CloudConnexa
Jul 17, 2026
Jul 22, 2026
•
14 min read
CloudConnexa and Check Point Harmony SASE both promise to replace a stack of point solutions with a single, cloud-delivered service — but they draw the line between “included” and “add-on” in very different places. This breakdown covers architecture, Zero Trust controls, the security stack, and where each pricing model works best, so you can match the right platform to your environment.
Quick summary
CloudConnexa bundles ZTNA, content filtering, and IDS/IPS into one OpenVPN-based service with flat, seat-based pricing and no per-feature add-ons. Check Point Harmony SASE offers a deeper, modular threat-prevention stack — sandboxing, CASB, DLP, Enterprise Browser — built on a privately-owned backbone with a published 99.999% SLA, with advanced modules priced separately. Choose CloudConnexa for an all-included, OpenVPN-based service sized for SMB and mid-market IT teams. Choose Harmony SASE if you need Check Point's broader threat-prevention stack and are prepared to license the modules you'll use.
CloudConnexa overview
OpenVPN CloudConnexa is a cloud-delivered network security platform that unifies ZTNA (private application access), secure internet access (content filtering, IDS/IPS), SaaS protection, and site-to-site connectivity into a single service. It is built around OpenVPN's “Wide-area Private Cloud” (WPC) model: an overlay private network spanning CloudConnexa's Points of Presence, through which customers connect their networks via software Connectors that require no inbound ports and their devices via the OpenVPN Connect client, while OpenVPN operates the control and data planes. It uses OpenVPN Data Channel Offload (DCO) for high performance and offers zero-trust controls based on identity, device, and location context. Client and device connections use the OpenVPN protocol, and IPsec is supported for site-to-site (Network Connector) connections. Its built-in Cyber Shield delivers content filtering and IDS/IPS at no extra licensing tier, and the service is SOC 2 Type 2 and ISO/IEC 27001 certified.
Check Point Harmony SASE overview
Check Point Harmony SASE (formerly Perimeter 81, acquired by Check Point) is a cloud-delivered SASE platform combining ZTNA, secure internet access, and a global private network, managed from the Check Point Infinity Portal. The vendor operates the control and data plane across 80+ privately owned points of presence, with a Tier-1 dual-provider backbone and a published 99.999% availability SLA. Devices connect through the SASE Agent using WireGuard (default) or OpenVPN, while sites connect via IPsec (IKEv1/IKEv2), a WireGuard Connector, or OpenVPN tunnels. Its security stack draws on Check Point's threat-prevention engines — URL filtering, malware scanning, and (via add-on licenses) sandboxing/threat emulation, content disarm, zero-phishing, CASB/SaaS security, and DLP. Advanced threat-prevention, Enterprise Browser, CASB, and DLP capabilities require higher-tier or add-on licenses.
For the side-by-side feature grid OpenVPN maintains against this vendor, see OpenVPN vs. Perimeter 81.
When to choose CloudConnexa vs. Check Point Harmony SASE
Choose CloudConnexa if you want one service that bundles ZTNA, content filtering, and IDS/IPS without per-feature add-on licenses; if you want the OpenVPN protocol with router and VPS compatibility; or if you need IPsec-or-OpenVPN site-to-site and full-tunnel internet protection included at no extra cost.
Choose Check Point Harmony SASE if you need a broad threat-prevention stack — sandboxing/threat emulation, content disarm and reconstruction, zero-phishing, CASB/SaaS security, and DLP — backed by Check Point's ThreatCloud and a private backbone with a 99.999% SLA; you require agentless/clientless web-app access and an Enterprise Browser for unmanaged devices; and you can license advanced modules as add-ons and administer a broader platform.
Architectural trade-off
Both platforms route traffic through vendor-operated infrastructure rather than a peer-to-peer mesh, so the trade-off here isn't gateway-vs-mesh — it's how each vendor draws the line between what's built into the base service and what's a paid add-on, and which protocol and network footprint back that up. The points below weigh that difference and test where common claims hold.
Where Check Point's approach can help
- Its 80+ privately owned PoPs and Tier-1 dual-provider backbone, backed by a published 99.999% SLA, can matter for organizations routing significant multi-site or branch traffic across Check Point's network rather than the public internet.
- WireGuard as the default device protocol uses a smaller, modern codebase that can simplify auditing and, in some benchmarks, edge out throughput versus a non-DCO OpenVPN deployment.
