It seems like your browser didn't download the required fonts. Please revise your security settings and try again.
Barracuda CloudGen Firewall

CloudGen Firewall Licensing

  • Last updated on

The Barracuda CloudGen Firewall supports various platforms. Licensing differs according to the platform the firewall is deployed on. Single licenses for the CloudGen Firewall and Control Center are bound to the MAC address of the first network interface.

Deployment Options: Which products are available on which platform?

The Barracuda CloudGen Firewall offers different kinds of deployment:

PlatformCloudGen Firewall (F)Control Center (CC)Secure Access Controller (AC) Secure Connector (SC)License Type
SingleEnterprise Pool

Barracuda Hardware Appliance (e.g., F380a)






Fp, FSCp (TSFp)

Virtual Appliance (e.g., VF500)






VFC-Pool (VFp)

Standard Hardware Appliance (e.g., TSF1000)






VFC-Pool (TSFp)

Public Cloud Instance (Microsoft Azure, Amazon Web Services, Google Cloud Platform) – BYOL / PAYG







*The new CGF v8.3.2 and v9.0.0 support the VFC model structure and licenses, which replace the former individual Cloud, VF, SF/TSF licensing. Please visit our EoS/EoLs information page for further information.

In general, each deployment option has its individual license type. However, starting with CGF v8.3.2 and 9.0.0, Barracuda Networks hardware also accepts the new CGF-VFC licenses. Functionality and performance of the Barracuda hardware depends on the core limit of the VFC license. New CGF-VFC licenses can be used for public cloud instances (AWS, Azure, GCP), virtual appliances, and standard hardware.

Licenses and Subscriptions: Which features are supported?

For details on base licensing and available add-on subscriptions for the Barracuda CloudGen Firewall, see Base Licensing and Subscriptions.

Management Options: How to manage licenses?

You can manage your Barracuda CloudGen Firewall individually as a stand-alone box or centrally via a Firewall Control Center (CC). There are different kinds of license management concepts available:

  • Single Licensing (F, VF, TSF, VFC) – Per-box license: This license is bound to the serial number or MAC address of the hardware. A 'non-managed, stand-alone box' is always single licensed. But single-licensed boxes can also be managed via a CC. Nevertheless, each license belongs specifically to one appliance. We refer to this as a 'managed, single-licensed box'. For more information, see Hardware Licensing and Virtual / Software Licensing.
  • Enterprise Licensing (Fp, VFp, TSFp, VFCp) - a.k.a. Pool Licensing – Enterprise license (pool or float license): This license lets you centrally license and manage multiple boxes with one master license. Enterprise licensing can therefore only be used in conjunction with a Firewall Control Center. The pool license is bound to the customer account number and the CC’s ID (i.e., CC Master ID). A box licensed in this way is referred to as a 'managed, pool-licensed box'. For more information, see Enterprise Licensing (Pool).
  • Public Cloud Licensing – Barracuda CloudGen Firewalls for the public cloud are licensed as BYOL (Bring-Your-Own-License) or as PAYG (Pay-As-You-Go). For BYOL, you need to purchase licenses directly from Barracuda Networks. After installing the cloud instance, the licenses can be downloaded via an online token and activated. Cloud instances with PAYG licensing are purchased directly at the cloud vendor’s marketplace. In this case, licenses are installed automatically in the background. Public cloud performance limitations are defined by level. For more information, see Public Cloud Licensing.

Each kind of deployment has its own license type:

DeploymentLicense TypeSingle Licensed Enterprise Licensed

Barracuda Hardware

Barracuda Hardware License (F, FSC)

Serial number

CC Master ID

Virtual Appliance

VFC* (former VF)

MAC Address

CC Master ID

Standard Hardware

VFC* (former TSF)

MAC Address

CC Master ID

Cloud Instance

VFC* (former Public Cloud Level)

MAC Address

CC Master ID

 If you are licensing a Firewall Control Center, a CloudGen Firewall, or are using pool licenses, please refer to the documentation for your product version.

Control Center Licensing

The Firewall Control Center license is installed on the box layer and the management interface of the Control Center. The Control Center manages, assigns, and updates VF and SF pool licenses for managed firewalls and can also automatically activate licenses. For more information, see Licensing CloudGen Firewalls in the Control Center in the Barracuda CloudGen Firewall documentation.

Control Center licenses scale by the number of firewalls that can be managed by the CC.

EditionModelSystem typeRanges (Configuration Groups)Clusters (Tenants)Number of managed firewallsHA licensePKI ServiceBarracuda Earth
StandardC400Hardware11Unlimited [Recommended: 20]OptionalNoNo
VC400Virtual13Unlimited [Recommended: 20]OptionalNoNo
VCC400Public Cloud13Unlimited [Recommended: 20]OptionalNoNo
EnterpriseC610Hardware1UnlimitedUnlimited [Recommended: 200]OptionalYesYes
VC610Virtual2UnlimitedUnlimited [Recommended: hardware-dependent]OptionalYesYes
VCC610Public Cloud2UnlimitedUnlimited [Recommended: cloud instance-dependent]OptionalYesYes
GlobalVC820Virtual5 (additional ranges optionally available)UnlimitedUnlimited [Recommended: hardware-dependent]IncludedYesYes

In case of highly distributed environments (i.e., multiple firewalls) where a Control Center for central management is in use, Barracuda Networks offers an enterprise licensing model, also known as pool licensing.

For more information, see Enterprise Licensing (Pool).

Cold Spare Licensing

For redundancy, you can purchase a CloudGen Firewall without a license and use it as a cold spare replacement. If the production unit fails, call Barracuda Networks Technical Support to transfer the license to the spare unit and continue normal operations.

For more information, see CloudGen Firewall Cold Spare Replacement in the Barracuda CloudGen Firewall documentation.