In short: WatchGuard FireCloud is WatchGuard's cloud-delivered security service for hybrid workers. FireCloud Internet Access is a firewall-as-a-service and secure web gateway that inspects traffic at WatchGuard points of presence. FireCloud Total Access adds zero trust network access to private resources, using an existing Firebox, a virtual gateway or a server gateway, all managed in WatchGuard Cloud.
What WatchGuard FireCloud is
A Firebox protects people while they sit behind it. Once they work from home or a coffee shop, their traffic goes straight to the internet and the office VPN is often only used to reach a file server. FireCloud closes that gap by moving firewall and web security into the cloud.
Users run the WatchGuard Connection Manager (installed with the WatchGuard Agent) on Windows or macOS. Their traffic goes through FireCloud, where WatchGuard applies content scanning (Gateway AntiVirus and APT Blocker), network blocking (Botnet Detection and Intrusion Prevention), geolocation controls, content filtering (WebBlocker and Application Control) and access rules. WatchGuard describes FireCloud as a cloud-delivered SASE solution. Users authenticate through an identity provider: WatchGuard AuthPoint, Microsoft Entra ID, Okta or another SAML provider, or the WatchGuard Cloud Directory. Zero trust conditions in access policy need either AuthPoint or the WatchGuard Cloud Directory.
FireCloud Internet Access vs FireCloud Total Access
| Capability | FireCloud Internet Access | FireCloud Total Access |
|---|---|---|
| Cloud firewall (FWaaS) with user-based rules | Yes | Yes |
| Secure web gateway: malware, phishing and malicious site blocking | Yes | Yes |
| Content filtering, geolocation and network blocking | Yes | Yes |
| Zero trust network access to private applications | No | Yes |
| Private applications hidden from the internet | No | Yes |
| VPN replacement | No | Yes |
| Monitoring of FireCloud activity | Not listed | Yes |
| Management | WatchGuard Cloud | WatchGuard Cloud |
WatchGuard also offers a Zero Trust Bundle that combines FireCloud Total Access with WatchGuard endpoint security (to check device health) and AuthPoint MFA with risk-based access policies and dark web credential monitoring, all managed in WatchGuard Cloud. WatchGuard MDR can be added for 24/7 monitoring. It suits organisations that want WatchGuard to be their main security platform.
How Total Access reaches private resources
Total Access needs a gateway inside your network that FireCloud can broker connections through. WatchGuard offers three types:
- Firebox Gateway: an eligible existing Firebox acts as the gateway, with FireCloud running as a built-in service, so there is nothing new to install
- Virtual Gateway: a virtual machine you deploy on Hyper-V (generation one virtual machines), VMware ESXi or Proxmox
- Server Gateway: installed on a Windows server and only able to reach resources on that server
You then define each private resource (name, FQDN, IP address, protocol and port), add it to access rules for the right groups and, where an application needs it, add a Kerberos authentication resource to the same rule. Users see only the applications they are allowed to reach, rather than a whole network as with a traditional VPN. This is the app-by-app model described in our ZTNA guide.
Who FireCloud suits
FireCloud is a natural choice if:
- You already run WatchGuard Firebox firewalls managed in WatchGuard Cloud, because the Firebox can become the Total Access gateway and the same console covers both
- You use WatchGuard AuthPoint for MFA or WatchGuard endpoint security and want one vendor and one console
- You want to retire the remote access VPN on the Firebox without changing how office traffic is protected
- Your IT partner manages many customers or sites, since service providers can allocate FireCloud licences to managed accounts and deploy configuration templates from WatchGuard Cloud
A typical rollout for an existing WatchGuard customer looks like this:
- Activate the FireCloud licence (or a trial) and connect FireCloud to your identity provider
- Review the default content scanning, network blocking, geolocation and content filtering settings and the access rules for each group
- Deploy the WatchGuard Agent and Connection Manager to a pilot group through your device management tool
- For Total Access, add the Firebox (or a virtual gateway) as the gateway and publish the first private applications
- Move remaining users and applications across, then retire the Firebox remote access VPN
If you have no WatchGuard estate, compare it with NordLayer, Todyl or Microsoft Entra Private Access before deciding.
FireCloud and Firebox Cloud: which do you need?
The names are similar but the products solve different problems:
- FireCloud protects people: remote and hybrid users and their access to applications.
- WatchGuard Firebox Cloud and FireboxV protect networks: virtual firewalls that run in public cloud platforms such as Microsoft Azure or on hypervisors such as VMware and Hyper-V, in front of servers and workloads.
Many organisations use both, with the Firebox estate (physical, virtual or cloud) handling sites and workloads and FireCloud covering users. Read more in our cloud firewall guide.
FireCloud is also different from DNS-only protection. WatchGuard's DNSWatch filters at the DNS layer, while FireCloud routes traffic through a cloud firewall and web gateway, so it can apply user-based firewall rules and inspect more than domain names. Our DNS filtering guide explains where each approach fits.
Licensing and how we help
FireCloud is licensed per user, as a term licence for a set number of users or, through service providers, as a monthly subscription. Licence keys are activated through WatchGuard, and service providers allocate users to their managed accounts in WatchGuard Cloud. A one-time 30-day trial is available. Downgrading from Total Access to Internet Access permanently removes gateway and private resource configuration, so choose the edition with your VPN plans in mind. Pricing depends on the edition and user count, so ask us for a quote. Licensing detail is on Software Licensing UK.
We plan the rollout with you: identity provider integration, default policy review, Connection Manager deployment through your device management tool, gateway choice for Total Access, and a staged move of applications off the VPN. If you would also like round-the-clock monitoring of endpoints and identities, WatchGuard's MDR services are covered in our managed detection and response guide. Contact us to get started.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between FireCloud Internet Access and FireCloud Total Access?
FireCloud Internet Access protects remote users' internet traffic with a cloud firewall and secure web gateway. FireCloud Total Access includes all of that and adds zero trust access to private applications, so it can replace a remote access VPN.
Do I need a Firebox to use WatchGuard FireCloud?
No. FireCloud runs in WatchGuard's cloud. For Total Access you need a gateway to reach private resources, which can be an existing Firebox, a virtual gateway on Hyper-V, VMware ESXi or Proxmox, or a server gateway on a Windows server.
Which identity providers work with FireCloud?
FireCloud supports WatchGuard AuthPoint, the WatchGuard Cloud Directory and SAML identity providers such as Microsoft Entra ID and Okta. Zero trust conditions in access policy need AuthPoint or the WatchGuard Cloud Directory.
Is WatchGuard FireCloud SASE?
WatchGuard describes FireCloud as a cloud-delivered SASE solution. Internet Access provides FWaaS and a secure web gateway, and Total Access adds ZTNA to private applications, all managed in WatchGuard Cloud.
How is FireCloud licensed?
FireCloud is licensed per user, either as a term licence or as a monthly subscription through a service provider, and a 30-day trial is available. Ask us for a quote for the edition and number of users you need.