What is our primary use case?
We are using it for in and out of our cloud from on-premises. Security from our SD-WAN and express route connectivity is our main use case.
We also have vendor integrations. SAP RISE was the big one that we recently had where we were using dedicated CloudGuard network gateways for straight vendor implementations.
How has it helped my organization?
The ease of deployment has been a benefit. Having Check Point on-premises definitely helped with moving to the cloud. It feels very similar after you migrate. It was not as cumbersome as on-premises, and it was a little less scary for others. It enabled others within our company to adopt.
We have unified security management across hybrid clouds as well as on-prem. We are using just gateways to the cloud, and we have the same management server and the same console as on-prem gateways. It definitely allows you to have unified policies across the board. This seamless integration is a huge plus. Smart-1 Cloud is the next portion to go up to, so we can remove the complexity of management, such as login and whatnot, from our responsibilities.
By using CloudGuard Network Security, we have a good foundation. The history of Check Point has a reliability that I trust. Most of the improvements we do are more internal. There are actions that we, as customers, need to do. It helps to have vendors like Check Point who will go out of their way to help you make their product seamless. It is only as good as how you use it. That has been a big positive, and we have had a good accounts team that has been able to bring proper resources to us, and we encourage those additional resources they provide to us to help us be successful.
For identifying security threats, our company uses a portfolio of different kinds of vector spots and inspection spots. Some of that is handled by another team, and I do not have direct insight into that. However, it has definitely added some automatic reaction with our on-premise setup, which has helped us integrate cross-platform. That portion has been great because no one wants to be too vendor-dependent. You want to be vendor-agnostic. The fact that we can utilize it across multiple vendors has been a positive for us.
What is most valuable?
We are using gateways, and I appreciate the high-availability gateways they have. They stand out more than the competitors.
The Check Point architecture team adapting fluently to the architecture that each cloud has is valuable. They are adaptive to customer solutions, which is a big advantage.
What needs improvement?
Some more built-in marketplace templates would be nice. It would be nice to see more vendor assistance in deployments and backup of recoveries versus having customers rely upon that themselves. That would make it a lot more seamless and aligned with the standard on-premise model that is there. Check Point can extend the same posture that they have to CloudGuard and make that transition very seamless.
Check Point does not have as big a footprint in engineering teams as Cisco or Palo Alto has, especially in the US market. Therefore, finding someone who understands Check Point is a lot harder. If Check Point can make it easier for seamless transitions, it will build the confidence of engineers and help with the adoption of a new vendor for those engineers. Anything they can do to help with that is a competitive advantage, and it works for any company looking into it.
For how long have I used the solution?
I have been using CloudGuard Network Security for about three years.
What do I think about the stability of the solution?
It is very stable, but in any virtualized environment, you are still dependent on your cloud provider. If Amazon, Microsoft, Google, or any other cloud provider reboots the gateway because they are doing some maintenance and did not tell you about it, it is not Check Point's fault. It is something where you have to correlate whether you had an outage or lost a node. You still have to report that. It still looks like that your Check Point firewall went down, so guilty until proven innocent type of deal comes into play. That has been a little bit more challenging than when it is your hardware on-premises. Outside of a power issue or an upstream switch, if something goes wrong in the box, it is not on Check Point. At that point, you can hammer down to the cloud. Having shared resources makes it a little bit difficult to delineate. You have to go case by case.
What do I think about the scalability of the solution?
I have not directly experienced the need for scaling, particularly horizontally. Based on studies, presentations, documentation, and architecture, scalability is definitely there, so I have confidence that if my business needs to shift to high throughput and high sessions, Check Point will have a solution for me to do that seamlessly.
How are customer service and support?
I have always had challenges with TAC. There still seems to be a difference in the type or level of tech support you get based on the region you call into. That has been a little bit more challenging. We have had issues with getting the same candid answers where they were regurgitating without looking through. At the support level, we have had some challenges back and forth, but when we talk to our account team or our sales engineer and say that we have a problem, their reaction is very quick. Their escalation internals take care of that. They get us the right people.