- Agentless/clientless access through the Enterprise Browser reduces endpoint footprint for contractors, M&A integrations, and BYOD scenarios where installing an agent isn't practical.
- A single vendor umbrella (Check Point Infinity Portal) can consolidate SASE with the rest of a Check Point security estate — firewalls, endpoint, threat intel — for teams already standardized on Check Point.
Trade-offs and claim-vs-reality
- The claim that Harmony SASE is “one platform” holds for administration, but not for licensing: sandboxing/threat emulation, content disarm and reconstruction, zero-phishing, CASB, and DLP sit behind higher tiers or add-ons, so the base SASE license doesn't include the full threat-prevention stack the brand is known for.
- “WireGuard is faster” depends on the comparison point: OpenVPN's Data Channel Offload (DCO) is built specifically to close the historical OpenVPN throughput gap while keeping OpenVPN's broader router, VPS, and legacy-device compatibility — so raw-protocol benchmarks don't necessarily predict real-world throughput on either service.
- Agentless web access is scoped to browser-based/web applications through the Enterprise Browser; most private-app, site-to-site, and non-web traffic still needs the SASE Agent or a connector, so “clientless” doesn't mean the agent becomes optional across the board.
- A 99.999% SLA and private backbone matter most when a large share of your traffic actually transits that backbone across many sites; a single-office or fully remote org may not experience a noticeable difference versus CloudConnexa's Points of Presence.
- Consolidating SASE, firewall, and endpoint onto one vendor can simplify procurement, but it also raises switching cost and concentrates risk in a single vendor relationship — worth weighing against CloudConnexa's narrower, single-purpose scope.
Feature comparison
Architecture & Deployment Model |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Cloud-hosted control + data plane |
Yes — WPC overlay; fully hosted |
Yes — fully cloud-delivered; unified Infinity Portal [1] |
|
Network model |
Full-mesh core between PoPs; WPC overlay |
Full-mesh any-to-any global cloud network |
|
Multiple isolated overlay networks |
Yes — multiple isolated WPCs per account (segment OT, IoT, and IT networks) |
Yes — multiple isolated Networks per account, each with its own gateways, IP, and groups |
|
Connection model |
Devices via OpenVPN Connect; networks/servers via OpenVPN or IPsec Connectors |
Devices via SASE Agent; sites via IPsec / WireGuard Connector / OpenVPN tunnel |
|
Regions / PoPs |
~36 Regions worldwide |
80+ privately owned PoPs; Tier-1 backbone; 99.999% SLA |
|
Branch / SD-WAN connector |
Compatible routers and software with OpenVPN and IPsec tunnels. No SD-WAN MPLS links. |
Yes — Check Point SD-WAN integration; 3rd-party SD-WAN via IPsec |
|
On-device / hybrid SASE |
Content filtering can be performed without tunneling internet traffic. |
Yes — "hybrid SASE" enforces SWG inspection within the agent |
Administration & Management |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Web admin console |
Yes — Administration Portal; Owner/Admin/Member roles |
Yes — unified Infinity Portal [1] dashboard |
|
Public API |
Yes — REST API with OAuth 2.0 |
Yes — Harmony SASE REST API (networks, gateways, tunnels, users, groups) |
|
Infrastructure-as-code |
Yes — Terraform provider |
No. API-driven |
|
Multi-tenant |
Yes. Multiple isolated WPCs per Owner account |
Yes — multi-tenant management |
Zero Trust & Identity |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Zero-trust access model |
Zero Trust Application Broker in CloudConnexa continuously verifies identity, location context, and device posture, then assigns a synthetic intermediate IP scoped to a single authorized app. The device never receives a route to the private network, making lateral movement structurally impossible. Access Groups control access to destination applications and IP services based on source identity. They include network-to-application and network-to-network access control. |
Identity- and posture-based least-privilege across full mesh |
|
Agentless / clientless app access |
No. |
Yes — reverse-proxy portal for HTTP/HTTPS, RDP, VNC, SSH |
|
Enterprise Browser [2] (unmanaged devices) |
Not offered |
