In short
SASE vs firewall is about where inspection happens. A next-generation firewall (NGFW) inspects traffic at one site. SASE inspects it in a provider's cloud, following users and branches anywhere, usually with firewall as a service. Many UK organisations keep firewalls at data centres and larger sites and add a Security Service Edge (SSE) for users.
Want an impartial recommendation?
Tell us about your users, systems and priorities and we will tell you which option fits, and why.
The short answer
For most organisations, SASE changes what the firewall is for rather than removing it.
- Remote users, web filtering and SaaS control move to the cloud, because that is where the users and applications now are.
- The remote access VPN that used to terminate on the firewall can be replaced with ZTNA, so the firewall no longer needs to expose a VPN service to the internet.
- Sites with servers, operational technology, CCTV, card terminals or strict segmentation needs usually keep a local firewall, because a lot of their traffic stays inside the building.
Some small offices, where almost everything is SaaS and people mostly work elsewhere, can replace the office firewall altogether with SASE and a small software gateway. Which group you fall into is a design question, not a product one.
SASE vs traditional network security
Traditional network security is built around a perimeter. Branches connect to head office or a data centre over MPLS or site-to-site VPNs, internet traffic breaks out through a central firewall stack, and remote staff join the network through a remote access VPN that terminates on that firewall. Once inside, users and devices are trusted to reach a lot of the network.
SASE moves the checks to where people and applications are now. Users and sites connect to the nearest point of presence of a Security Service Edge (SSE), where web, SaaS and private application policy is applied, and SD-WAN handles the links between sites and the cloud. Access is granted per application rather than per network.
The table below compares the two at the level most organisations meet them: the site firewall, or NGFW, against SASE.
SASE vs NGFW compared
| On-premises NGFW | SASE / firewall as a service | |
|---|---|---|
| Where inspection happens | On an appliance or virtual firewall at the site or data centre | At the provider's points of presence, or on the device for some platforms |
| Remote users | Through a VPN back to the firewall | Directly, through an agent or browser, wherever they are |
| Branch offices | A firewall at each branch, or backhaul to head office | SD-WAN or tunnels into the security cloud |
| Data centre and server protection | Strong: inspects north-south and east-west traffic locally | Limited for traffic that stays inside the site |
| SaaS and web control | For traffic passing through that site | For every user, on or off site |
| Private app access | Remote access VPN, network-level | ZTNA, per application |
| Management | Per appliance or per vendor manager | One cloud console and policy |
| Typical licensing | Per appliance with security subscriptions | Per user, plus per site for branch connections |
"Cloud firewall" can mean firewall as a service for people and sites, or a virtual firewall protecting networks inside a public cloud. Our Cloud Security site explains both under cloud firewall (opens in a new tab).
Still not sure which way to go? Ask us
Tell us what matters most to you and we will recommend one, with the trade-offs explained.
Where the firewall still earns its place
Even in a well-designed zero trust architecture, local network controls matter. The NCSC's ZTNA reference architectures (opens in a new tab) describe private resources sitting in network segments separated by business criticality, with local controls such as firewalls (virtual or physical) or access control lists stopping traffic between segments unless it is explicitly allowed. That limits lateral movement if something inside is compromised.
That is a job for a firewall at the site or data centre, not for a cloud service a user's traffic passes through on its way in. Typical keepers:
- Data centres and server rooms, where east-west inspection and segmentation protect the most important systems.
- Sites with unmanaged devices: printers, cameras, door entry, building systems and guest Wi-Fi.
- Operational technology and industrial networks, which need local control and often cannot run agents.
- Sites with large local traffic volumes that would be wasteful to send to the cloud and back.
Microsegmentation is another way to limit lateral movement inside a site.
Where SASE takes over
SASE does the jobs that an office firewall was not designed for once people left the office:
- Protecting remote and hybrid users with the same web, DNS and SaaS policy as office staff, without a VPN backhaul.
- Replacing the remote access VPN with per-application ZTNA, which takes an internet-facing service off the firewall once users have moved. See SASE vs VPN, and ztna.org.uk on how to replace your VPN (opens in a new tab).
- Controlling SaaS and generative AI use through CASB and data controls in the Security Service Edge (SSE), which a site firewall only sees for traffic that happens to pass through it.
- Small branches, which can connect into the security cloud over SD-WAN or IPsec instead of needing a full firewall each.
The networking side of that is covered on SASE vs SD-WAN.
Weighing up the options?
We can compare them against your own requirements and recommend what fits.
How vendors we supply join the firewall and SASE
Several platforms we supply are designed to work with, or stand in for, a site firewall:
- Cisco: with Cisco universal ZTNA (opens in a new tab), Cisco Secure Access defines per-user, per-application policy and enforces it in the cloud, while Cisco Secure Firewall Threat Defense enforces the same policy on-site and inspects with IPS, file and malware policy. The firewall appliances are on network-infrastructure.co.uk under Cisco Secure Firewall (opens in a new tab).
