It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

Base Licensing and Subscriptions

  • Last updated on

Licenses and subscription updates for the CloudGen Firewall are provided by the Barracuda Networks Online database. Single licenses for the CloudGen Firewall are bound to the MAC address of the first network interface.

The Energize Updates subscription is mandatory and gets installed automatically.

Barracuda Networks offers the following licenses and subscriptions:

CloudGen Firewall Base License

The CloudGen Firewall base license gives you a next-generation firewall with the following features:

  • Application Control reporting

  • SSL Inspection (available on all models, except F10 and F100)

  • SD-WAN

  • Unlimited number of VPN clients (client-to-site, TINA, and IPsec VPN)

The following license types are available for your Barracuda CloudGen Firewall:

Base license type

Installed on

License bound to

Hardware License

CloudGen Firewall F-Series hardware appliance

  • MAC licenses (+Serial Number)

  • Pool licenses

Virtual Firewall Cloud License (VFC)

Public Cloud (BYOL):

  • Microsoft Azure

  • Amazon AWS

  • Google Compute Cloud

Virtual Platforms:

  • VMware ESXi

  • Citrix XenServer

  • Xen

  • KVM

  • Microsoft Hyper-V

  • VMware vCloudAir

Standard Hardware (without guarantee)

  • MAC licenses

  • Pool licenses

Individual Virtual, Cloud and Software Licenses

Virtual License (VF)

  • VMware ESXi

  • Citrix XenServer

  • Xen

  • KVM

  • Microsoft Hyper-V

  • VMware vCloudAir

  • MAC licenses

  • Pool licenses

Cloud License – Azure (CAZ)

  • Microsoft Azure

  • MAC licenses (BYOL)

  • Pay-As-You-Go (PAYG) Hourly Rate

Cloud License – AWS (CAW)

  • Amazon AWS

  • MAC licenses (BYOL)

  • Pay-As-You-Go Hourly Rate

Cloud License - Google Cloud (CLD)

  • Google Compute Cloud

  • MAC licenses (BYOL)

Software License (SF/TSF)

  • Standard Hardware

  • MAC licenses

  • Pool licenses

Cold Spare Licensing

For redundancy, you can purchase a CloudGen Firewall without a license and use it as a cold spare replacement. If the production unit fails, call Barracuda Networks Technical Support to transfer the license to the spare unit and continue normal operations.

In addition to the base license, you can add the following subscriptions to use your firewall to its fullest extent:

Barracuda Energize Updates

This subscription is mandatory for every firewall for the first year. The following features are included with Barracuda Energize Updates:

  • 24x7 technical support.

  • Application Control

  • Firmware updates

  • Application Control definition updates

  • IPS/IDS engine and signature updates

  • Barracuda Web Security Gateway

  • SSL VPN template updates

  • File Content definition updates

Basic Support

Includes email support 24x7 and phone support between the hours of 9 a.m. and 5 p.m. Monday through Friday in the US (Pacific Time), Japan, China, Austria, and the United Kingdom time zones.

Firmware Maintenance

Includes new firmware updates with feature enhancements, bug fixes, and pattern updates for:

  • Application Control

  • IPS/IDS engine

  • SSL VPN template updates

  • File Content definition updates

SD-WAN

SD-WAN provides multi-path VPN tunnels across all providers, thereby offering redundant, reliable, and failsafe network connections. When the VPN tunnel is up, it can transmit traffic as long as at least one ISP link is operational. Admins can retain full control over how each link is used, or they can configure the advanced balancing and bandwidth management features to optimally use the available bandwidth. SD-WAN combines a multi-transport VPN tunnel with the following advanced VPN routing, balancing, and shaping features:

  • Dynamic Bandwidth and Round Trip Time (RTT) Detection

  • Performance-Based Transport Selection

  • Adaptive Bandwidth Protection

  • Adaptive and Static Session Balancing

  • Failover Support

  • Multi-Provider Load Balancing

VPN Forward Error Correction (FEC)

Forward Error Correction is a method of correcting data transmission errors that occur over noisy communication lines, thereby improving data reliability without requiring retransmission.