Yes — with in-browser DLP and threat protection (not available in all plans) |
|
User authentication |
Local username/password, LDAP, SAML 2.0 |
Local user database, SAML, OIDC, Active Directory |
|
Simultaneous IdP + local auth |
Yes — SAML and local accounts usable at the same time. (not available in all plans) |
Yes — local user database coexists with SAML/IdP users |
|
Multiple group membership per user |
Yes — one Primary plus up to 20 Secondary user groups (additive) |
Yes — multiple groups per member; policies evaluated additively |
|
MFA |
Built-in 2FA; passkey / passwordless. Delegated to IdP when SAML is used. |
Yes — supported (commonly via IdP) |
|
Device posture / compliance |
Yes — OS, OS version, antivirus, disk encryption, certificate |
Yes — endpoint security, certificate, disk encryption, file/registry/process checks; continuous validation; agentless posture too |
|
Location / geo context |
Yes — allow/block by IP range or country |
Yes — geo-location, date/time |
|
SCIM provisioning |
Yes — SCIM 2.0 (not available in all plans) |
Yes — SCIM provisioning from IdP |
|
Service / non-human identity |
Host Connectors; REST API (OAuth client credentials); mutual TLS. |
Partial — scoped API token; local-database accounts for non-interactive use |
|
Device / supply-chain trust |
Device Identity Verification & Enforcement (locks profile to device) |
Partial — device-certificate validation and device isolation; no node-key co-signing |
Access Use Cases |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Remote access |
Yes — core use case |
Yes — agent-based full network access |
|
Site-to-site |
Yes — via Network Connectors (IPsec or OpenVPN) |
Yes — IPsec, WireGuard Connector, or OpenVPN; BGP routing |
|
Internet gateway / secure egress |
Yes — any Network as Internet Gateway; smart geo routing |
Yes |
|
Selective SaaS routing by domain (split tunnel on) |
Yes — route specific SaaS domains through a chosen Internet Gateway with split tunnel on (no full tunnel required) |
Yes — policy-based routing of selected destinations via the gateway |
|
Vendor-provided static egress IP |
No — the customer runs the Internet Gateway and supplies the public IP |
Yes — vendor-provided dedicated cloud IP (standard) |
|
Cloud connectors (AWS / Azure / GCP) |
Yes — AWS, Azure, GCP; plus VPS and routers |
Yes — integrates with AWS, Azure, GCP and on-prem firewalls |
|
Agentless ZTNA web apps |
Not offered |
Yes — reverse-proxy web/RDP/SSH access |
|
Split tunneling |
Yes — Split Tunnel On/Off and Restricted Internet |
Yes — agent feature (not on plain OpenVPN tunnel mode) |
Networking |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Client/device VPN protocol |
OpenVPN only; OpenVPN Data Channel Offload (DCO) for throughput |
WireGuard (default) and OpenVPN; no IPsec/IKEv2 for the client agent |
|
WireGuard |
No — not supported for any connection type |
Yes — default for client; dedicated WireGuard Connector for sites |
|
Site-to-site protocol |
IPsec or OpenVPN (Network Connectors) |
IPsec (IKEv1/IKEv2), WireGuard Connector, or OpenVPN |
|
OpenVPN tunnel feature caveat |
Full feature set on OpenVPN client/network tunnels |
OpenVPN tunnel mode lacks split tunnel, DNS filtering, SWG, firewall, SSO, logging |
|
DNS |
Yes — DNS Proxy, custom records/zones, private DNS support. |
Yes — cloud resolver with DNS filtering; private DNS per network |
Secure Internet Access |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Secure web gateway (SWG) |
DNS Proxy + Cyber Shield Traffic Filtering |
Yes — cloud + on-device SWG |
|
URL / content filtering |
Yes — Domain Filtering, 43 categories; included |
Yes — 110 categories; app control for 8,000+ apps |
|
Malware protection |
Yes — content filtering for malware, ransomware, C2, phishing. No scanning of downloads. |
Yes — scans downloads and web components |
|
HTTPS / SSL inspection |
No. Does not do DPI of secure traffic flows. |
Yes — HTTPS/SSL inspection |
|
IDS / IPS |
Yes — Cyber Shield Traffic Filtering (monitor/block) |
Delivered via Threat Emulation [3] / Anti-Bot [6] / Zero-Phishing [5]. |
|
Sandboxing / threat emulation / CDR |
Not offered. |
Yes — Threat Emulation [3], Threat Extraction (CDR) [4], Zero-Phishing [5] (not available in all plans) |
|
Cloud firewall (FWaaS) |
Yes - Access Groups + WPC firewall function |
