Can customers implement hardware firewall appliances?
In Oracle Cloud Infrastructure (OCI), customers can absolutely implement dedicated firewall appliances. However, because you are renting a software-defined environment, these are typically deployed as Virtual Appliances (NVAs) rather than physical rack-mounted hardware.
As of 2026, here is how you can implement a "hardware-grade" firewall in your OCI tenancy:
The OCI Marketplace contains pre-configured images from the world's leading security vendors. These are designed to run on OCI compute shapes but function exactly like their physical hardware counterparts.
Top Vendors: You can deploy Palo Alto Networks (VM-Series), Fortinet (FortiGate), Check Point (CloudGuard), and Cisco (Secure Firewall).
Licensing: You can either pay per hour (included in your OCI bill) or "Bring Your Own License" (BYOL) if you already have an existing contract with the vendor.
If you want the power of a Palo Alto hardware appliance without the headache of managing a virtual machine, OCI offers a Native Network Firewall.
Powered by Palo Alto: This service uses Palo Alto’s Next-Generation Firewall (NGFW) technology under the hood.
Managed Service: Oracle handles the scaling, high availability, and patching. You only manage the security policies (rules, URL filtering, intrusion prevention).
Performance: It is highly scalable, supporting throughput from 4 Gbps up to 25 Gbps.
To make a firewall appliance work like a "hardware gate" for your entire cloud, architects use a Hub-and-Spoke design:
The Hub: You create a central VCN (the "Hub") where your firewall appliance sits.
The Spoke: All your other application VCNs (the "Spokes") are connected to this hub via a Dynamic Routing Gateway (DRG).
The Policy: You configure routing so that all traffic—whether it’s coming from the internet or moving between your own servers—is forced to pass through the firewall appliance in the Hub for inspection.
| Feature | 3rd Party Appliance (VM) | OCI Network Firewall (Native) |
| Management | You manage OS, updates, & HA | Oracle manages infrastructure |
| Scaling | Manual (Resize VM) | Automatic / On-demand |
| Familiarity | Same UI as your on-prem hardware | OCI Console / API |
| Best For | Reusing existing team skills | Simplified, cloud-native scale |
A unique technical step when implementing your own firewall appliance in OCI is disabling the Source/Destination Check on the firewall's Virtual Network Interface Card (VNIC).
Why? By default, a cloud server only accepts traffic addressed to it.
The Fix: Since a firewall needs to process traffic meant for other servers, you must toggle this setting to allow the appliance to "act like a router" and inspect transit traffic.