In short
SASE vs firewall is about where inspection happens. A next-generation firewall (NGFW) inspects traffic at one site. SASE inspects traffic in a provider's cloud, following users and branches anywhere, often with firewall as a service. Many organisations keep firewalls at data centres and larger sites and add SSE for users; some small offices can replace the office firewall.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The short answer
For most organisations, SASE changes what the firewall is for rather than removing it.
- Remote users, web filtering and SaaS control move to the cloud, because that is where the users and applications now are.
- The remote access VPN that used to terminate on the firewall can be replaced with ZTNA, so the firewall no longer needs to expose a VPN service to the internet.
- Sites with servers, operational technology, CCTV, card terminals or strict segmentation needs usually keep a local firewall, because a lot of their traffic stays inside the building.
Some small offices, where almost everything is SaaS and people mostly work elsewhere, can replace the office firewall altogether with SASE and a small software gateway. Which group you fall into is a design question, not a product one.
SASE vs NGFW compared
| On-premises NGFW | SASE / firewall as a service | |
|---|---|---|
| Where inspection happens | On an appliance or virtual firewall at the site or data centre | At the provider's points of presence, or on the device for some platforms |
| Remote users | Through a VPN back to the firewall | Directly, through an agent or browser, wherever they are |
| Branch offices | A firewall at each branch, or backhaul to head office | SD-WAN or tunnels into the security cloud |
| Data centre and server protection | Strong: inspects north-south and east-west traffic locally | Limited for traffic that stays inside the site |
| SaaS and web control | For traffic passing through that site | For every user, on or off site |
| Private app access | Remote access VPN, network-level | ZTNA, per application |
| Management | Per appliance or per vendor manager | One cloud console and policy |
| Typical licensing | Per appliance with security subscriptions | Per user, plus per site for branch connections |
"Cloud firewall" can mean firewall as a service for people and sites, or a virtual firewall protecting networks inside a public cloud. Our Cloud Security site explains both under cloud firewall.
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Where the firewall still earns its place
Even in a well-designed zero trust architecture, local network controls matter. The NCSC's ZTNA reference architectures describe private resources sitting in network segments separated by business criticality, with local controls such as firewalls (virtual or physical) or access control lists stopping traffic between segments unless it is explicitly allowed. That limits lateral movement if something inside is compromised.
That is a job for a firewall at the site or data centre, not for a cloud service a user's traffic passes through on its way in. Typical keepers:
- Data centres and server rooms, where east-west inspection and segmentation protect the crown jewels.
- Sites with unmanaged devices: printers, cameras, door entry, building systems and guest Wi-Fi.
- Operational technology and industrial networks, which need local control and often cannot run agents.
- Sites with large local traffic volumes that would be wasteful to send to the cloud and back.
Microsegmentation is another way to limit lateral movement inside a site; see network segmentation vs microsegmentation.
Where SASE takes over
SASE does the jobs that an office firewall was not designed for once people left the office:
- Protecting remote and hybrid users with the same web, DNS and SaaS policy as office staff, without a VPN backhaul.
- Replacing the remote access VPN with per-application ZTNA, which takes an internet-facing service off the firewall once users have moved. See how to replace your VPN.
- Controlling SaaS and generative AI use through CASB and data controls, which a site firewall only sees for traffic that happens to pass through it.
- Small branches, which can connect into the security cloud over SD-WAN or IPsec instead of needing a full firewall each.
The networking side of that is covered on SASE vs SD-WAN.
Weighing up the options?
We can compare them against your own requirements and give you a straight answer.
How vendors we supply join the two
Several platforms we supply are designed to work with, or stand in for, a site firewall:
- Cisco universal ZTNA applies the same per-user, per-application policy on-site as remotely. Cisco Secure Access defines the policy and enforces it in the cloud, while Secure Firewall Threat Defense enforces it for on-premises resources and inspects with IPS, file and malware policy. See Cisco universal ZTNA and Cisco Secure Firewall.
- WatchGuard FireCloud gives remote users firewall as a service and a secure web gateway, and FireCloud Total Access can use an existing Firebox as the gateway to private resources.
- Exium positions its Cyber Gateway, a software next-generation firewall with SD-WAN, IDS/IPS and segmentation, as a replacement for traditional office firewalls, and SASE Pro can connect existing firewalls to the Exium cloud during a migration. See Exium.
- Check Point SASE includes firewall as a service and SD-WAN, and is managed in the Check Point Portal. See Check Point ZTNA.
