Consumption-based firewall for private cloud

For virtual firewalls deployed in a private cloud, the strongest consumption-oriented licensing options I found are Fortinet FortiFlex, Check Point CloudGuard Metered License, and Palo Alto Networks Software NGFW Credits. The important caveat is that vendors generally do not publish comparable private-cloud $/vCPU or $/Gbps rates, so “most competitive” is better assessed by licensing flexibility and billing mechanics than by a universal price ranking.

My shortlist

1. Fortinet FortiFlex — strongest match for true “pay as you grow.”

FortiFlex is unusually well aligned with your requirement. Fortinet explicitly says it applies to virtual data centers and on-premises environments, with consumption calculated on a daily basis. You buy a pool of points, then dynamically deploy FortiGate-VMs and services; capacity can be increased or decreased without buying a new license each time. Unused points can roll over.www.fortinet.com

That makes it particularly interesting if your private cloud has variable VM counts or workloads.

2. Check Point CloudGuard Metered License — worth benchmarking closely.

Check Point's metered licensing documentation specifically describes protection of virtualized environments and private-cloud datacenters and says the PAYG model charges according to actual usage.sc1.checkpoint.com+1

I'd put this into the RFP alongside FortiFlex rather than assuming Fortinet will be cheaper—the actual rate card/discount structure is likely to determine the winner.

3. Palo Alto Networks Software NGFW Credits — strongest alternative if you're already a Palo Alto shop.

Palo Alto's credit model is consumption-like rather than simple hourly billing. Credits sit in a pool; deployed firewalls consume them, and when a firewall is deactivated, the credits return to the pool. Deployment profiles can be modified and can combine vCPUs, security services, Panorama and support.docs.paloaltonetworks.com+1

That's particularly useful for organizations wanting a shared licensing pool across multiple private-cloud clusters.

One important distinction

I would not treat public-cloud PAYG as equivalent to private-cloud consumption licensing. For example, Sophos offers very straightforward hourly PAYG with no minimum commitment on Azure, and WatchGuard offers hourly/PAYG Firebox Cloud on AWS and Azure. docs.sophos.com But those models don't necessarily give you the same economics when you're running the firewall on your own VMware/KVM/Nutanix/OpenStack infrastructure.

Cisco is also somewhat different: its FTDv performance tiers are designed for private cloud and decouple licensed throughput from VM compute, but that's capacity/performance-tier licensing rather than pure usage metering.www.cisco.com

What I'd put in the procurement exercise

Ask Fortinet, Check Point and Palo Alto for quotes using the same scenario:

• 10 virtual firewalls initially
• 4–8 vCPU each
• VMware/KVM/Nutanix/OpenStack
• 12-month and 36-month commitments
• Ability to add/remove instances monthly
• Seasonal peak of 2× normal capacity
• HA pair licensing
• Threat/IPS/URL/DLP services included
• Unused entitlement rollover
• License portability between clusters
• Minimum annual commitment
• Price for additional consumption
• Exit/decrease provisions

The key number to compare is effective annual cost at 50%, 100%, 150%, and 200% utilization, rather than the vendor's nominal license price.

Bottom line: based on the publicly documented licensing mechanics, I'd make Fortinet FortiFlex, Check Point CloudGuard Metered, and Palo Alto Software NGFW Credits the primary competitive set for your requirements. FortiFlex has the clearest documented combination of private-cloud support + daily consumption + elastic scale + rollover, while Check Point and Palo Alto provide credible alternatives whose negotiated rates could materially change the cost ranking.www.fortinet.com

For private-cloud environments, I’d focus on firewall vendors that offer virtual network security appliances with usage-based licensing, flexible capacity scaling, and bring-your-own-license (BYOL) or pay-as-you-go (PAYG) options. The key is to distinguish true consumption-based billing from a subscription that requires you to commit to fixed capacity for one or three years.

For a competitive pay-as-you-grow model, compare both the firewall software license and the underlying infrastructure costs, including compute, throughput, support, and high availability.

