It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

This Firmware Version Is End-Of-Support

Documentation for this product is no longer updated. Please see for further information on our EoS policy.


  • Last updated on

If you are licensing a NextGen Control Center, a managed F-Series Firewall, or are using pool licenses, see Licensing on a NG Control Center.

Single licenses for the NextGen Firewall F-Series and Control Center are bound to the MAC address of the first network interface.

In this article:

Barracuda NextGen Firewall F-Series Base Licenses

The F-Series Firewall base license gives you a next-generation firewall with the following features:

  • Application Control reporting
  • SSL Interception (available on all models, except F10 and F100)
  • WAN optimizations (compression, Traffic Intelligence, QoS, Data Caching)
  • Unlimited number of VPN clients (Client-to-Site Barracuda TINA and IPsec VPN)

You can purchase the F-Series Firewall in three different versions:

Base License TypeInstalled OnLicense Bound to
Hardware LicenseNextGen Firewall F-Series hardware appliance
  • MAC licenses
  • Pool licenses
Virtual License
  • VMware Hypervisors
  • Citrix XenServer
  • Xen Server
  • KVM Server
  • Microsoft Hyper-V
  • vCloudAir
  • MAC licenses
  • Pool licenses
Cloud License - Azure
  • Microsoft Azure
  • MAC licenses (BYOL)
  • Pay-As-You-Go Hourly Rate
Cloud License - AWS
  • Amazon AWS
  • MAC licenses (BYOL)
  • Pay-As-You-Go Hourly Rate
Software License
(legacy phion customers only)
Standard Hardware
  • MAC licenses
  • Pool licenses
Hardware Appliances

A NextGen F-Series Firewall or Control Center hardware appliance is bound to a license on activation. If the appliance must be replaced (RMA), the existing license will be transferred to the replacement unit.

There are no capacity restrictions for hardware appliances. The only restriction is the system performance of the hardware itself. An unlimited number of protected IP addresses, SSL VPN users, and HTTP proxy users (AV+Webfilter) are included. SSL VPN and SSL Interception is included with every F-Series Firewall, except for the F10, VF10, F100, and F101 models.

Virtual Systems

Virtual systems are classified by a "capacity" number in the model name, which defines the number of protected Firewall IPs, SSL-VPN users, VPN users, and HTTP Proxy users (Virus scanning and NG Web Filter). This number is enforced for all smaller models of the virtual appliance (NextGen Firewall VF10 - VF500). NextGen Firewall VF1000 to VF8000 do not set a software limit to the number of protected IP addresses; the capacity number still applies as a sizing recommendation. Depending on the model number, they are also limited by the number of CPU cores that can be used. You must assign the correct number of CPU to your NextGen Firewall or Control Center Vx. If you assign more CPU cores than covered by the license, the license state will be displayed as expired.

Legacy phion licenses do not distinguish between virtual and hardware licenses and also differ from Barracuda VF licenses. Users behind the HTTP proxy service and Client-to-Site VPN users are not factored into the capacity number. Legacy phion licenses require an additional license for Client-to-Site VPN.

If you cannot adjust the number of CPU cores in your hypervisor, it might be necessary to configure the bootloader to use the number of licensed CPU cores. For more information on how to configure the bootloader, see How to Configure the Bootloader. The following table displays the capacity and the number of CPU cores for each NextGen Firewall Vx:

ModelCapacityLicensed Number of CPU Cores


There might be limitations to the number of the network interfaces you can connect to you virtual host, depending on the license of your virtualization platform. Please check with your platform vendor.

Public Cloud Systems

F-Series Firewalls deployed in the Amazon AWS or Microsoft Azure public clouds are not restricted to a capacity. Performance is only limited by the performance and number of CPU cores of the virtual instance used. To use any service (Firewall, VPN, etc...), you must have an active Energize Updates subscription.

Microsoft Azure and Amazon AWS Pay-As-You-Go Licenses

You can choose to pay an hourly rate for the public cloud F-Series Firewall. The pay-as-you-go license is generated and bound to the VM or Instance on the first boot. The Pay-As-You-Go license includes the following services:

  • Forwarding Firewall
  • VPN Service
  • All services included in the Basic Remote Access Subscription
  • All services included in the Premium Remote Access Subscription
  • SSH Proxy
  • DNS
  • DHCP
  • DHCP Relay
  • FTP Gateway
  • Dynamic Routing
  • (If managed by a Control Center) Distributed Firewall

Microsoft Azure Instance sizes:

  • Level 2 – Small (1 core, 1.75GB memory)
  • Level 4 – Medium (2 cores, 3.5GB memory)
  • Level 6 – Large (4 cores, 7GB memory)
  • Level 8 – Extra Large (8 cores, 14GB memory)

Amazon AWS Instances sizes

  • Level 2 m1.small (1 vCPU core)
  • Level 4 – c1.medium (2 vCPU cores)
  • Level 6 – m1.xlarge (4 vCPU cores)
  • Level 8 – c1.xlarge (8 vCPU cores)
Cold Standby Licensing

For redundancy, you can purchase an F-Series Firewall without a license and use it as a cold standby replacement. If the production unit fails, call Contacting Barracuda Networks Technical Support to transfer the license to the stand-by unit and continue normal operations.