For additional deployments from the cloud perspective, we have always had great contacts to get to. I have been very happy with the level of support Check Point has given us for new deployments' design ideas and problems. The feature roadmap they chose has been excellent.
Overall, I would rate their customer service and support an eight out of ten. I am dropping points because of the TAC issues that I have had.
Which solution did I use previously and why did I switch?
We do use another vendor that does a similar function. The vendor is Fortinet. Both vendors have their own pros and cons. The big difference between the two from a cloud network security perspective is that the high availability model that Check Point has is not what the competitor has. So, you are still relying upon load balancers, and you are still relying upon cloud failover, which adds a little bit of complexity. This high availability has been a huge plus. We have not seen our current vendors or other vendors be able to do so.
We, as such, have not switched. We have a different vendor we use, and we have not made the decision to switch. We are still at that deciding factor because we are seeing where things fit with both platforms. From an ROI perspective, switching would not be advantageous to us at this point based on what we are getting, but it is definitely something that is looked upon as we look at life cycles. We can then make a decision one way or the other to meet our business needs.
The decision to go for CloudGuard instead of our cloud vendor's cloud firewall was predated. There were some implementations that were already there. We have made additional investments where we did go between vendor A and vendor B and made a decision. I made the decision and chose Check Point, not just for the single pane of glass and ease of management but also for the high availability. For the high availability that we were deploying, there was no other solution that could give us the seamlessness we were looking for. We could not get that from other vendors, so it became evident that going for Check Point was the right decision to make.
How was the initial setup?
We are a Microsoft Azure Shop, and the deployment model would be high-availability gateways. We are not using gateway low balancers. We are just using the high-availability deployments.
In terms of ease of deployment, I cannot speak for the earlier years, but I did hear that there were some pain points. That was more of a combination of cloud maturity in Microsoft and Check Point integrations. There were other challenges related to intermixing and the knowledge base. This was when Check Point was new to our company, and we probably did not have the right MSP support. A lot of those gaps and failures were due to the support and not having that strong knowledge base and operating support afterward. Recent deployments, from 2020 to 2024, are different. There is a night and day kind of difference. We had instant Check Point support. They walked us through and sat on the call while we deployed in real-time with our CloudOps teams. It was seamless. We ran into a gap, and we were easily able to fix it right then and there. They were very collaborative. It has just been a night-and-day type of scenario.
What about the implementation team?
For the first implementation, we used an MSP consultant in collaboration with Check Point. We did the recent deployment in-house directly with Check Point.
What was our ROI?
We are yet to figure that part out. There is a lot of tuning on our side, and we have definitely seen its remediation and prevention capabilities help us in very critical situations. Knowing that we could be proactive instead of constantly being reactive has definitely put me at much more ease at night. There are some improvements to that.
Investment-wise, this is where you look at the consolidation and realize that you might have different vendor technologies that might be doing the same thing. This is something we will have to look at. It is not necessarily a Check Point problem. It is something that we, as an enterprise, have to look into.
What's my experience with pricing, setup cost, and licensing?
My experience has been extremely positive. It was not a concern because I had an account team that fought for pricing for our company. They were not pushing me to professional services for certain help. I was instantly getting a CloudGuard architect to help us out. They understood our environment and bridged the gap where we needed that help with our public cloud provider and with Check Point, in this case. That is what made the experience. They allowed us to scale it well, and that is where Check Point has done very well.
They realize that customers need to be adaptive in their cloud deployments, and they are much quicker than on-prem. They know that in the end, their product speaks for itself, so pricing has always been very competitive compared to other vendors. I have always had account teams no matter what company I have worked for, and they have always done a good job of meeting that gap. So, its pricing was not the reason we made the decision.
What other advice do I have?
I would rate CloudGuard Network Security a nine out of ten. The ease of template deployment would have been nice. There was also a little bit of weirdness with the licensing models for our on-premise management. That is pretty much it. Otherwise, I am extremely happy with it. They are not negatives. It is still great.
Disclosure: My company does not have a business relationship with this vendor other than being a customer.