In short: WatchGuard FireCloud is a cloud-delivered security service for remote users, licensed per user. FireCloud Internet Access routes their traffic through WatchGuard points of presence for firewalling, intrusion prevention, antivirus, sandboxing and web and application filtering. FireCloud Total Access adds zero trust access to private resources on your network without a VPN.
What FireCloud is
FireCloud is WatchGuard's cloud-delivered security service and its SASE offering, combining firewall as a service, a secure web gateway and zero trust network access. Instead of sending home and travelling users back to the office over a VPN, an app on each device, the WatchGuard Connection Manager, sends their traffic to the nearest WatchGuard point of presence, where it is inspected with the same security services that run on a Firebox.
FireCloud is configured in WatchGuard Cloud, with access rules applied to users and groups from your identity provider.
Internet Access and Total Access compared
| Feature | Internet Access | Total Access |
|---|---|---|
| Per-user firewall as a service | Yes | Yes |
| Secure web gateway with WebBlocker category filtering | Yes | Yes |
| Intrusion Prevention Service | Yes | Yes |
| Gateway AntiVirus and APT Blocker sandboxing | Yes | Yes |
| Application Control, geolocation and botnet blocking | Yes | Yes |
| Application-level zero trust access to private resources | No | Yes |
With Total Access, remote users reach internal resources, such as a file share or intranet, without a VPN. The Connection Manager builds a WireGuard tunnel to the nearest point of presence, which connects through a second WireGuard tunnel to a FireCloud Gateway on your network: an existing Firebox or a FireCloud virtual gateway. Access rules, not open network access, decide which users reach which resources. WatchGuard also sells FireCloud as part of a Zero Trust Bundle with Endpoint Security, AuthPoint Total Identity Security and ThreatSync XDR.
How FireCloud is licensed
FireCloud is licensed per user. The licence sets how many users can use the service, and users are allocated in WatchGuard Cloud. Moving from Internet Access to Total Access is a licence change rather than a new deployment, although you will need to set up a gateway for private access. We confirm term and monthly options in your quote. Ask us for a quote for your number of remote users.
Requirements and deployment
- Identity: users sign in through a SAML identity provider, such as Microsoft Entra ID, Okta or AuthPoint, or through WatchGuard Cloud Directory. Zero trust conditions need AuthPoint as the SAML provider or WatchGuard Cloud Directory.
- Client: the Connection Manager is deployed through the WatchGuard Agent on Windows and Mac computers, with an app for mobile devices. It cannot be installed on computers that still run older Panda endpoint products.
- Private access: Total Access needs a FireCloud Gateway. If a Firebox is the gateway and Application Control is on, it must be set to allow WireGuard.
All security services are on by default with a default access rule, so a basic deployment can be running soon after the identity provider is connected, then refined with web filtering categories and application rules.
Who it suits
FireCloud suits organisations with staff who work from home or travel and who want the same web protection off the network as on it, and those looking to retire a remote access VPN. Total Access suits organisations that still have on-premises file servers or line-of-business applications that remote staff need. If you want FireCloud activity watched around the clock, Total MDR and Open MDR can monitor it.
How we help
We connect FireCloud to your identity provider, configure the Firebox or virtual gateway for Total Access, publish private resources, roll out the Connection Manager and tune filtering policies. Compare other approaches in SASE, ZTNA and business VPN.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between FireCloud Internet Access and Total Access?
Internet Access protects remote users' internet and SaaS traffic with firewall, web filtering, intrusion prevention, antivirus and sandboxing. Total Access adds zero trust access to private resources on your network without a VPN.
Do I need a Firebox for FireCloud?
Not for Internet Access. Total Access needs a FireCloud Gateway on your network, which can be a Firebox or a FireCloud virtual gateway.
Is FireCloud licensed per user or per device?
Per user. The licence sets how many users can use FireCloud, and users are allocated in WatchGuard Cloud.
Which identity providers work with FireCloud?
Any SAML identity provider, such as Microsoft Entra ID, Okta or AuthPoint, or WatchGuard Cloud Directory. Zero trust conditions need AuthPoint or WatchGuard Cloud Directory.