Single licenses for the Barracuda NG Firewall and NG Control Center are bound to the MAC address of the first network interface.
In this article:
The Barracuda NG Firewall base license gives you a next generation firewall including the following features:
- Application Control 2.0 reporting
- SSL Interception (available on all models, except F10 and F100)
- WAN optimizations (compression, Traffic Intelligence, QoS, Data Caching)
- Unlimited number of VPN clients (Client-to-Site Barracuda TINA and IPsec VPN)
- High Availability (both Barracuda NG Firewalls must be licensed).
You can purchase the Barracuda NG Firewall in three different versions:
|Base License Type||Installed On||License Bound to|
|Hardware License||Barracuda NG appliance||MAC license only|
|Virtual License |
|Cloud License - Azure |
|Cloud License - AWS|
|Software License |
(legacy phion customers only)
A Barracuda NG Firewall hardware appliance is bound to a license on activation. If the appliance must be replaced (RMA), the existing license will be transferred to the replacement unit.
There are no capacity restrictions for hardware appliances. The only restriction is the system performance of the hardware itself. An unlimited number of protected IP addresses, SSL VPN users, and HTTP proxy users (AV+Webfilter) are included. SSL VPN and SSL Interception is included with every Barracuda NG Firewall, except for the F10, F100, and F101 models.
Virtual systems are classified by a "capacity" number in the model name, which defines the number of protected Firewall IPs, SSL-VPN users, VPN users, and HTTP Proxy users (AV and Webfilter). This number is enforced for all smaller models of the virtual appliance (Barracuda NG Firewall VF25 - VF500). Barracuda NG Firewall VF1000 to VF8000 do not set a software limit to the number of protected IP addresses; the capacity number still applies as a sizing recommendation. Depending on the model number, they are also limited by the number of CPU cores that can be used. You must assign the correct number of CPU to your Barracuda NG Firewall Vx or VF. If you assign more CPU cores than covered by the license, the license state will be displayed as "expired".
For more information on how protected IP addresses are counted, contact Barracuda Technical Support.
Legacy phion licenses do not distinguish between virtual and hardware licenses and also differ from Barracuda VF licenses. Users behind the HTTP proxy service and Client-to-Site VPN users are not factored into the capacity number. Legacy phion licenses require an additional license for Client-to-Site VPN.
If you cannot adjust the number of CPU cores in your hypervisor, it might be necessary to configure the bootloader to use the number of licensed CPU cores. For more information on how to configure the bootloader, see How to Configure the Bootloader. The following table displays the capacity and the number of CPU cores for each Barracuda NG Firewall virtual appliance model:
|Model||Capacity||Licensed Number of CPU Cores|
Public Cloud Systems
Barracuda NG Firewalls that are deployed in the Amazon AWS or Microsoft Azure public clouds are not restricted to a capacity. Performance is only limited by the performance and number of CPU cores of the virtual instance used. To use any service (Firewall, VPN, etc...), you must have an active Energize Update subscription.
Microsoft Azure Instance sizes:
- Level 2 – Small (1 core, 1.75GB memory)
- Level 4 – Medium (2 cores, 3.5GB memory)
- Level 6 – Large (4 cores, 7GB memory)
- Level 8 – Extra Large (8 cores, 14GB memory)
Amazon AWS Instances sizes
- Level 2 – m1.small (1 vCPU core)
- Level 4 – c1.medium (2 vCPU cores)
- Level 6 – m1.xlarge (4 vCPU cores)
- Level 8 – c1.xlarge (8 vCPU cores)
Cold Standby Licensing
For redundancy, you can purchase a Barracuda NG Firewall appliance without a license and use it as a cold standby replacement. If the production unit fails, call Contacting Barracuda Networks Technical Support to transfer the Barracuda NG Firewall license to the stand-by unit and continue normal operations.
In addition to the base license, you can add the following subscriptions to use your Barracuda NG Firewall to its full extent:
Barracuda Energize Updates
This license is mandatory for the first year, for every Barracuda NG Firewall purchased. The following features are included with Barracuda Energize Updates:
- 24x5 technical support.
- Application Control 2.0 traffic control
- Firmware updates including Application Control 2.0 definition updates
- IPS/IDS engine and signature updates
- Barracuda Web Filter
Barracuda NG Malware Protection
Enables the antivirus service.This license is available for all Barracuda NG Firewall models except F10.
Advanced Threat Protection
Enables ATP. An NG malware protection subscription license is required. The number of files you can upload per hour and per month are limited, depending on your Barracuda NG Firewall model. The number of files scanned are counted in the Barracuda ATP Cloud. If the local counter on your Barracuda NG Firewall is reset, i.e., by reinstalling the OS, the local counter will be out-of-sync for the rest of the month. Limits still apply.
|Barracuda NG Firewall Model||Burst Limit (files/min)||Files per Month|
|F200, F201, F300, F301||5||108 000|
|F900||50||1 000 000|
|AWS/Azure Level 2||5||108 000|
|AWS/Azure Level 4||10||216 000|
|AWS/Azure Level 6||15||324 000|
|AWS/Azure Level 8||35||750 000|
|VF8000||50||1 000 000|
Barracuda NG SSL VPN and NAC
Enables the SSL VPN and NAC service.
Barracuda NG Web Filter
Enables the Barracuda NG Web Filter service, which can use both online and offline databases.
Barracuda NG Web Security
Enables the Barracuda NG Web Filter service, and can use both online and offline databases and the antivirus service.
Instant Replacement Service
Instant replacement service includes the following features:
- Replacement unit shipped next business day.
- 24x7 technical support.
- Hardware refresh every four years.
Barracuda Web Security Service
Barracuda NG Control Center Licensing
Barracuda NG Control Center licenses scale by the number of Barracuda NG Firewalls that can be managed by the Control Center. The High Availability license is included with the VC820 Global Edition model and can be purchased as an add-on for all other models.
|Model||System Type||Number of Managed Gateways||Tenants (Ranges)||Configuration Groupings (Clusters)||HA License||Additional Tenants|
|C610||Hardware||Recommendation: 200||1||No limit||Optional||n/a|
|VC610||Virtual||Recommendation: 200||1||No limit||Optional||n/a|
|VC820||Virtual||Recommendation 1000+ |
only limited by hardware
|5 (additional tenants optionally available)||No limit||Included||Optional|