It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

CloudGen Firewall Licensing

  • Last updated on

The Barracuda CloudGen Firewall supports various platforms. Licensing differs according to the platform the firewall is deployed on. Single licenses for the CloudGen Firewall and Control Center are bound to the MAC address of the first network interface.

Deployment Options: Which products are available on which platform?

The Barracuda CloudGen Firewall offers different kinds of deployment:

PlatformCloudGen Firewall (F)Control Center (CC)Secure Access Controller (AC) Secure Connector (SC)License Type
SingleEnterprise Pool

Barracuda Hardware Appliance (e.g., F380a)

Virtual Appliance (e.g., VF500)VFVCVFAC-VFVFp
Standard Hardware Appliance (e.g., TSF1000)TSF*---TSFTSFp
Public Cloud Instance (Microsoft Azure, Amazon Web Services, Google Cloud Platform) – BYOL / PAYGVFCVCCVACC-VFCVFCp

*TSF (termed SF) is the successor license to SF, which is end-of-sales.

In general, each deployment option has its individual license type. However, Barracuda hardware also accepts termed software licenses. The functionality and performance of the Barracuda hardware depends on the limits of the TSF license (maximum IPs, supported cores).

If you are licensing a Firewall Control Center, a CloudGen Firewall, or are using pool licenses, please refer to the documentation for your product version.

Base Licensing and Subscriptions

The CloudGen Firewall base license gives you a next-generation firewall with the following features:

  • Application Control reporting
  • SSL Inspection (available on all models, except F10 and F100)
  • WAN Optimization (compression, Traffic Intelligence, QoS, data caching)
  • Unlimited number of VPN clients (client-to-site, TINA, and IPsec VPN)

For more information, see Base Licenses.

In addition to the base license, you can add subscriptions for features such as Malware Protection, Advanced Threat Protection, and Remote Access. Feature sets and available add-on subscriptions may differ from product type or platform. For more information, see Subscriptions.

Management Options: How to manage licenses?

You can manage your Barracuda CloudGen Firewall individually as a stand-alone box or centrally via a Firewall Control Center (CC). There are two different kinds of license management concepts available:

  • Single Licensing (F, VF, TSF, VFC) – Per-box license: This license is bound to the serial number or MAC address of the hardware. A 'non-managed, stand-alone box' is always single licensed. But single-licensed boxes can also be managed via a CC. Nevertheless, each license belongs specifically to one appliance. We refer to this as a 'managed, single-licensed box'.
  • Enterprise Licensing (Fp, VFp, TSFp, VFCp) - a.k.a. Pool Licensing – Enterprise license (pool or float license): This license lets you centrally license and manage multiple boxes with one master license. Enterprise licensing can therefore only be used in conjunction with a Firewall Control Center. The pool license is bound to the customer account number and the CC’s ID (i.e., CC Master ID). A box licensed in this way is referred to as a 'managed, pool-licensed box'. For more information, see Enterprise Licensing (Pool).

Each kind of deployment has its own license type:

DeploymentLicense TypeSingle Licensed Enterprise Licensed
Barracuda HardwareBarracuda Hardware License (F, FSC)Serial numberCC Master ID
Virtual ApplianceVirtual Appliance License (VF)MAC AddressCC Master ID
Standard HardwareTermed Software License (TSF)MAC AddressCC Master ID
Cloud InstanceCloud Instance License (VFC)MAC AddressCC Master ID

Hardware Appliances

A CloudGen Firewall hardware appliance is bound to a license on activation. If the appliance must be replaced (RMA), the existing license will be transferred to the replacement unit. There are no capacity restrictions for hardware appliances. The only restriction is the system performance of the hardware itself. An unlimited number of protected IP addresses, SSL VPN users, and HTTP proxy users (Virus Scanner and Web Security Gateway) is possible. The functionality of SSL VPN and SSL Inspection is included with every CloudGen Firewall, except for the F10, F100, and F101 models.

Virtual and Software Models

Virtual systems are classified by a 'capacity' number in the model name, which defines the number of protected firewall IPs, SSL VPN users, VPN users, and HTTP Proxy users (Virus Scanner). This number is enforced for all smaller models of the virtual appliance (CloudGen Firewall VF10 - VF500). CloudGen Firewalls VF1000 to VF8000 do not set a software limit to the number of protected IP addresses; the capacity number still applies as a sizing recommendation. Depending on the model number, they are also limited by the number of CPU cores that can be used. You must assign the correct number of CPU to your CloudGen Firewall or Control Center Vx. If you assign more CPU cores than covered by the license, the license state will be displayed as expired.

Legacy phion licenses do not distinguish between virtual and hardware licenses and also differ from Barracuda VF licenses. Users behind the HTTP Proxy service and client-to-site VPN users are not factored into the capacity number. Legacy phion licenses require an additional license for client-to-site VPN.

If you cannot adjust the number of CPU cores in your hypervisor, it might be necessary to configure the bootloader to use the number of licensed CPU cores.

The following table displays the capacity and the number of CPU cores for each CloudGen Firewall Vx:

Model Capacity (Protected IPs)Number of Supported CPU Cores 

VF10, TSF10




VF25, TSF25




VF50, TSF50




VF100, TSF100




VF250, TSF250




VF500, TSF500




VF1000, TSF1000




VF2000, TSF2000




VF4000, TSF4000




VF8000, TSF8000




* Number of protected FW IPs, SSL VPN users, VPN users, and proxy users (AV + Web Filter)

The number of network interfaces is limited only by the number supported by the hypervisor.

Public Cloud Systems

Barracuda CloudGen Firewalls for the public cloud are licensed as BYOL (Bring-Your-Own-License) or as PAYG (Pay-As-You-Go). For BYOL, you need to purchase licenses directly from Barracuda Networks. After installing the cloud instance, the licenses can be downloaded via an online token and activated. Cloud instances with PAYG licensing are purchased directly at the cloud vendor’s marketplace. In this case, licenses are installed automatically in the background. Public cloud performance limitations are defined by level.

For more information, see Public Cloud Licensing.

Firewall Control Center

The Firewall Control Center license is installed on the box layer and the management interface of the Control Center. The Control Center manages, assigns, and updates VF and SF pool licenses for managed firewalls and can also automatically activate licenses. 

Firewall Control Center licenses scale by the number of firewalls that can be managed by the Control Center. 

EditionModelSystem TypeRanges (Configuration Groups)Clusters (Tenants)Number of Managed FirewallsHA LicensePKI ServiceBarracuda Earth
Standard VC400Virtual11Unlimited  [Recommended: 20]OptionalNoNo
VCC400Public Cloud1 (additional ranges optionally available)1Unlimited [Recommended: 20]OptionalNoNo
EnterpriseVC610Virtual1UnlimitedUnlimited [Recommended: hardware-dependent]OptionalYesYes
VCC610Public Cloud2 (additional ranges optionally available)UnlimitedUnlimited [Recommended: cloud instance-dependent]OptionalYesYes
GlobalVC820Virtual5 (additional ranges optionally available)UnlimitedUnlimited [Recommended: hardware-dependent]IncludedYesYes

In case of highly distributed environments (i.e., multiple firewalls) where a Control Center for central management is in use, Barracuda Networks offers an enterprise licensing model, also known as pool licensing.

For more information, see Enterprise Licensing (Pool).

Cold Spare Licensing

For redundancy, you can purchase a CloudGen Firewall without a license and use it as a cold spare replacement. If the production unit fails, call Barracuda Networks Technical Support to transfer the license to the spare unit and continue normal operations.

Last updated on