come from the Azure Firewall pricing page and Azure Retail Prices API (eastus, 9 November 2026); AWS primary/secondary endpoints, data, Advanced Inspection/Threat Defense come from the AWS Network Firewall pricing page (US East); GCP Essentials/Standard/Enterprise and hierarchical policies come from the Google Cloud NGFW pricing page (9 November 2026). TCO, break-even, hidden costs and the 90-day checklist are editorial.
Eight limitations: (1) public list prices only, excluding tax/discounts/commitments; (2) US East/US regions only; (3) 730 hours/month, 1 TB = 1,024 GB/GiB; (4) one endpoint, with HA multiplied separately; (5) logs/storage/insights/SIEM and all TLS/IDPS add-on combinations are excluded; (6) no real throughput/latency/failover benchmark; (7) GCP bidirectional evaluation and AWS multi-AZ data billing may increase actual usage; (8) prices/features change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure Firewall Pricing: azure.microsoft.com/en-us/pricing/details/azure-firewall. Basic/Standard/Premium, data, policy, capacity units, add-ons. Accessed 9 November 2026.
- Azure Retail Prices API (productName contains Firewall, eastus): prices.azure.com/api/retail/prices. 0.395/1.25/1.75, 0.065/0.016, policy $100/month. Accessed 9 November 2026.
- AWS, Network Firewall Pricing: aws.amazon.com/network-firewall/pricing. Primary/secondary endpoints, data, Advanced Inspection/Threat Defense. Accessed 9 November 2026.
- Google Cloud, Cloud NGFW Pricing: cloud.google.com/firewall/pricing. Essentials/Standard/Enterprise, hierarchical policies. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow the Azure/AWS/Google official pages and bills; this is not procurement, commercial or legal advice.