In short: WatchGuard Firebox Cloud is the Firebox firewall built for AWS and Microsoft Azure, and FireboxV is the same software for VMware ESXi, Microsoft Hyper-V and KVM. Both run Fireware and are sized by virtual CPUs. With your own licence you choose Standard Support, Basic Security or Total Security and can manage them alongside hardware Fireboxes in WatchGuard Cloud.
Firebox Cloud and FireboxV in brief
WatchGuard's virtual firewalls run Fireware, the same operating system as a hardware Firebox, so policies, VPN settings and security services behave the same way wherever the firewall runs.
| Firebox Cloud | FireboxV | |
|---|---|---|
| Where it runs | Amazon Web Services and Microsoft Azure, deployed from each marketplace | Your own hypervisors: VMware ESXi, Microsoft Hyper-V and Linux KVM |
| Typical use | Protecting servers and applications in the public cloud, and VPNs from the cloud to your offices | Protecting a server room or private cloud, segmenting virtual networks, VPN termination in a data centre |
| Sizes | Small, Medium, Large and Extra Large | Micro, Small, Medium, Large and Extra Large |
| Licensing options | Bring your own licence, or hourly pay as you go through the cloud bill | A licence per virtual machine, activated with a feature key |
| Management | WatchGuard Cloud (bring your own licence only), or local Fireware tools | WatchGuard Cloud or local Fireware tools |
For users and branch offices rather than servers, WatchGuard's cloud-delivered option is WatchGuard FireCloud, its firewall as a service and SSE product.
Security suites
A FireboxV licence, or a Firebox Cloud licence you bring yourself, combines a size with one of three subscription levels. (Hourly pay-as-you-go Firebox Cloud instances include the security services in the hourly charge instead.)
| Subscription | What it includes |
|---|---|
| Standard Support | Stateful firewall, VPN, SD-WAN, standard 24x7 technical support and software updates |
| Basic Security Suite | Adds intrusion prevention, gateway antivirus, application control, WebBlocker web filtering, spamBlocker, geolocation blocking, botnet detection, Tor exit node blocking and network discovery |
| Total Security Suite | Adds APT Blocker sandboxing, DNSWatch, IntelligentAV, ThreatSync XDR, EDR Core and Gold 24x7 support |
For servers that publish services to the internet, the Basic Security Suite is the minimum we would normally suggest, because intrusion prevention is what blocks exploit attempts. The Total Security Suite adds sandboxing and correlation with other WatchGuard products, which suits organisations using WatchGuard endpoint or MDR services.
Sizing, explained generically
Firebox Cloud and FireboxV are licensed by size rather than by user. For Firebox Cloud, the size sets the maximum number of virtual CPUs the firewall will use:
| Firebox Cloud size | Virtual CPUs used |
|---|---|
| Small | Up to 2 |
| Medium | Up to 4 |
| Large | Up to 8 |
| Extra Large | No limit |
FireboxV comes in the same sizes plus a Micro size for the smallest deployments. If the virtual machine has more CPUs than the licence allows, the extra cores sit idle, so match the cloud instance type to the licence to avoid paying the provider for capacity you cannot use.
Size from your expected throughput with security services switched on, not just your internet bandwidth. Memory matters too: WatchGuard states that IntelligentAV needs a virtual machine with at least 4 GB of memory.
Bring your own licence or pay as you go
Firebox Cloud can be licensed two ways:
- Bring your own licence (BYOL): you buy the WatchGuard licence separately, activate it with a feature key tied to the instance, and the cloud provider bills only the virtual machine and its resources. Only BYOL supports WatchGuard Cloud management, DNSWatch, ThreatSync and the REST API.
- Hourly pay as you go: the WatchGuard licence and security services are included in the hourly charge on your AWS or Azure bill, with nothing separate to activate or renew. It is quick to start, and WatchGuard offers a trial period without the hourly software charge, but it does not support WatchGuard Cloud or DNSWatch.
Switching between the two means deploying a new instance and moving the configuration, so decide up front. With either model, the cloud provider's compute, storage and data transfer charges are separate from the WatchGuard licence.
Where it fits, and the alternatives
Firebox Cloud and FireboxV suit organisations that already use Fireboxes at their offices and want one approach to firewall policy and VPNs across sites, data centre and cloud, managed by the same people in WatchGuard Cloud.
Alternatives worth comparing:
- Provider-native firewalls (such as Azure Firewall) are run by the cloud provider and scale with demand, but are managed per cloud, separately from your office firewalls.
- Check Point CloudGuard Network Security suits organisations standardised on Check Point, with auto-scaling deployment patterns and support for Google Cloud and Azure Virtual WAN.
- Security groups alone are not a firewall: they filter by address and port but do not inspect traffic.
See the cloud firewall guide for the full comparison. Firewalls control network paths; for misconfigured storage or excessive permissions, you also need cloud security posture management.
How we help
We size the instance, deploy it from the marketplace or onto your hypervisor, route your subnets through it, build VPNs to your offices and migrate rules from your current firewall where possible. We supply the WatchGuard licence for bring-your-own-licence and FireboxV deployments and handle renewals. Ask us for a quote for the size and suite you need, or contact us to discuss your cloud network.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is WatchGuard Firebox Cloud?
Firebox Cloud is WatchGuard's firewall for Amazon Web Services and Microsoft Azure. It runs the same Fireware software as hardware Fireboxes and protects cloud servers, connects cloud networks to offices by VPN and is managed in WatchGuard Cloud.
What is the difference between Firebox Cloud and FireboxV?
They run the same software. Firebox Cloud is built for AWS and Azure and deployed from their marketplaces. FireboxV runs on hypervisors you manage yourself: VMware ESXi, Microsoft Hyper-V and KVM.
Can Firebox Cloud be managed from WatchGuard Cloud?
Yes, when licensed as bring your own licence. WatchGuard states that the hourly pay-as-you-go option does not support WatchGuard Cloud management or DNSWatch. FireboxV can also be managed in WatchGuard Cloud.
Which security suite do I need for Firebox Cloud?
Standard Support gives the firewall and VPN. The Basic Security Suite adds intrusion prevention, gateway antivirus and filtering, which we suggest as a minimum for internet-facing servers. The Total Security Suite adds sandboxing, DNSWatch, IntelligentAV, ThreatSync XDR and Gold support. Pay-as-you-go instances include the security services in the hourly charge.
Is FireCloud the same as Firebox Cloud?
No. FireCloud is WatchGuard's cloud-delivered firewall as a service and secure web gateway for users and sites. Firebox Cloud is a virtual firewall you deploy inside your own AWS or Azure network.