The fundamentals of the Managed Firewall offering
The service Managed Firewall is a fully managed next-generation firewall (NGFW) cluster deployed on the sovereign SecNumCloud infrastructure. It is the reference network security perimeter for all architectures hosted at Cloud Temple.
The service is available in two editions depending on your level of sovereignty requirements and your existing ecosystem:
- Stormshield Edition ANSSI-qualified French solution (Enhanced Qualification - Common Criteria EAL4+), recommended for Operators of Vital Importance (OIV), Operators of Essential Services (OSE), organisations subject to the LPM/NIS2 and environments requiring total technological sovereignty.
- Fortinet Edition NGFW: World leader in the NGFW market, recommended for private companies wishing to benefit from an extended SASE ecosystem (FortiGuard, Security Fabric, SD-WAN, ZTNA) and maximum integration with their existing infrastructures.
In both cases, the service includes the HA cluster (Active/Passive), full operational management (MCO, 24/7 supervision, signature updates) and advanced VPN capabilities.
Our compliance procedures
Our Managed Firewall offering is HDS and ISO 27 001 certified
The benefits of Cloud Temple's Managed Firewall offering
Security without constraints
Zero Ops, focus on protection
Outsource the complete management of the firewall (deployment, high availability, updates, supervision) so that your teams can concentrate on defining security policies.
Advanced protection
Unified multi-layer security
Combine network filtering, application inspection, IPS/IDS, web filtering and anti-malware in a single service, continuously enhanced by threat intelligence feeds.
Continuity and scalability
High availability and scalability
Ensure continuity of service thanks to a cluster architecture with automatic failover, while easily adapting capacity without overhauling the infrastructure.
Guaranteed sovereignty
Trusted infrastructure and technology
SecNumCloud hosting in France, with the option of technological sovereignty via ANSSI-qualified solutions.
The features of our Managed Firewall
Stateful Firewall (L3/L4)
Filtering by connection state: source/destination IP, TCP/UDP ports, protocols. Stateful session tables for all flows.
NGFW - Application Control (L7)
Identification and control of over 3,000 applications (HTTP, HTTPS, cloud apps, P2P, business protocols) regardless of the port used. Authorisation/block/restrict policies by application.
IPS/IDS (Intrusion Prevention)
Real-time detection and blocking of attempts to exploit vulnerabilities: attack signatures, protocol anomalies, virtual patching. Automatic signature updates.
Web Filtering (URL Filtering)
Categorisation and filtering of URLs using a database updated in real time. Blocking of malicious sites, phishing, malware. DNS filtering. SafeSearch enforcement.
SSL/TLS Deep Inspection
Decryption and inspection of encrypted HTTPS/TLS traffic. Transparent re-encryption to the client. Exception management (banking, health, internal certificates).
Anti-malware (Antivirus)
Analysis of files in transit over HTTP, FTP, SMTP, IMAP and POP3 protocols. Detection of malware, ransomware and malicious documents.
VPN IPsec Site-to-Site
AES-256-GCM encrypted IKEv2 IPsec tunnels with Perfect Forward Secrecy (PFS). Authentication using PKI certificates or pre-shared keys. VPN route-based (VTI). Dead Peer Detection (DPD).
SSL-VPN Remote Access
Secure remote access for mobile users. Full tunnel or split tunnel. MFA authentication (TOTP + LDAP/Active Directory). Web portal or native client.
High Availability (HA)
Active/Passive cluster with synchronisation of sessions and configurations. Automatic failover in the event of a failure (< 1 second break).
NAT/PAT
Network Address Translation (NAT source, NAT destination, PAT) for controlled exposure of services and management of Internet flows.
Logs & Reporting
Full logging of authorised/blocked flows, IPS events, VPN connections and user sessions. Export to SIEM.
Centralised management
Administration via Cloud Temple managed console. Editor interface available (Stormshield Management Center / FortiManager).
Different functions depending on the option chosen
Exclusive features Fortinet Edition
This solution combines native SD-WAN to optimise network performance and reduce costs, with enhanced security thanks to ZTNA, which controls access based on the identity and status of endpoints. It also enables environments to be segmented using VDOMs, while relying on FortiGuard threat intelligence and the Fortinet ecosystem to detect, analyse and manage threats. Finally, anti-spam filtering effectively protects email flows.
