In short: WatchGuard Firebox is a hardware firewall whose features depend on its subscription. Standard Support covers firewall, VPN and SD-WAN; the Basic Security Suite adds intrusion prevention, gateway antivirus and web filtering; Prime adds sandboxing and DNS filtering on newer models; Total adds IntelligentAV, ThreatSync XDR and EDR Core. Each appliance is licensed individually.
What a Firebox is
A WatchGuard Firebox is a physical firewall appliance that sits between your network and the internet. WatchGuard makes small desktop units for offices and branches and rack-mount appliances for head offices and data centres. Every Firebox runs WatchGuard's Fireware operating system, so policies work the same way across the range; what changes between appliances is throughput, port count and capacity, and a few services are not offered on the smallest models.
What a Firebox can actually *do* is set by its subscription. With only Standard Support it is a capable firewall and VPN gateway. Add a security suite and the same box inspects traffic for malware, intrusions and unsafe websites. For a firewall on your own hypervisor or in a public cloud, see FireboxV and Firebox Cloud.
Security suites compared
Each subscription includes everything in the one above it.
| Subscription | What it adds | Support |
|---|---|---|
| Standard Support | Stateful firewall, site-to-site and remote access VPN, SD-WAN, Access Portal on most models, centralised management | 24/7 standard |
| Basic Security Suite | Intrusion Prevention Service, Application Control, WebBlocker web filtering, spamBlocker, Gateway AntiVirus, geolocation blocking, botnet detection, Tor exit node blocking, network discovery | 24/7 standard |
| Prime Security Suite | APT Blocker cloud sandboxing, DNSWatch DNS filtering and Shadow AI visibility of generative AI apps on the network | 24/7 standard |
| Total Security Suite | IntelligentAV, ThreatSync XDR, EDR Core for a set number of endpoints, network management | 24/7 Gold |
WatchGuard offers the Prime Security Suite only on Firebox models launched after 2025; on older appliances the choice is Standard Support, Basic or Total. EDR Core is a light endpoint detection and response agent you can deploy on a limited number of computers, set by the appliance model. A Firebox with the Total or Prime suite is also what WatchGuard Total MDR needs to monitor the firewall.
How Firebox licensing works
A Firebox subscription is tied to one appliance by its serial number and activated in your WatchGuard account. There is no per-user charge for the firewall itself, but each model is designed for a range of users and traffic, so choosing the right appliance matters as much as choosing the suite.
- Term: suites are sold for a fixed term and renewed at the end; we track the date for you.
- Upgrades: you can move an existing appliance from Standard Support or Basic to a higher suite without replacing the hardware.
- Cloud management: to manage a Firebox from WatchGuard Cloud it needs an active security suite, or a Standard Support licence that includes WatchGuard Cloud access.
- Expiry: when a suite on a cloud-managed Firebox expires, WatchGuard allows a short grace period before the security services stop.
We confirm in your quote whether the appliance is supplied with the subscription or you already own it. Ask us for a quote and we will size the appliance and suite against your connection speed and user count.
Management and deployment
A Firebox can be managed from WatchGuard Cloud or locally with Fireware Web UI and the Policy Manager tool in WatchGuard System Manager. Cloud management is the simpler choice for most organisations: appliances can be shipped to a site and set up remotely, firmware updates are scheduled centrally and reports are kept in the cloud.
Fireboxes link branch offices with site-to-site VPN or SD-WAN and give home workers remote access VPN. A Firebox can also act as the gateway that FireCloud Total Access uses to reach private resources, and it supplies the network telemetry that WatchGuard NDR analyses.
Who it suits
Fireboxes suit small and mid-sized organisations, schools, charities and multi-site businesses that want one vendor for perimeter security without a large network team. The Basic Security Suite is a sensible minimum for an office whose staff browse the web and receive email. Prime suits newer appliances where you want sandboxing, DNS filtering and visibility of AI tools without the full Total suite. Total suits organisations that want XDR and EDR Core in the firewall, or plan to add MDR.
If you are preparing for Cyber Essentials, a properly configured firewall is one of the five technical controls. For a broader look at the market, see firewalls and network security.
How we help
We size the appliance for your internet connection and users, recommend a suite, configure the firewall in WatchGuard Cloud and set up VPNs and web filtering policies. After go-live we handle renewals, suite upgrades and replacement appliances, so your firewall does not run without its security services.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between the Basic and Total Security Suite?
The Basic Security Suite adds intrusion prevention, gateway antivirus, application control, web filtering and spam blocking to the firewall. The Total Security Suite adds APT Blocker sandboxing, DNSWatch, IntelligentAV, ThreatSync XDR, EDR Core for a set number of endpoints and Gold support.
What happens if my Firebox subscription expires?
The appliance keeps passing traffic, but after a short grace period the subscribed security services stop and you lose support and access to new firmware. We track renewal dates so this does not happen unexpectedly.
Can I upgrade from Basic to Total Security mid-term?
Yes. You can move an existing Firebox to a higher suite without replacing it. We quote the upgrade and apply the new licence in your WatchGuard account.
Do I need the Prime Security Suite?
Only if your appliance supports it and you want the middle option. WatchGuard offers Prime on Firebox models launched after 2025; it adds APT Blocker, DNSWatch and Shadow AI visibility to the Basic suite without the full Total Security Suite.