Yes — identity-based Firewall-as-a-Service |
|
CASB / SaaS security |
Not offered (SaaS access can be restricted to an Internet Gateway egress IP, and DNS logs allow for shadow-SaaS discovery) |
Yes — shadow-SaaS discovery, SSPM, anomaly detection (not available in all plans) |
|
DLP |
Not offered |
Yes — 700+ data types; in-browser and SaaS DLP (not available in all plans) |
Observability & Operations |
||
|
Capability |
CloudConnexa |
Check Point Harmony SASE |
|---|---|---|
|
Audit logging |
Yes — Audit Log of config changes; CSV export |
Yes — audit logs |
|
Access / traffic visibility |
Yes — Access Visibility and DNS Log |
Yes — activity monitoring dashboards |
|
SIEM / log export |
Yes — JSON streaming to AWS S3 |
Yes — Syslog forwarding; Splunk, Microsoft Sentinel, Amazon S3 (CEF/LEEF) |
|
Log retention |
retention amount depends on the log type and plan |
3 months default; extended retention at extra cost (not available in all plans) |
|
Alerts |
Yes — email alerts for usage, connector status, log streaming |
Yes — anomaly-based alerting (strongest under SaaS Security license) |
Reference: Check Point Harmony SASE named features
Check Point markets several capabilities under proprietary names. The numbers below are referenced in the comparison tables above (e.g. "Infinity Portal [1]"). Each entry summarizes the function and the closest equivalent in CloudConnexa.
|
Feature |
What it does |
CloudConnexa equivalent |
|---|---|---|
|
Check Point's unified cloud console for managing its security products. |
The CloudConnexa Administration Portal. |
| 2. Enterprise Browser |
A secured/managed browser extending zero-trust access (with in-browser DLP and threat protection) to unmanaged devices. |
Not offered |
| 3. Threat Emulation |
Cloud sandbox that detonates files to detect zero-day malware. |
Not offered |
| 4. Threat Extraction (CDR) |
Content Disarm & Reconstruction — strips active content and rebuilds clean files. |
Not offered. |
| 5. Zero-Phishing |
Real-time detection of zero-day phishing pages. |
Cyber Shield blocks known phishing domains via content / DNS filtering (not a dedicated zero-day engine). |
| 6. Anti-Bot |
Detects and blocks command-and-control / bot communications. |
Cyber Shield Traffic Filtering blocks C2 and known threats. |
Frequently asked questions
What is Check Point Harmony SASE?
Check Point Harmony SASE is a cloud-delivered SASE platform (formerly Perimeter 81, acquired by Check Point) that combines ZTNA, secure internet access, and a global private network under the Check Point Infinity Portal, with add-on modules for advanced threat prevention, CASB, and DLP.
Is CloudConnexa the same as Perimeter 81?
No. CloudConnexa is OpenVPN's own cloud-delivered ZTNA/SASE platform. Perimeter 81 is the product Check Point acquired and has since rebranded as Check Point Harmony SASE — the two are unrelated companies and codebases. See OpenVPN vs. Perimeter 81 for a direct feature comparison.
Does CloudConnexa support WireGuard?
No. CloudConnexa's client and device connections use the OpenVPN protocol, accelerated with OpenVPN Data Channel Offload (DCO), with IPsec available for site-to-site Network Connectors. Check Point Harmony SASE defaults to WireGuard for its SASE Agent and also supports OpenVPN.
Does Check Point Harmony SASE include content filtering and IDS/IPS by default?
Basic URL filtering and malware scanning are part of the core stack, but capabilities like sandboxing/threat emulation, content disarm and reconstruction, zero-phishing, CASB, and DLP require higher-tier or add-on licenses. CloudConnexa's Cyber Shield bundles content filtering and IDS/IPS into the base service.
Which is better for SMBs vs. enterprises?
CloudConnexa's flat, seat-based pricing and bundled security stack tend to suit SMB and mid-market IT teams that want predictable costs without add-on licensing. Harmony SASE's modular pricing and deeper threat-prevention stack tend to suit organizations that need those specific advanced modules and are prepared to license them as they scale. For a broader look at where each SASE platform fits, see OpenVPN's Best SASE Solutions guide.
Secure your network now
Ready to see how CloudConnexa compares firsthand? Get started for free or book a demo — no credit card required.
Related posts from OpenVPN