- Todyl SASE applies a cloud next-generation firewall to every device running its agent, with SSL inspection available as an option or in Todyl's Advanced and Complete packages. See Todyl SASE.
None of these is a reason to throw out a firewall that still protects a site with local systems. They are a reason to stop asking that firewall to protect people who are not there.
Firewall mistakes the NCSC warns about
Two of the four ZTNA anti-patterns in the NCSC's guidance land squarely on the firewall:
- Exposing private applications to the internet. Publishing internal applications with public IP addresses, or exposing management interfaces, means a flaw in the application itself can be exploited before any policy is applied. The NCSC recommends brokering access through a hardened connector or proxy instead, so only that component faces the internet.
- Maintaining legacy access routes that bypass the policy engine. The NCSC's examples include VPN access with broad network connectivity and static firewall rules that permit access without policy evaluation, often kept for convenience during a phased migration. It advises removing them wherever possible and tightly restricting any that must stay. In practice, giving each remaining rule an owner and a review date makes that easier to manage.
A firewall review is a natural part of any SASE project for that reason: the aim is to finish with fewer inbound openings and fewer broad rules, not an extra layer on top of the old ones. The NCSC ZTNA guidance page summarises the full set.
Keep, shrink or replace: a quick guide
| Your estate | Likely answer |
|---|---|
| Data centre or server room with on-site systems | Keep a firewall there; add SSE for users |
| Head office with mostly SaaS use and hybrid staff | Keep a right-sized firewall or SD-WAN edge; move users to SSE and ZTNA |
| Small branches with a few staff | SD-WAN or tunnels into SASE; a full firewall each may not be needed |
| Very small office, nearly everything in SaaS | SASE with a software gateway may replace the appliance |
| Remote access VPN on the firewall | Replace with ZTNA; close the inbound service once users have moved |
Firewalls are also one of the technical controls in Cyber Essentials, so check how any change fits your scope against the Cyber Essentials requirements. No product makes you compliant on its own.
How Forever Systems helps
We can review your firewall estate, remote access and SaaS use together, then recommend where a firewall should stay, where it can shrink and where SASE takes over, so you do not pay twice for the same protection. We then plan the migration, including the clean-up of old rules and inbound openings. Scope and timescales are confirmed at quote, and pricing depends on sites, users and features, so ask us for a quote. Contact us for a review.
How Forever Systems helps with ZTNA and SASE
We are an independent IT and cyber security provider. We supply and support several zero trust access and SASE platforms, so we can recommend what fits how your people work rather than one vendor's answer to everything.
- Assess first: we look at your current VPN, firewall, identity set-up and the applications people need to reach before suggesting anything new
- Vendor-aware advice across ZTNA, SSE and SASE options, including Cisco Secure Access and Check Point Harmony SASE
- Pilots and phased roll-out: we can help you start with one group of users or one application, then extend access policy by policy
- VPN replacement: planning the move away from remote access VPNs, including identity provider integration and device posture checks
- Ongoing support: policy changes, licence reviews and renewals, with the details confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, features and term, so ask us for a quote.
Frequently asked questions
Does SASE replace a firewall?
Partly. SASE takes over protection for remote users, web and SaaS traffic and remote access. Data centres and sites with local systems usually keep a firewall for segmentation and local traffic. Some very small offices can replace the appliance.
What is the difference between SASE and an NGFW?
An NGFW inspects traffic at one site or data centre. SASE inspects traffic in a provider's cloud, so the same policy applies to users and branches wherever they connect, usually including firewall as a service.
Is firewall as a service the same as SASE?
No. Firewall as a service is one component of SASE. SASE also includes a secure web gateway, CASB and ZTNA, plus SD-WAN networking for branches.
Do I still need a firewall if staff work from home?
Your offices probably still need one for on-site devices and servers. Home workers are better protected by SSE or SASE than by a VPN back to the office firewall.
Can SASE replace our remote access VPN on the firewall?
In most cases, yes, through ZTNA. Plan the move app by app, keep a narrowly scoped route for anything legacy, and close the inbound VPN service once users have moved.
Still deciding?
Ask us and a member of our team will reply by email with a straight answer.
More zero trust access guides
Cisco universal ZTNAOne per-app zero trust policy for remote and on-site users, enforced by Secure Access and Secure Firewall.VPN replacementRetiring a remote access VPN: the options, an NCSC-aligned migration plan and what changes for users.Segmentation vs microsegmentationVLANs and firewall zones compared with per-host least-privilege rules, and how both relate to ZTNA.