Concerns and support receiving dual-vendor firewall strategy

Shan Vasudevan 20 Reputation points
2026-03-26T09:11:08.8733333+00:00

I am escalating a request for formal clarification regarding the supportability of a third-party firewall (NVA) architecture within Microsoft Azure.

As my work place, we are mandated to maintain a dual-vendor firewall strategy, and therefore cannot adopt a single-vendor approach using Azure Firewall alone.

Proposed Architecture

Third-party NVA: Check Point CloudGuard ClusterXL (Active/Standby)

Inbound: Azure Standard Load Balancer (public IP acting as cluster VIP)

Outbound: Azure NAT Gateway attached to the firewall external subnet

Routing: UDRs directing traffic through the firewall layer

Traffic Flow

  • Inbound: Internet → Load Balancer → Active firewall node
  • Outbound: Workload → Firewall (inspection + SNAT) → NAT Gateway → InternetProposed Architecture
    • Third-party NVA: Check Point CloudGuard ClusterXL (Active/Standby)
    • Inbound: Azure Standard Load Balancer (public IP acting as cluster VIP)
    • Outbound: Azure NAT Gateway attached to the firewall external subnet
    • Routing: UDRs directing traffic through the firewall layer
    Traffic Flow
    • Inbound: Internet → Load Balancer → Active firewall node
    • Outbound: Workload → Firewall (inspection + SNAT) → NAT Gateway → Internet

Concern

We have received guidance suggesting that this design may not be supported unless explicitly confirmed by the firewall vendor, alongside recommendations to transition to Azure Firewall.

However, based on Microsoft’s own published guidance:

  • NAT Gateway is the recommended method for outbound connectivity
  • NVA-based architectures are supported and documented
  • No restriction is stated regarding use of NAT Gateway with third-party NVAs

Request for Clarification

We require a clear response on the following:

Does Microsoft Azure impose any technical limitation preventing the use of Azure NAT Gateway with third-party NVAs such as Check Point CloudGuard?

Is there any documented reason this architecture would not function as designed?

If not, can Microsoft confirm that this design is supported from a platform perspective?

Is the recommendation to use Azure Firewall instead based on technical constraints, or on support ownership / platform alignment?

Azure NAT Gateway
Azure NAT Gateway

NAT Gateway is a fully managed service that securely routes internet traffic from a private virtual network with enterprise-grade performance and low latency.

0 comments

1 answer

Sort by: Oldest
Most helpful Newest Oldest
  1. Vallepu Venkateswarlu 10,595 Reputation points Microsoft External Staff Moderator
    2026-03-26T09:46:28.9333333+00:00

    Hi @ Shan Vasudevan,

    Welcome to Microsoft Q&A Platform.

    It looks like you’ve put together a solid NVA-based design and just want to make sure there’s nothing in Azure that will break it. Based on Microsoft’s own docs, there is no platform-level limitation preventing you from using an Azure NAT Gateway in front of (or behind) a third-party firewall such as Check Point CloudGuard. In other words:

    1. Azure NAT Gateway is the recommended approach for outbound connectivity from your virtual network.
    2. There’s no clause in the NAT Gateway docs that says “you can’t combine a third-party NVA with NAT Gateway.” As long as the NAT Gateway is attached to the same subnet (or spoke) and your UDRs forward traffic through your active/standby NVA cluster, outbound flows will be SNAT’d by NAT Gateway and inbound return traffic will flow back through it.
    3. All the “gotchas” in the NAT Gateway documentation revolve around SKU mismatches, delegated subnets for certain PaaS, empty-subnet issues (for StandardV2), etc.—none of which block a standard NVA + NAT Gateway pairing.
    4. The nudges toward Azure Firewall in some guidance are largely driven by unified management, built-in telemetry, Microsoft-owned support channels and the tighter integration that comes with a first-party service (for example, DNAT rule collections, Azure Policy compliance, Firewall Manager, etc.), not by a hard technical bar on NVAs + NAT Gateway.

    So, from a pure platform standpoint, your design is supported. If you’re simply aiming for “Will this break?” or “Is this unsupported?” — the answer is no.

    References

    1. What is Azure Virtual Network NAT (Azure’s outbound-connectivity recommendation) https://docs.microsoft.com/azure/virtual-network/nat-gateway/nat-overview
    2. Design virtual networks with NAT gateway (applicable restrictions & known issues) https://docs.microsoft.com/azure/virtual-network/nat-gateway/nat-gateway-resource
    3. Troubleshoot NAT Gateway connectivity and configuration issues https://docs.microsoft.com/azure/virtual-network/nat-gateway/troubleshoot-nat-connectivity
    4. Integrate Azure Firewall with NAT Gateway (for comparison on 1st-party behavior) https://docs.microsoft.com/azure/firewall/integrate-with-nat-gateway

    Please210246-screenshot-2021-12-10-121802.pngand “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    Was this answer helpful?

    1 person found this answer helpful.

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.