Network Security — enterprise stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
1. Firewall Platform - Virtual / Edge NGFW
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitspfSense CE: Free OSS unlimited, community support. pfSense Plus: $129/yr/instance. OPNsense: Free. FortiGate-VM: $0.80/hr = ~$576/mo PAYG, BYOL $600/yr + support. Palo Alto VM-300: $1.50/hr = ~$1080/mo PAYG, bundle $3000/yr with Threat Prevention. Free tier limits: Community edition unlimited throughput, no TAC.
2. VPN Gateway - Remote Access VPN
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsWireGuard: Free OSS unlimited. OpenVPN AS: Free 2 concurrent users, $15/mo for 10 concurrent, $0.50/hr for 20. Tailscale: Free 100 devices/3 users, Pro $6/user/mo, Enterprise $18/user/mo. Pritunl: Free tier 1 gateway. Overage: Tailscale $6 per extra user.
3. Site-to-Site VPN / SD-WAN Edge Router
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsstrongSwan: Free OSS. ZeroTier: Free 25 nodes, Basic $50/mo 50 nodes. Fortinet SD-WAN: Included in FortiGate license $800/yr per edge. Meraki vMX: $600/yr + license. Palo Alto Prisma SD-WAN: $1.2k/yr per site. Free limit: WireGuard unlimited tunnels, manual mesh.
4. IDS/IPS Engine - Network Intrusion Detection/Prevention
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSuricata: Free OSS unlimited, community rules. Snort: Free community rules delay 30d, Subscriber Rules $29/mo, Snort 3 integrated $99/mo. Palo Alto Threat Prevention: $2000/yr per VM-300. FortiGate IPS: $1200/yr. CrowdStrike Falcon IDS: $59.99/host/mo. Free tier: Suricata/Snort handle 10Gbps on commodity HW.
5. Network Access Control (NAC)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsPacketFence: Free OSS unlimited endpoints, community support. OpenNAC: Free 50 endpoints. Cisco ISE: Base $50k/yr + $4/endpoint/mo, ~$120k/yr for 1000 endpoints. Forescout: $50k/yr base + $8/endpoint. Aruba ClearPass: $15k starter + $10/endpoint. Free limits: PacketFence supports 10k nodes on 1 VM.
6. Network Segmentation / Microsegmentation Controller
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCalico OSS: Free. Illumio Core: $50k/yr starter 100 workloads, $500/workload/yr scale. Guardicore: 30-day free trial, then $60k/yr 100 workloads, $400/workload. VMware NSX microseg: $6k/CPU/yr. Free limits: Manual VLAN ACLs unlimited but no visibility.
7. Network Traffic Monitoring / NDR (Network Detection & Response)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsZeek: Free OSS, needs 16GB RAM per 10Gbps. ntopng Community Free 30-day retention. Arkime: Free OSS. ExtraHop: $50k/yr base 1Gbps, $95k/yr 10Gbps. Darktrace: $100k/yr starter, $8k per 1Gbps sensor. Vectra AI: $70k/yr. Free limit: Zeek unlimited sensors community support.
8. DDoS Protection / Anti-DDoS Edge & Transit
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsFastNetMon OSS: Free. AWS Shield Standard: Free included. Cloudflare Free: Unlimited unmetered mitigation L3/4. Magic Transit: $5000/mo base includes 20TB, $0.05/GB overage, $10k/mo for 100TB commits. AWS Shield Advanced: $3000/mo + $0.05/GB + $0.10/hr WAF. Akamai Prolexic: $7500/mo. Imperva: $6000/mo. Free limits: Self-hosted handles <20Gbps with BGP blackholing.
9. Log Management / SIEM for Network Logs (Firewall, Flow)
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsElastic OSS: Free self-hosted unlimited ingest. Elastic Cloud: $95/mo 1GB/day, $0.15/GB overage. Graylog: Free 5GB/day, Enterprise $1500/mo. Splunk: $150/GB/mo, Cloud $2k/mo 5GB/day. Wazuh: Free. Devo: $80/GB. Free limits: ELK 100GB disk per node ~2TB/month flows on 1 node, retention 7 days.
10. Secrets Management for Firewall / VPN Credentials
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS: Free unlimited secrets, self-hosted. Infisical: Free 10 users, Cloud $20/mo. Doppler: Free 5 users/100 secrets, Pro $15/user/mo. HCP Vault: $0.03/hr cluster (~$22/mo) + $0.10/secret/mo >1000. CyberArk Conjur: $30k/yr. Free limits: Vault OSS 0$ but HA needs 3 nodes.
