In short: WatchGuard Firebox Cloud is the Firebox firewall for Amazon Web Services and Microsoft Azure. With a bring-your-own licence you choose Small, Medium, Large or Extra Large, which caps the CPUs it uses, plus a security subscription, and keep WatchGuard Cloud management. The pay-as-you-go option is billed by the cloud provider instead.
What Firebox Cloud is
Firebox Cloud is WatchGuard's firewall for public cloud. It runs the Fireware operating system used by every Firebox, deployed as a virtual machine from the AWS Marketplace or Microsoft Azure Marketplace. It protects servers and applications you host in the cloud, connects your cloud network to your offices by site-to-site VPN, and gives remote users a secure way in.
Because it is the same software as a hardware Firebox, policies, VPN settings and security services carry across. If you run your own hypervisors instead, see FireboxV.
Sizes
A bring-your-own-licence (BYOL) Firebox Cloud is sold in four sizes, which set the maximum number of virtual CPUs (AWS) or CPU cores (Azure) the firewall will use and with it the maximum VPN throughput:
| Size | Maximum vCPUs or cores |
|---|---|
| Small | 2 |
| Medium | 4 |
| Large | 8 |
| Extra Large | Unrestricted |
If the cloud virtual machine has more CPUs than the size allows, the firewall uses only the licensed number, so match the instance type to the licence to avoid paying the cloud provider for capacity the firewall cannot use.
Security subscriptions
A BYOL licence combines the size with Standard Support, the Basic Security Suite or the Total Security Suite, for example Firebox Cloud Medium with the Basic Security Suite. The services in each are described on our Firebox page. In the cloud a few work differently: the Access Portal needs the Total Security Suite, IntelligentAV needs an instance with at least 4 GB of memory, and the Prime Security Suite is not offered.
Bring your own licence or pay as you go
WatchGuard offers two ways to license Firebox Cloud, and the choice decides how it can be managed:
| BYOL | Hourly / pay as you go | |
|---|---|---|
| Who bills the WatchGuard software | Us, as a WatchGuard licence | Amazon or Microsoft, in the hourly rate |
| Who bills the virtual machine | Amazon or Microsoft | Amazon or Microsoft |
| WatchGuard Cloud management | Yes | No |
| DNSWatch, ThreatSync, NDR for Firebox and Total MDR | Supported (NDR and MDR sold separately) | Not supported |
| Renewal | Licence renewed at the end of its term | No separate licence to renew |
Most organisations that want central management choose BYOL. Switching between BYOL and pay as you go means deploying a new instance and moving the configuration, so it is worth deciding up front. Ask us for a quote for the size and subscription you need.
Deployment and requirements
You deploy Firebox Cloud from the marketplace into your virtual network, place it in the route between your subnets and the internet, then apply the feature key from the activated licence. Once added to WatchGuard Cloud it can be managed alongside your other Fireboxes. Choose the instance type with the security services in mind, because memory and CPU affect which services you can run and how fast.
Who it suits and how we help
Firebox Cloud suits organisations moving servers into AWS or Azure that want the same firewall and VPN approach as their offices, and teams who need inspection that the cloud provider's own network controls do not offer. We size the instance, deploy it, set up VPNs to your sites and renew the licence. For the wider picture, see firewalls and network security.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Firebox Cloud work in Microsoft Azure and AWS?
Yes. Firebox Cloud is available in both the AWS Marketplace and the Microsoft Azure Marketplace, with the same BYOL sizes and pay-as-you-go option.
What is the difference between BYOL and pay as you go?
With BYOL you buy the WatchGuard licence separately and the cloud provider bills only the virtual machine; it supports WatchGuard Cloud management. Pay as you go adds the software charge to your cloud bill but does not support WatchGuard Cloud or DNSWatch.
Is the cloud virtual machine included in the licence?
No. The Firebox Cloud licence covers the WatchGuard software and services. Amazon or Microsoft bills the virtual machine, storage and network usage directly.
Can I switch a Firebox Cloud from pay as you go to BYOL?
Not in place. WatchGuard requires a new instance with the other licence type, after which the configuration is moved across. We plan the move so the firewall's routes and VPNs are ready before you switch over.