Short answer
Usually not a box at every branch. Cloudflare's cloud firewall protects users and sites; regulated sites can keep an on-site firewall.
In detail: Do you need a firewall with a modern network?
How protection is split:
- Users: Cloudflare Gateway filters web and DNS traffic and applies data protection wherever people work
- Sites: with a site tunnel, Cloudflare's cloud firewall applies policy to all site traffic, including devices that cannot run an app
- Private apps: Cloudflare Access replaces broad VPN access with per-app access
- The Peplink router adds basic firewalling and keeps the site online across several links
Where a regulator, auditor or the size of a site calls for a full next-generation firewall on site, the Advanced package uses Fortinet or Sophos, and FirstNet's Firewall as a Service can run it for you.