Licensing

Single licenses for the NextGen Firewall F-Series and Control Center are bound to the MAC address of the first network interface.

In this article:

Barracuda NextGen Firewall F-Series Base Licenses

The F-Series Firewall base license gives you a next-generation firewall with the following features:

• Application Control reporting
• SSL Interception (available on all models, except F10 and F100)
• WAN optimizations (compression, Traffic Intelligence, QoS, Data Caching)
• Unlimited number of VPN clients (Client-to-Site Barracuda TINA and IPsec VPN)

You can purchase the F-Series Firewall in three different versions:

Hardware Appliances

A NextGen F-Series Firewall or Control Center hardware appliance is bound to a license on activation. If the appliance must be replaced (RMA), the existing license will be transferred to the replacement unit.

There are no capacity restrictions for hardware appliances. The only restriction is the system performance of the hardware itself. An unlimited number of protected IP addresses, SSL VPN users, and HTTP proxy users (AV+Webfilter) are included. SSL VPN and SSL Interception is included with every F-Series Firewall, except for the F10, VF10, F100, and F101 models.

Virtual Systems

Virtual systems are classified by a "capacity" number in the model name, which defines the number of protected Firewall IPs, SSL-VPN users, VPN users, and HTTP Proxy users (Virus scanning and NG Web Filter). This number is enforced for all smaller models of the virtual appliance (NextGen Firewall VF10 - VF500). NextGen Firewall VF1000 to VF8000 do not set a software limit to the number of protected IP addresses; the capacity number still applies as a sizing recommendation. Depending on the model number, they are also limited by the number of CPU cores that can be used. You must assign the correct number of CPU to your NextGen Firewall or Control Center Vx. If you assign more CPU cores than covered by the license, the license state will be displayed as expired.

Legacy phion licenses do not distinguish between virtual and hardware licenses and also differ from Barracuda VF licenses. Users behind the HTTP proxy service and Client-to-Site VPN users are not factored into the capacity number. Legacy phion licenses require an additional license for Client-to-Site VPN.

If you cannot adjust the number of CPU cores in your hypervisor, it might be necessary to configure the bootloader to use the number of licensed CPU cores. For more information on how to configure the bootloader, see How to Configure the Bootloader. The following table displays the capacity and the number of CPU cores for each NextGen Firewall Vx:

Public Cloud Systems

F-Series Firewalls deployed in the Amazon AWS or Microsoft Azure public clouds are not restricted to a capacity. Performance is only limited by the performance and number of CPU cores of the virtual instance used. To use any service (Firewall, VPN, etc...), you must have an active Energize Updates subscription.

Microsoft Azure and Amazon AWS Pay-As-You-Go Licenses

You can choose to pay an hourly rate for the public cloud F-Series Firewall. The pay-as-you-go license is generated and bound to the VM or Instance on the first boot. The Pay-As-You-Go license includes the following services:

• Forwarding Firewall
• VPN Service
• All services included in the Basic Remote Access Subscription
• All services included in the Premium Remote Access Subscription
• SSH Proxy
• DNS
• DHCP
• DHCP Relay
• FTP Gateway
• Dynamic Routing
• (If managed by a Control Center) Distributed Firewall

Microsoft Azure Instance sizes:

• Level 2 – Small (1 core, 1.75GB memory)
• Level 4 – Medium (2 cores, 3.5GB memory)
• Level 6 – Large (4 cores, 7GB memory)
• Level 8 – Extra Large (8 cores, 14GB memory)

Amazon AWS Instances sizes

• Level 2 – m1.small (1 vCPU core)
• Level 4 – c1.medium (2 vCPU cores)
• Level 6 – m1.xlarge (4 vCPU cores)
• Level 8 – c1.xlarge (8 vCPU cores)

Cold Standby Licensing

For redundancy, you can purchase an F-Series Firewall without a license and use it as a cold standby replacement. If the production unit fails, call Contacting Barracuda Networks Technical Support to transfer the license to the stand-by unit and continue normal operations.

Subscription Licenses

In addition to the base license, you can add the following subscriptions to use your firewall to its fullest extent.

Barracuda Energize Updates

This license is mandatory for the first year, for every F-Series Firewall. The following features are included with Barracuda Energize Updates:

• 24x5 technical support.
• Application Control 2.0
• Firmware updates
• Application Control 2.0 definition updates
• IPS/IDS engine and signature updates
• Barracuda Web Filter

• SSL-VPN Web Forward template updates

• File Content definition updates

Malware Protection

Enables the Virus scanner service.This license is available for all F-Series Firewalls except F10 and VF10.

Advanced Threat Detection

Enables ATD. A malware subscription license is required. The number of files you can upload per hour and per month are limited, depending on your firewall model. The number of files scanned are counted in the Barracuda ATD Cloud. If the local counter on your Firewall is reset, i.e., by reinstalling the OS, the local counter will be out-of-sync for the rest of the month. Limits still apply.

Legacy SSL VPN and Access-Control-Server-Based NAC

Enables the SSL VPN and classic policy-server-based NAC service. Includes unlimited concurrent SSL VPN sessions and one CudaLaunch session.

Barracuda Remote Access Basic

Enables the SSL VPN service and NAC support. For F-Series Firewalls deployed in Azure/AWS, this subscription is included in the Energize Updates subscription. Remote Access subscriptions are available for NextGen Firewall F80 and larger as well as all NextGen Firewall Vx models.

Included SSL-VPN Features

• Browser based access via desktop and mobile portals.
• SSL-VPN-based server-side NAC
• VPN Templates for SSL VPN

Included Network Access Client Features

• Windows Personal FW
• Windows Health Check via Access Control Service.

User Session Limits

• Unlimited concurrent SSL VPN user sessions. 
• One concurrent Client-to-Site VPN session by the same user.
• One CudaLaunch session.

Barracuda Remote Access Premium

A Remote Access Basic Subscription is included in the Remote Access Premium subscription. Remote Access subscriptions are available for NextGen Firewall F80 and larger as well as all NextGen Firewall Vx and public cloud models. For PAYG F-Series Firewalls in AWS and Azure, this subscription is automatically included.

Included SSL-VPN Features

• Browser based access via desktop and mobile portals.
• SSL-VPN-based server-side NAC
• VPN Templates for SSL VPN

Included Network Access Client Features

• Windows Personal FW
• Windows Health Check via Access Control Service.

CudaLaunch

• iOS
• Android 
• Central Management of accessible resources and VPN provisioning

User Session Limits

• Unlimited concurrent SSL VPN user sessions.
• Unlimited concurrent CudaLaunch sessions. 
• Multiple concurrent Client-to-Site VPN sessions by the same user.

Barracuda NG Web Filter

Enables the Barracuda NG Web Filter service, which can use both online and offline databases.

Barracuda NG Web Security

Enables the Barracuda URL Filter service, and can use both online and offline databases and the antivirus service.

Instant Replacement Service

Instant replacement service includes the following features:

• Replacement unit shipped next business day.
• 24x7 technical support.
• Hardware refresh every four years.

Barracuda Web Security Service

To use Barracuda Web Security Service, an additional subscription is required. For more information, see How to Configure the Barracuda Web Security Service.

NextGen Control Center Licensing

Barracuda NextGen Control Center licenses scale by the number of F-Series Firewalls that can be managed by the Control Center. The High Availability license is included with the VC820 Global Edition model and can be purchased as an add-on for all other models.

Next Steps

To install the NextGen Firewall F-Series or Control Center licenses, see:

• How to License your Barracuda NG Firewall
• Licensing on a NG Control Center