Best-fit firewall providers

Shortlist based on published licensing models and private-cloud deployment support, checked October 2026.

• 

1. Fortinet — FortiGate-VM + FortiFlex

(Strongest fit)

Fortinet offers virtual firewalls for VMware, OpenStack/KVM, Microsoft Hyper-V, and other private-cloud platforms. Its FortiFlex program uses a points-based consumption model, allowing organizations to deploy virtual appliances and security services, scale capacity up or down, and pay according to usage.www.fortinet.com+2

Why shortlist it: A strong match for private-cloud estates, managed service providers, and organizations wanting to avoid fixed per-appliance licensing commitments.

Pricing to validate: Points consumption rates, minimum point purchases, term discounts, and how unused points expire.

Official resources: FortiFlex ·FortiGate virtual appliances

---

• 

2. Palo Alto Networks — VM-Series + Software NGFW Credits

Palo Alto Networks supports VM-Series firewalls in private clouds and offers a flexible credit-based licensing model. Software NGFW Credits allow you to configure firewall capacity and security services according to deployment needs. PAYG is also available through supported public-cloud marketplaces and cloud service providers.docs.paloaltonetworks.com+1

Why shortlist it: A compelling option if you want advanced threat prevention and flexible allocation of licenses across virtual firewall deployments.

Pricing to validate: Credit pricing, consumption rates, support charges, and whether the proposed private-cloud arrangement can be billed on a genuinely usage-based basis.

Important distinction: Public-cloud PAYG availability does not mean direct hourly PAYG is available for every private-cloud hypervisor.

Official resources: VM-Series overview ·Licensing guide

---

• 

3. Cisco — Secure Firewall Threat Defense Virtual

Cisco supports virtual firewall appliances on VMware, KVM, OpenStack, Nutanix, and Microsoft Hyper-V. Its performance-tiered licensing lets you select a throughput tier and adjust it to match security requirements. Private-cloud deployments can use Cisco Smart Licensing, including term subscriptions.www.cisco.com+2

Why shortlist it: Worth comparing if you already use Cisco infrastructure and want consistent licensing across private and public clouds.

Pricing to validate: Subscription terms, license portability, minimum commitments, and the ability to add or release entitlements as demand changes.

Important distinction: Cisco's published hourly PAYG option is limited to supported public-cloud deployments; private-cloud support alone does not establish consumption-based billing.

Official resources: Secure Firewall Threat Defense Virtual ·Cisco ordering guide

How I would compare them

These are comparisons of published capabilities, not a verified price ranking. I couldn't establish that any one provider is universally the cheapest; negotiated discounts, throughput, security subscriptions, and contract terms can change the result substantially.

My recommendation

Start with Fortinet FortiFlex, then run a like-for-like commercial comparison with Palo Alto Networks Software NGFW Credits. Include Cisco if your environment already uses its networking or security ecosystem.

Ask each vendor for a quote against the same deployment profile and request explicit answers to these five questions:

1. Can we deploy on our own private-cloud infrastructure without using a public-cloud marketplace?
2. Are charges based on actual runtime, daily consumption, allocated capacity, or a prepaid credit pool?
3. Can we scale from a small deployment to a larger one without purchasing a new fixed-term license?
4. What happens to charges when a firewall is stopped, removed, or scaled down?
5. What are the minimum commitments, HA licensing costs, support charges, and renewal conditions?

One detail that will narrow the shortlist

Which private-cloud platform are you running?

1. Infrastructure

VMware vSphere / VMware Cloud Foundation

OpenStack / KVM

Nutanix AHV

Microsoft Hyper-V

Mixed environment / other platform

---

2. Preferred billing model

Daily or hourly usage-based billing

Prepaid credits with flexible consumption

Monthly subscription with elastic scaling

---

3. Expected demand pattern

Variable demand, with frequent scaling

Steady baseline with occasional spikes

Multi-tenant MSSP / service provider

[Narrow the vendor shortlist]

With those details, the comparison can focus on providers whose actual licensing terms match your infrastructure and growth model, rather than just vendors that offer virtual firewalls.