11. Network Infrastructure Monitoring / Uptime & SNMP
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsPrometheus/Grafana: Free OSS unlimited metrics. LibreNMS: Free. Zabbix: Free. Checkmk Raw: Free 750 services. Datadog: $15/host/mo infra + $30/host/mo network monitoring, $5/GB logs. SolarWinds NPM: $2.5k/yr 100 nodes, $15k/yr 1000 nodes. PRTG: Free 100 sensors, then $1800/yr 500 sensors. Free limits: LibreNMS monitors 10k ports on 4 vCPU.
12. Web Application Firewall (WAF) / L7 Firewall Edge
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsModSecurity: Free OSS. Cloudflare Free WAF: Free 1 rule, Pro $20/mo 5 rules. AWS WAF: $5/mo per ACL + $1 per million req, ~$25/mo small site. Imperva: $500/mo starter, $3000/mo full. FortiWeb Cloud: $350/mo. F5 Advanced WAF: $2k/mo. Free limits: ModSecurity unlimited but self-hosted.
13. DNS Firewall / Secure DNS Filtering & DNSSEC
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsPi-hole: Free. BIND RPZ: Free. Cloudflare Gateway Free: 50 users free DoH filtering. NextDNS: Free 300k queries/mo, $2.99/mo unlimited. Cisco Umbrella: $5/user/mo DNS, $10/user/mo full. Infoblox: $2/infra/mo. Quad9: Free. Free limits: Pi-hole unlimited but no threat intel feeds.
14. Load Balancer / Reverse Proxy (L4/L7 + Global LB)
Runs in multiple regions for speed and resilience. Enterprise-grade reliability and the hardest to retrofit.Pricing & free-tier limitsHAProxy/Nginx OSS: Free unlimited. Caddy: Free. Cloudflare LB: $5/mo + $0.50 per 1M req. AWS ALB: $16/mo base + $0.0225/LCU-hour ~$25-80/mo. NGINX Plus: $2500/yr/instance. F5 BIG-IP VE: $2k/yr lab, $8k/yr prod 1Gbps. Free limits: OSS handles 100k rps per core.
15. Packet Capture & Forensics Storage (Full Packet Capture)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsArkime: Free OSS, storage cost only ~$20/TB/mo S3. Stenographer: Free Google OSS 10Gbps per node. NetWitness: $80k/yr starter 10TB. ExtraHop Packetstore: $60k/yr 48TB. EndaceProbe: $120k/appliance 100TB. Free limits: Arkime single node 50TB with 30-day retention on 10Gbps sampled 10:1.
16. NetFlow / IPFIX / sFlow Collector & Analyzer
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsnfdump/nfsen: Free OSS unlimited. pmacct: Free. ElastiFlow Basic Free 4k fps, Pro $2500/yr 25k fps. ntopng Pro $149/yr. Kentik: $15k/yr starter 10k fps, $2 per 1k fps overage. Scrutinizer: $5k/yr 10k fps, $25k/yr 100k fps. SolarWinds NTA: $2k add-on. Free limits: nfdump handles 100k flows/sec on 8 vCPU.
17. PKI / Certificate Management for VPN & Firewall TLS
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsLet's Encrypt: Free auto certs rate 50/week/domain. Smallstep OSS: Free. Cloudflare ACM: Free edge certs, $10/mo for custom certs. Venafi: $50k/yr base 1000 certs, $15/cert/yr overage. Sectigo: $20k/yr 500 certs. DigiCert: $8k/yr 250 certs. Free limits: Let's Encrypt unlimited but 90-day expiry, no S/MIME.
18. RADIUS / TACACS+ AAA Server for Network Admin Access
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsFreeRADIUS: Free unlimited. tac_plus: Free. JumpCloud: Free 10 users, $7/user/mo after. Cisco ISE AAA part of $50k/yr suite. ClearPass: $12k base + AAA licenses. Radiator: $1800 one-time. Foxpass: $4/user/mo. Free limits: FreeRADIUS handles 10k auth/sec on 4 cores.
19. IP Address Management (IPAM) / DDI Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsphpIPAM: Free OSS unlimited. NetBox OSS: Free. NetBox Cloud: Free 50 IPs, $500/mo 10k IPs. Infoblox: $20k/yr 1000 IPs, $8/IP/yr overage. BlueCat: $25k/yr 2000 IPs. SolarWinds IPAM: $2k/yr 1024 IPs. Free limits: NetBox CE handles 100k IPs self-hosted.
20. Threat Prevention Subscription / IPS Signatures Feed Service
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsET Open: Free. ET Pro: $800/yr per sensor. Abuse.ch: Free. Palo Alto Threat Prev: $2000-4500/yr per VM. FortiGuard IPS: $1200/yr per VM, $3k/yr for HW 100F. CrowdStrike Intel feeds: $20k/yr. Free limits: ET Open delayed 30 days vs Pro real-time.
