Professional support · firewall cloud migration
Home · Professional support · Firewall to public cloud
Migrate an on-premises firewall to Azure, AWS, GCP and OCI
The data-centre firewall moves to the public cloud without the inspection hop falling out of the path. Azure, AWS, Google Cloud and OCI are all in this engagement. The older three-cloud card on the desk now points here when OCI is part of the ask.
What moves with the firewall
The job is the inspection path, not a screenshot of the rulebase. A policy that passes in the data centre and is bypassed by a cloud route is a failed migration.
In the written scope
- Security policy, objects, NAT and site-to-site VPN inventory
- Where the virtual firewall or native cloud firewall sits in the hub
- Routes and peerings checked so the hop cannot be skipped
- Logging path into the SIEM you already run
- A test list for the flows that must pass, and rollback of the internet edge
Called out before you pay
- Vendor licences and cloud marketplace subscriptions are yours
- Decryption certificates are re-issued by you. We do not take private keys off the estate casually.
- User-ID, device identity and VPN clients that have no cloud equivalent stay on the gap list
- We do not claim every object converts. Objects with no target are listed, not hidden.
Azure, AWS, Google Cloud, OCI
| Cloud | Virtual NGFW landing | Native control we will not confuse with the NGFW |
|---|---|---|
| Microsoft Azure | VM-Series, FortiGate-VM, CloudGuard or Cisco virtual firewall in the hub VNet | Azure Firewall, NSGs, and route tables. They can sit beside the NGFW. They are not the rulebase. |
| Amazon Web Services | The same virtual firewalls in a hub VPC, usually behind a gateway load balancer when the design needs it | Security groups and AWS Network Firewall |
| Google Cloud | Virtual NGFW in the hub project or shared VPC | VPC firewall policy and Cloud NGFW if you choose it on purpose |
| Oracle Cloud Infrastructure | Virtual NGFW in the hub VCN | Security lists, NSGs, and the OCI network firewall |
Palo Alto and FortiGate are the requests we see most. Check Point and Cisco are the same desk. For policy-as-code after the landing, use the Terraform engagement. That price is discussed separately.
How you start
- WhatsApp the current vendor, the target cloud, and whether this is the internet edge, east-west, or both.
- We reply with what we need to see: a policy export, a routing sketch, and the window.
- The quote names what is in and what is out. You confirm before any payment.
Support and pricing
Scoped after we see the current firewall, the target cloud and the window. No fixed fee is printed here.
Confirm on WhatsApp before paying. GST extra as applicable. Firewall and cloud licences are not included.
Questions people ask before they message
Which on-premises firewalls can move to Azure, AWS, GCP or OCI?
Palo Alto, FortiGate, Check Point and Cisco ASA or Secure Firewall are the usual sources, physical or virtual. The target is Azure, AWS, Google Cloud or OCI. Juniper SRX, SonicWall and Sophos are quoted the same way when you already run them. The fee is scoped on WhatsApp.
Will a cloud security list replace the NGFW policy?
Not by default. A security list, network security group, or VPC firewall rule is not a Palo Alto or FortiGate rulebase. Azure Firewall, AWS Network Firewall, Google Cloud firewall policy and the OCI network firewall are design choices we write down. If you still need App-ID, IPS profiles, or decryption, the landing is a virtual NGFW: VM-Series, FortiGate-VM, CloudGuard, or the Cisco virtual firewall your licence allows.
What has to be true before cutover?
Policy, NAT and VPN are inventoried. The hub VPC or VNet is drawn so traffic cannot skip the firewall by taking a peering shortcut. Hybrid links (VPN, ExpressRoute, Interconnect, FastConnect, or the circuit you already pay for) are named. Rollback is the on-premises edge you have not powered off.
Is the price the same as the ₹35,000 F5 VMware offer?
No. ₹35,000 is only the hardware F5 appliance to VMware BIG-IP VE engagement. This firewall-to-cloud page is a scoped quote. Terraform automation is priced separately, on discussion.
Related on this desk
Start on WhatsApp
Send the current firewall, the target cloud, and whether the internet edge, the east-west path, or both must move. The fee comes back on WhatsApp.
Techclick Infosec Pvt Ltd
CIN U78100UP2025PTC217519
Email: support@techclick.in · WhatsApp: +91 92772 29456