Malware Protection

Enables the local/on box AVIRA Virus Scanner service. This license is available for all CloudGen Firewalls except F10, VF10, TSF10, and F12.

Advanced Threat Protection

Enables ATP. Advanced Threat Protection (ATP) offers protection against advanced malware, zero-day exploits, and other targeted attacks beyond virus pattern detection. The number of files you can upload per hour and per month are limited, depending on your firewall model. The number of files scanned are counted in the Barracuda ATP Cloud. If the local counter on your Firewall is reset, i.e., by reinstalling the OS, the local counter will be out-of-sync for the rest of the month. Limits still apply. For more information, see the License Metrics section below.

DNS sinkholing can be used for securing clients on a LAN against access to malicious sites. DNS sinkholing requires ATP. 

Environment and number of files inspected per month

Hardware

# of files

Virtual and Public Cloud

# of files

F18

108000

VFC1

108000

F80

108000

VFC2

216000

F180

108000

VFC4

324000

F280

216000

VFC8

648000

F380

260000

VFC16

750000

F400

324000

VFC48

1000000

F600

540000

-

-

F800

750000

-

-

F900

1000000

-

-

F1000

on request

-

-

Advanced Remote Access

Enables the SSL VPN service, MFA using One-time Passwords (OTP), SAML Azure AD authentication, and NAC support. Remote Access subscriptions are available for the CloudGen Firewall F18 or higher and all CloudGen Firewall Vx and public cloud models. For PAYG CloudGen Firewalls in AWS and Azure, this subscription is automatically included.

Included SSL VPN Features
  • Browser-based access via desktop and mobile portals

  • SSL VPN-based, server-side NAC

  • VPN templates for SSL VPN

Authentication
  • Multi-factor authentication using Time-based One-time Passwords (TOTP)

  • AD FS/SAML authentication for Client-to-Site VPN

Included Network Access Client Features
  • Windows Personal Firewall

  • Windows Health Check via Access Control Service

  • AD FS/SAML authentication for Barracuda CloudGen WAN and Barracuda CloudGen Firewall 8.2.0 or higher. 

CudaLaunch
  • iOS, Android, Windows, and macOS support  

  • Central management of accessible resources and VPN provisioning

User Session Limits
  • Unlimited concurrent SSL VPN user sessions

  • Unlimited concurrent CudaLaunch sessions

  • Multiple concurrent client-to-site VPN sessions by the same user when using VPN Group Policies

Barracuda Firewall Insights

The Barracuda Firewall Insights subscription enables a CloudGen Firewall to stream data for statistical analytics to the Barracuda Firewall Insights Server.

Instant Replacement Service

Instant Replacement service includes the following features:

  • Replacement unit shipped next business day

  • 24x7 technical support

  • Hardware refresh every four years

Which subscriptions/features are available on which platform?

Feature sets and available subscriptions may differ from product type or platform. The following table provides an overview of which feature/subscription is available for which product.

Feature / Subscription


Hardware

Virtual, Software, Public Cloud BYOL
(CGF-VFC)

Public Cloud PAYG

Barracuda Energize Updates (EU)
Mandatory for the first year. Includes Barracuda Web Filter.
Required Active Licenses: base

Available / Unlimited users

Available / Limited by capacity

Incl. in Service Subscription 1)
Limited by capacity

Malware Protection (M)
Enables the AVIRA antivirus service.
Required Active Licenses: EU

Available / Unlimited users

Available / Limited by capacity

Not available 3)

Advanced Threat Protection (ATP)
Enables Advanced Threat Protection to the Barracuda Cloud.
Required Active Licenses: EU

Available / Unlimited users / Limited file upload

Available / Unlimited users / Limited file upload

Not available 3)

Advanced Remote Access (ARA)

Includes SSL VPN and enables the CudaLaunch app and multiple logins of one user.