21. SSL/TLS Inspection / Decryption Appliance & Key Escrow
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsSquid SSL Bump: Free OSS but CPU heavy ~$200/mo compute for 1Gbps. PolarProxy: Free OSS. Mitmproxy: Free. FortiProxy VM: $1.2k/yr 500 users. Blue Coat: $20k/yr 1000 users. Palo Alto decryption included in PAN licence $1500/yr. A10 Thunder SSLi: $35k appliance. Free limits: Squid 500Mbps per vCPU for decrypted traffic.
22. Network Sandbox / File Analysis for Network Traffic
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsCuckoo/CAPEv2: Free OSS self-hosted. Joe Sandbox Community: Free 12 samples/day. WildFire: $3k/yr per VM-300 add-on, $0.50 per file analysis overage after 10k/mo. FortiSandbox VM: $4k/yr 5000 files/day. Hybrid Analysis: Free tier. Check Point Threat Emulation: $5k/yr. Free limits: CAPEv2 needs $500/mo bare metal for 500 samples/day.
23. Network DLP / Data Loss Prevention (Network Layer)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenDLP: Free OSS. MyDLP Community: Free. Nightfall: Free 100 findings/mo, $200/mo 5k events, $0.05 per event overage. Symantec DLP: $30k/yr 500 users + $60/user/yr. Forcepoint: $35/user/yr. Palo Alto Enterprise DLP: $15k/yr base + $5/user/mo. Free limits: OpenDLP no ICAP, manual only.
24. Secure Web Gateway (SWG) / Forward Proxy Filter
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSquid+SquidGuard: Free OSS. e2guardian: Free. Cloudflare Gateway: Free 50 users, PayGo $7/user/mo. Zscaler ZIA: $30/user/mo business, $45/user/mo transformation, min $36k/yr. Netskope: $35/user/mo. Prisma Access: $200/user/yr. Free limits: Squid handles 10k concurrent but no cloud intel.
25. Cloud Firewall / Firewall-as-a-Service (FWaaS)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAWS NFW: Free tier 1000 hrs/yr, then $0.395/hr = ~$285/mo per endpoint + traffic $0.065/GB. Azure Firewall Basic: $1.25/hr ~ $900/mo. Cloudflare FW: Free 5 rules, Pro $20/mo 25 rules. Prisma Cloud FW: $600/mo per VPC. FortiGate CNF: $0.50/hr ~$360/mo. Check Point CloudGuard: $1.8k/mo. Free limits: AWS NFW free 1000 hourly + 1M requests.
26. SASE / SSE Platform (Converged Edge Security Service)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsDIY OpenSASE: Free OSS infra cost only. Cloudflare One Free 50 users, Teams Standard $7/user/mo, Enterprise $14/user/mo. Cato: $25/site/mo + $25/user/mo, $60k/yr min. Zscaler SSE: $35/user/mo bundle, $90k/yr min 100 users. Palo Alto Prisma SASE: $250/user/yr. Netskope: $40/user/mo. Free limits: Cloudflare One free 50 seats, ZTNA only.
27. Network TAP / SPAN Aggregation / Packet Broker
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOVS mirroring: Free OSS. Cubro Mini TAP: $250 one-time. Garland TAP: $400-800 one-time. Gigamon: $20k/appliance 10G + $8k/yr support, Visibility Platform $70k/yr. Ixia Flex TAP: $1.2k one-time. Arista DANZ: $5k/port license yr. cPacket: $30k/yr. Free limits: Software TAP handles 1Gbps per core max.
28. Network Vulnerability Scanner (Network Layer)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenVAS Community: Free unlimited IPs self-hosted. Nessus Essentials: Free 16 IPs. Greenbone Basic: $1800/yr 50 IPs. Nessus Pro: $3.5k/yr 128 IPs, $5k/yr 256 IPs. Qualys: $25k/yr 500 IPs. InsightVM: $2k/yr 128 IPs. Free limits: OpenVAS feed delayed 14d vs enterprise feed same day.
29. Firewall Policy Audit / Compliance & Rule Cleanup Manager
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsCustom scripts: Free. Nipper Community: Free 1 device. Tufin: Free tier 10 FW, then $40k/yr 25 FW, $85k/yr 100 FW. FireMon: $35k/yr 25 FW. AlgoSec: $50k/yr 25 FW, $120k/yr 100 FW. Skybox: $60k/yr. Free limits: Self-audit handles 1k rules manual review.