Exclusive Stormshield Edition features
Stormshield Network Security offers ANSSI Renforcée-certified advanced protection for OIV, OSE, Defence and LPM environments. Its ASQ engine analyses network protocols beyond signatures to detect zero-day attacks. It integrates natively with Stormshield Data Security to encrypt files and emails, and can be managed via the centralised SMC console. Finally, it benefits from regular threat intelligence with IPS updates, malicious URLs and indicators of compromise.
Technical specifications
Do you have a perimeter security or multi-site interconnection project? Let's talk.
Whether you need to meet the stringent requirements of the ANSSI (LPM, NIS2) with a sovereign Stormshield solution, or deploy an advanced SD-WAN and ZTNA architecture with Fortinet, our cybersecurity experts can help. We can help you size your high-availability firewall cluster and define your filtering and remote access (VPN) policies.
Tell us the broad outlines of your project using this form: we'll get back to you quickly to design the security perimeter that's right for your infrastructure.
Pricing
| Managed Firewall work units - (excluding infrastructure) | Unit | Unit price € excl. tax/month | Commitment |
|---|---|---|---|
| FIREWALL UTM - Fortigate Virtual VM02V - without vdom | 1 virtual cluster | 743,27 € | 12 months |
| FIREWALL UTM - Fortigate Virtual VM04V - without vdom | 1 virtual cluster | 1 302,35 € | 12 months |
| FIREWALL UTM - Fortigate Virtual VM08V - without vdom | 1 virtual cluster | 2 427,72 € | 12 months |
| FIREWALL UTM - Virtual STORMSHIELD EVA1 - 1Vcpu - 2GB RAM - 50 SSLVPN Users Max - 100 Tunnels | 1 virtual cluster | 381,92 € | 1 month |
| FIREWALL UTM - Virtual STORMSHIELD EVA2 - 2Vcpu - 3GB RAM - 512 SSLVPN Max Users - 150 Tunnels | 1 virtual cluster | 441,63 € | 1 month |
| FIREWALL UTM - Virtual STORMSHIELD EVA3 - 4Vcpu - 6GB RAM - 512 SSLVPN Max Users - 200 Tunnels | 1 virtual cluster | 561,08 € | 2 months |
Use cases
A question of compliance and ecosystem.
The Stormshield Edition (French publisher) has been awarded an ANSSI Enhanced Qualification (CC EAL4+). It is essential for OIVs, OSEs, the defence sector or any organisation subject to the LPM/NIS2 requiring total technological sovereignty. The Fortinet Edition is aimed at private companies looking for advanced connectivity features (native SD-WAN, ZTNA access, multi-tenant via VDOMs) and advanced integration with a global SASE ecosystem.
No, management is 100% outsourced to guarantee security.
As part of our “Zero Ops” approach, administration of the cluster (and direct CLI access) is reserved for our teams. Any change to your security policy (filtering rules, VPN settings) is subject to a documented and traceable Change Management process operated by Cloud Temple. Depending on your service plan, you may be provided with read-only access to the editor's interface (SMC or FortiManager) to view your logs and configurations.
Switchover is automatic and almost immediate.
By default, the service includes a High Availability architecture (Active/Passive cluster). In the event of failure of the active node, sessions, configurations and routing tables are already synchronised on the passive node. Failover takes place in less than a second (SLA target), guaranteeing transparent continuity of service for your applications and VPN tunnels.
Yes, thanks to SSL/TLS Deep Inspection.
The Managed Firewall includes a function for decrypting and inspecting traffic encrypted in TLS 1.3, to apply antivirus and intrusion prevention (IPS), before re-encrypting it at its destination. It is of course possible to set decryption exceptions to respect the confidentiality of certain flows (banking, health, etc.).
Complete reversibility, free of charge.
If you decide to leave the service, we will provide you with the complete export of your configuration file in the editor's format, as well as the parameters of your VPN tunnels, free of charge and within 15 days. Flow logs can also be exported within 30 days. After this period, your data and configurations are purged securely within 7 days.