Enables AD FS/SAML authentication for Client-to-Site VPN and multi-factor authentication using Time-based One-time Passwords (firmware 8.x and higher).
Required Active Licenses: EU

Available / Unlimited users

Available / Limited by capacity

Incl. in Service Subscription 2)
Limited by capacity

Barracuda Firewall Insights (FWI)

Activates Firewall Insights reporting service

Available

Available

Available

NAC & SSLVPN (formerly known as Basic Remote Access) is included in the Advanced Remote Access subscription (ARA).

  • 1) All cloud licenses include NAC & SSLVPN (former Basic Remote Access subscription).

  • 2) PAYG licenses include Advanced Remote Access.

  • 3) PAYG licenses cannot be enhanced with add-on subscriptions (Malware, ATP).

Subscription Start and Lifetime

Add-on subscriptions are termed licenses and are valid from the time purchased until the expiration date is reached. When entering the license token, Barracuda Firewall Admin automatically downloads the purchased license file from Barracuda Networks and installs the subscriptions on the Barracuda Firewall Control Center. As soon as a firewall gets registered via token or connects as a physical unit, the firewall queries the license files from the Barracuda Networks server. All add-on subscriptions need at least an active Base- and Energize Updates subscription to work properly.

Start date and lifetime (subscription period) of a license are defined when you order the license. If you register a unit after the expiration date, the license will show up as expired.

Only active subscriptions guarantee the functionality of the subscribed add-on features. Before exceeding the expiration date, licenses must be renewed in order to guarantee the functionality of the purchased add-on features. For more information, see License Validity in the Product Information documentation.

License Metrics

Barracuda CloudGen Firewall licenses contain keys and metrics for enabling specific features:

Base License
  • Hardware Model

    • Model

  • Virtual or Cloud Model

    • Model

    • Number of cores (VF, TSF, public Cloud)

Barracuda Energize Updates License

Enables IPS and various updates.

  • Hardware Model

    • Model

  • Virtual or Cloud Model

    • Model

    • Number of cores (VFC)

Advanced Threat Protection
  • Model

  • Burst limit (Files per minute)

  • Files per month

Model

Burst limit  

(files per minute)

Files per month

F18, F80, F93, F180, F193

5

108 000

F280

10

216 000

F380

12

260 000

F400

15

324 000

F600

25

540 000

F800

35

750 000

F900

50

1 000 000

F1000

50

1 000 000

AWS/Azure Level 2

5

108 000

AWS/Azure Level 4

10

216 000

AWS/Azure Level 6

15

324 000

AWS/Azure Level 8

35

750 000

VF25

2

43 200

VF50

5

108 000

VF100

10

216 000

VF250

15

324 000

VF500

20

432 000

VF1000

25

540 000

VF2000

30

648 000

VF4000

35

750 000

VF8000

50

1 000 000

VFC1

5

108 000

VFC2

10

216 000

VFC4

15

324 000

VFC8

30

648 000

VFC16

35

750 000

VFC48

50

1 000 000

Advanced Remote Access
  • Model

  • Remote Access Basic

  • Remote Access Premium

  • NAC&SSLVPN

All hardware and VFC models have a maximum metric of 9999. For VF/TSF models, the model number indicates the maximum number of SSL VPN- and NAC connections.

Model

Remote Access Basic


Remote Access Premium

NAC & SSLVPN

F18, F80, F82, F93, F180, F183, F193, F280, F380, F400, F600, F800, F900, F1000

9999

9999

9999

VFC

9999

9999

9999

VF25, TSF25

25

25

25

VF50, TSF50

50

50

50

VF100, TSF100

100

100

100

VF250, TSF250

250

250

250

VF500, TSF500

500

500

500

VF1000, TSF1000

1000

1000

1000

VF2000, TSF2000

2000

2000

2000

VF4000, TSF4000

4000

4000

4000

VF8000, TSF8000

8000

8000

8000

Malware Protection
  • Model

Barracuda Firewall Insights
  • Model