- HPE: HPE says EdgeConnect (opens in a new tab) SD-WAN has a built-in firewall with IDS/IPS, adaptive DDoS protection, URL filtering and role-based segmentation, and positions it to "replace legacy branch firewalls".
- Barracuda: Barracuda SecureEdge (opens in a new tab) is a cloud-native firewall as a service and lets you apply inspection and policy "in the cloud, at the branch, or on the device", with options from on-premises deployments to SaaS. See Barracuda SecureEdge.
- WatchGuard: FireCloud Total Access gives remote users firewall as a service, a secure web gateway and ZTNA, and can use an existing Firebox as the FireCloud Gateway (opens in a new tab) to private resources. See WatchGuard SASE.
- Check Point: Check Point SASE (opens in a new tab) includes firewall as a service and SD-WAN, managed in the Check Point Portal. See Check Point SASE.
- Exium: Exium positions its Cyber Gateway, a software next-generation firewall with SD-WAN, IDS/IPS and segmentation, as a replacement for traditional office firewalls. See Exium SASE.
- Todyl: Todyl SASE applies a next-generation firewall with SSL inspection to every device running its agent. See Todyl SASE.
None of these is a reason to throw out a firewall that still protects a site with local systems. They are a reason to stop asking that firewall to protect people who are not there. Vendor facts from HPE (opens in a new tab) and Barracuda (opens in a new tab), checked 9 November 2026.
Firewall mistakes the NCSC warns about
Two of the four ZTNA anti-patterns (opens in a new tab) in the NCSC's guidance land squarely on the firewall:
- Exposing private applications to the internet. Publishing internal applications with public IP addresses, or exposing management interfaces, means a flaw in the application itself can be exploited before any policy is applied. The NCSC recommends brokering access through a hardened connector or proxy instead, so only that component faces the internet.
- Maintaining legacy access routes that bypass the policy engine. The NCSC's examples include VPN access with broad network connectivity and static firewall rules that permit access without policy evaluation, often kept for convenience during a phased migration. It advises removing them wherever possible and tightly restricting any that must stay. In practice, giving each remaining rule an owner and a review date makes that easier to manage.
A firewall review is a natural part of any SASE project for that reason: the aim is to finish with fewer inbound openings and fewer broad rules, not an extra layer on top of the old ones.
Keep, shrink or replace: a quick guide
| Your estate | Likely answer |
|---|---|
| Data centre or server room with on-site systems | Keep a firewall there; add a Security Service Edge (SSE) for users |
| Head office with mostly SaaS use and hybrid staff | Keep a right-sized firewall or SD-WAN edge; move users to a Security Service Edge (SSE) and ZTNA |
| Small branches with a few staff | SD-WAN or tunnels into SASE; a full firewall each may not be needed |
| Very small office, nearly everything in SaaS | SASE with a software gateway may replace the appliance |
| Remote access VPN on the firewall | Replace with ZTNA; close the inbound service once users have moved |
Firewalls are also one of the technical controls in Cyber Essentials, so check how any change fits your scope against the Cyber Essentials requirements (opens in a new tab). No product makes you compliant on its own.
How Forever Systems helps
We can review your firewall estate, remote access and SaaS use together, then recommend where a firewall should stay, where it can shrink and where SASE takes over, so you do not pay twice for the same protection. Where a site still needs an appliance, we can supply the firewall hardware too, so the plan covers both. We then plan the migration, including the clean-up of old rules and inbound openings. Scope and timescales are confirmed at quote, and pricing depends on sites, users and features, so ask us for a quote. Contact us for a review.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Does SASE replace a firewall?
Partly. SASE takes over protection for remote users, web and SaaS traffic and remote access. Data centres and sites with local systems usually keep a firewall for segmentation and local traffic. Some very small offices can replace the appliance.
What is the difference between SASE and an NGFW?
An NGFW inspects traffic at one site or data centre. SASE inspects traffic in a provider's cloud, so the same policy applies to users and branches wherever they connect, usually including firewall as a service.
Is firewall as a service the same as SASE?
No. Firewall as a service is one component of SASE. SASE also includes a secure web gateway, CASB and ZTNA, plus SD-WAN networking for branches.
Do I still need a firewall if staff work from home?
Your offices probably still need one for on-site devices and servers. Home workers are better protected by a Security Service Edge (SSE) or SASE than by a VPN back to the office firewall.
Can SASE replace our remote access VPN on the firewall?
In most cases, yes, through ZTNA. Plan the move app by app, keep a narrowly scoped route for anything legacy, and close the inbound VPN service once users have moved.
Still deciding?
Ask us and a member of our team will get back to you.