It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

This Firmware Version Is End-Of-Support

Documentation for this product is no longer updated. Please see for further information on our EoS policy.


  • Last updated on

If you are licensing a Barracuda NG Control Center, a managed Barracuda NG Firewall, or are using pool licenses, see Licensing on a NG Control Center.

Single licenses for the Barracuda NG Firewall and NG Control Center are bound to the MAC address of the first network interface.

In this article:

Base Licenses

The Barracuda NG Firewall base license gives you a next generation firewall including the following features:

  • Application Control 2.0 reporting
  • SSL Interception (available on all models, except F10 and F100)
  • WAN optimizations (compression, Traffic Intelligence, QoS, Data Caching)
  • Unlimited number of VPN clients (Client-to-Site Barracuda TINA and IPsec VPN)
  • High Availability (both Barracuda NG Firewalls must be licensed).

You can purchase the Barracuda NG Firewall in three different versions:

Base License TypeInstalled OnLicense Bound to
Hardware LicenseBarracuda NG applianceMAC license only
Virtual License
  • VMware Hypervisors
  • Citrix XenServer
  • Xen Server
  • KVM Server
  • Microsoft Hyper-V
  • MAC licenses
  • Pool licenses
Cloud License - Azure
  • Microsoft Azure
  • MAC licenses
  • Pay-As-You-Go Hourly Rate
Cloud License - AWS
  • Amazon AWS
  • MAC licenses
Software License
(legacy phion customers only)
Standard Hardware
  • MAC licenses
  • Pool licenses
Hardware Appliances

A Barracuda NG Firewall hardware appliance is bound to a license on activation. If the appliance must be replaced (RMA), the existing license will be transferred to the replacement unit.

There are no capacity restrictions for hardware appliances. The only restriction is the system performance of the hardware itself. An unlimited number of protected IP addresses, SSL VPN users, and HTTP proxy users (AV+Webfilter) are included. SSL VPN and SSL Interception is included with every Barracuda NG Firewall, except for the F10, F100, and F101 models.

Virtual Systems

Virtual systems are classified by a "capacity" number in the model name, which defines the number of protected Firewall IPs, SSL-VPN users, VPN users, and HTTP Proxy users (AV and Webfilter). This number is enforced for all smaller models of the virtual appliance (Barracuda NG Firewall VF25 - VF500). Barracuda NG Firewall VF1000 to VF8000 do not set a software limit to the number of protected IP addresses; the capacity number still applies as a sizing recommendation. Depending on the model number, they are also limited by the number of CPU cores that can be used. You must assign the correct number of CPU to your Barracuda NG Firewall Vx or VF. If you assign more CPU cores than covered by the license, the license state will be displayed as "expired".

For more information on how protected IP addresses are counted, contact Barracuda Technical Support.

Legacy phion licenses do not distinguish between virtual and hardware licenses and also differ from Barracuda VF licenses. Users behind the HTTP proxy service and Client-to-Site VPN users are not factored into the capacity number. Legacy phion licenses require an additional license for Client-to-Site VPN.

If you cannot adjust the number of CPU cores in your hypervisor, it might be necessary to configure the bootloader to use the number of licensed CPU cores. For more information on how to configure the bootloader, see How to Configure the Bootloader. The following table displays the capacity and the number of CPU cores for each Barracuda NG Firewall virtual appliance model:

ModelCapacityLicensed Number of CPU Cores


There might be limitations to the number of the network interfaces you can connect to you virtual host, depending on the license of your virtualization platform. Please check with your platform vendor.

Public Cloud Systems

Barracuda NG Firewalls that are deployed in the Amazon AWS or Microsoft Azure public clouds are not restricted to a capacity. Performance is only limited by the performance and number of CPU cores of the virtual instance used. To use any service (Firewall, VPN, etc...), you must have an active Energize Update subscription.

Microsoft Azure Instance sizes:

  • Level 2 – Small (1 core, 1.75GB memory)
  • Level 4 – Medium (2 cores, 3.5GB memory)
  • Level 6 – Large (4 cores, 7GB memory)
  • Level 8 – Extra Large (8 cores, 14GB memory)

Amazon AWS Instances sizes

  • Level 2 m1.small (1 vCPU core)
  • Level 4 – c1.medium (2 vCPU cores)
  • Level 6 – m1.xlarge (4 vCPU cores)
  • Level 8 – c1.xlarge (8 vCPU cores)
Cold Standby Licensing

For redundancy, you can purchase a Barracuda NG Firewall appliance without a license and use it as a cold standby replacement. If the production unit fails, call Contacting Barracuda Networks Technical Support to transfer the Barracuda NG Firewall license to the stand-by unit and continue normal operations.

Subscription Licenses

In addition to the base license, you can add the following subscriptions to use your Barracuda NG Firewall to its full extent:

Barracuda Energize Updates

This license is mandatory for the first year, for every Barracuda NG Firewall purchased. The following features are included with Barracuda Energize Updates:

  • 24x5 technical support.
  • Application Control 2.0 traffic control
  • Firmware updates including Application Control 2.0 definition updates
  • IPS/IDS engine and signature updates
  • Barracuda Web Filter
Barracuda NG Malware Protection

Enables the antivirus service.This license is available for all Barracuda NG Firewall models except F10.

Advanced Threat Protection

Enables ATP. An NG malware protection subscription license is required. The number of files you can upload per hour and per month are limited, depending on your Barracuda NG Firewall model. The number of files scanned are counted in the Barracuda ATP Cloud. If the local counter on your Barracuda NG Firewall is reset, i.e., by reinstalling the OS, the local counter will be out-of-sync for the rest of the month. Limits still apply.

Barracuda NG Firewall ModelBurst Limit (files/min)Files per Month
F200, F201, F300, F3015108 000
F28010216 000
F38012260 000
F40015324 000
F60025540 000
F80035750 000
F900501 000 000
AWS/Azure Level 25108 000
AWS/Azure Level 410216 000
AWS/Azure Level 615324 000
AWS/Azure Level 835750 000
VF25243 200
VF505108 000
VF10010216 000
VF25015324 000
VF50020432 000
VF100025540 000
VF200030648 000
VF400035750 000
VF8000501 000 000
Barracuda NG SSL VPN and NAC

Enables the SSL VPN and NAC service.

Barracuda NG Web Filter

Enables the Barracuda NG Web Filter service, which can use both online and offline databases.

Barracuda NG Web Security

Enables the Barracuda NG Web Filter service, and can use both online and offline databases and the antivirus service.

Instant Replacement Service

Instant replacement service includes the following features:

  • Replacement unit shipped next business day.
  • 24x7 technical support.
  • Hardware refresh every four years.
Barracuda Web Security Service

Barracuda NG Control Center Licensing

Barracuda NG Control Center licenses scale by the number of Barracuda NG Firewalls that can be managed by the Control Center. The High Availability license is included with the VC820 Global Edition model and can be purchased as an add-on for all other models.

ModelSystem TypeNumber of Managed GatewaysTenants (Ranges)Configuration Groupings (Clusters)HA LicenseAdditional Tenants
C400HardwareRecommendation: 2011Optionaln/a
VC400VirtualRecommendation: 2011Optionaln/a
C610HardwareRecommendation: 2001No limitOptionaln/a
VC610VirtualRecommendation: 2001No limitOptionaln/a
VC820VirtualRecommendation 1000+
only limited by hardware
5 (additional tenants optionally available)No limitIncludedOptional

Next Steps

Last updated on