30. BGP & Routing Security / Route Hijack & Leak Protection
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsRoutinator: Free OSS. BGPalerter: Free OSS. Cloudflare RPKI Portal: Free. Kentik Free: Free 1B flow records. ThousandEyes BGP: $200/mo 5 tests, $2k/mo 50 feeds. Cisco Crosswork Cloud (ex BGPmon): $12k/yr. MANRS compliance free. Kentik Route: $20k/yr. Free limits: Routinator validates 200k ROAs on 2 vCPU.
31. Hardware Security Module (HSM) / Key Management for FW & VPN
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSoftHSM: Free. YubiHSM2: $550 one-time per device + $100/yr support. AWS CloudHSM: $1.45/hr = ~$1044/mo per HSM + $0.10 per 10k ops. Thales Luna: $15k one-time per appliance + $3k/yr support. Entrust nShield: $18k + $4k/yr. Azure Dedicated HSM: $1.40/hr. Free limits: SoftHSM not FIPS 140-2 L3, software only.
32. On-Prem DDoS Scrubbing Appliance / Mitigation Center Hardware
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsFastNetMon: Free OSS. Corero: $2000/mo lease 10Gbps, $5000/mo 100Gbps. FortiDDoS VM: $8k/yr 10Gbps. Arbor TMS HD: $70k appliance one-time + $14k/yr support 20Gbps, $150k 100Gbps. Radware DefensePro x4420: $120k one-time + $24k/yr. Free limits: FastNetMon mitigates 40Gbps with BGP RTBH only.
33. ICAP Server / Content Adaptation for DLP & SWG Inspection
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsc-icap: Free OSS unlimited. Symantec Content Analysis Trial free 30d, then $25k/yr appliance 1000 users. Blue Coat CAS S200 $18k one-time + $4k/yr. Fortinet FortiProxy built-in $0 with license $1200/yr. McAfee Web Gateway ICAP: $30/user/yr. Free limits: c-icap 500 req/sec per core.
34. OT / IoT Network Security / Industrial Firewall & DPI
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCommunity tools: Free. Nozomi Trial: Free 30d 100 assets. Dragos Community: Free 100 assets. Claroty: $70k/yr 500 OT devices, $140/OT asset/yr overage. Nozomi: $60k/yr 500 assets. Fortinet Rugged FW: $5k/appliance + $1.5k/yr subs. Dragos Platform: $100k/yr starter. Free limits: OSS IDS covers Modbus/DNP3 limited signatures only.
35. Network Encryption / MACsec / IPsec Offload & High-Speed Crypto
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsLinux MACsec: Free OSS, needs MACsec-capable NIC (~$150 one-time Mellanox). strongSwan: Free 10Gbps per core AES-NI. AWS VPN Acceleration: $0.05/hr. Thales HSE 10G: $12k one-time per appliance + $2k/yr, 100G $45k. Certes CEP 10G: $10k. Juniper EX with MACsec: $8k. Free limits: Linux MACsec 25Gbps per NIC with ConnectX-6 Dx.
36. Threat Intelligence Platform (TIP) - Network Feeds & IOC Sync to FW
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP: Free OSS unlimited. OpenCTI: Free OSS. OTX: Free community, 1M pulses. GreyNoise Free: 50 queries/mo free, Pro $500/mo 50k. Anomali: $60k/yr 5 users 10 feeds. Recorded Future: $120k/yr base. ThreatConnect: $50k/yr. Free limits: MISP needs self-hosted infra $200/mo compute to sync 50 feeds.
37. Network Automation & Orchestration / Firewall Orchestrator & IaC
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAnsible OSS: Free. OpenTofu: Free. NAPALM: Free. Ansible AAP: $50k/yr 100 nodes, Trial free 60 nodes. StackStorm: Free OSS. Itential: $75k/yr base 50 devices. Gluware: $90k/yr 100 devices. Tufin Orchestration: Included in $85k/yr suite, $30k add-on. Free limits: Ansible handles 1000 FW configs with GitOps.
38. Zero Trust Network Access (ZTNA) Platform - Enterprise Gateway
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOpenZiti: Free OSS unlimited. Pomerium OSS: Free. Cloudflare Access: Free 50 users, $7/user/mo Teams, Enterprise $14/user/mo. Tailscale: Free 100 devices. ZPA: $20/user/mo $28k/yr min 100 users, $30/user/mo full. Prisma Access ZTNA: $200/user/yr + $5000/mo tenant. Appgate SDP: $15/user/mo $25k/yr min. Free limits: OpenZiti self-hosted 10k concurrent on 8 vCPU.
How this enterprise network security checklist works.
Each requirement below is something a enterprise network security build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.