Subscription Licenses

In addition to the base license, you can add the following subscriptions to use your firewall to its fullest extent.

Barracuda Energize Updates

This license is mandatory for the first year, for every F-Series Firewall. The following features are included with Barracuda Energize Updates:

  • 24x5 technical support.
  • Application Control 2.0
  • Firmware updates
  • Application Control 2.0 definition updates
  • IPS/IDS engine and signature updates
  • Barracuda Web Filter
  • SSL-VPN Web Forward template updates

  • File Content definition updates
Malware Protection

Enables the Virus scanner service.This license is available for all F-Series Firewalls except F10 and VF10.

Advanced Threat Detection

Enables ATD. A malware subscription license is required. The number of files you can upload per hour and per month are limited, depending on your firewall model. The number of files scanned are counted in the Barracuda ATD Cloud. If the local counter on your Firewall is reset, i.e., by reinstalling the OS, the local counter will be out-of-sync for the rest of the month. Limits still apply.

ModelBurst Limit (files/min)Files per Month
F18, F80, F180, F200, F201, F300, F3015108 000
F28010216 000
F38012260 000
F40015324 000
F60025540 000
F80035750 000
F900501 000 000
AWS/Azure Level 25108 000
AWS/Azure Level 410216 000
AWS/Azure Level 615324 000
AWS/Azure Level 835750 000
VF25243 200
VF505108 000
VF10010216 000
VF25015324 000
VF50020432 000
VF100025540 000
VF200030648 000
VF400035750 000
VF8000501 000 000
Legacy SSL VPN and Access-Control-Server-Based NAC

Enables the SSL VPN and classic policy-server-based NAC service. Includes unlimited concurrent SSL VPN sessions and one CudaLaunch session.

Barracuda Remote Access Basic

Enables the SSL VPN service and NAC support. For F-Series Firewalls deployed in Azure/AWS, this subscription is included in the Energize Updates subscription. Remote Access subscriptions are available for NextGen Firewall F80 and larger as well as all NextGen Firewall Vx models.

Included SSL-VPN Features

  • Browser based access via desktop and mobile portals.
  • SSL-VPN-based server-side NAC
  • VPN Templates for SSL VPN

Included Network Access Client Features

  • Windows Personal FW
  • Windows Health Check via Access Control Service.

User Session Limits

  • Unlimited concurrent SSL VPN user sessions. 
  • One concurrent Client-to-Site VPN session by the same user.
  • One CudaLaunch session.
Barracuda Remote Access Premium

A Remote Access Basic Subscription is included in the Remote Access Premium subscription. Remote Access subscriptions are available for NextGen Firewall F80 and larger as well as all NextGen Firewall Vx and public cloud models. For PAYG F-Series Firewalls in AWS and Azure, this subscription is automatically included.

Included SSL-VPN Features

  • Browser based access via desktop and mobile portals.
  • SSL-VPN-based server-side NAC
  • VPN Templates for SSL VPN

Included Network Access Client Features

  • Windows Personal FW
  • Windows Health Check via Access Control Service.


  • iOS
  • Android 
  • Central Management of accessible resources and VPN provisioning

User Session Limits

  • Unlimited concurrent SSL VPN user sessions.
  • Unlimited concurrent CudaLaunch sessions. 
  • Multiple concurrent Client-to-Site VPN sessions by the same user.
Barracuda NG Web Filter

Enables the Barracuda NG Web Filter service, which can use both online and offline databases.

Barracuda NG Web Security

Enables the Barracuda URL Filter service, and can use both online and offline databases and the antivirus service.

Instant Replacement Service

Instant replacement service includes the following features:

  • Replacement unit shipped next business day.
  • 24x7 technical support.
  • Hardware refresh every four years.
Barracuda Web Security Service

NextGen Control Center Licensing

Barracuda NextGen Control Center licenses scale by the number of F-Series Firewalls that can be managed by the Control Center. The High Availability license is included with the VC820 Global Edition model and can be purchased as an add-on for all other models.

ModelSystem TypeNumber of Managed FirewallsTenants (Ranges)Configuration Groupings (Clusters)HA LicenseAdditional Tenants
C400HardwareRecommendation: 2011Optionaln/a
VC400VirtualRecommendation: 2011Optionaln/a
C610HardwareRecommendation: 2001No limitOptionaln/a
VC610VirtualRecommendation: 2001No limitOptionaln/a
VC820VirtualRecommendation 1000+
only limited by hardware
5 (additional tenants optionally available)No limitIncludedOptional

Next Steps

Last updated on