Yes, just through AWS and GCP marketplaces.

ESNI (now Encrypted Client Hello: https://tools.ietf.org/html/draft-ietf-tls-esni-08) is still in draft.

v1 of the firewall that is currently published ignores the extension but will deny in case SNI is absent.

v2, due in a couple of weeks, will actively seek presence of any of ECH extensions and deny them. This is to prevent domain-fronting style of exfiltration attempts. We expect HTTP Clients in the enterprise to not have moved over to ECH any time soon. However, the firewall has a lot of checks and balances built-in to mitigate this in the future when it arrives.