WatchGuard Firebox for SMBs: T and M series, Total Security Suite and cloud management

WatchGuard is our second reference firewall, alongside Fortinet. We are a WatchGuard partner and we recommend it to SMBs that want complete security with accessible administration, without in-house network expertise. Here is the range and our choices.

The ranges in a nutshell

• Firebox T, desktop: T25 for small sites up to 20 users, T45 up to 50, T85 up to 100, with built-in WiFi and PoE versions to power access points. Compact, silent, the majority of our SMB deployments.
• Firebox M, rackmount: M290 and M390 for headquarters of 100 to 400 users, fiber ports, redundant power on higher models.
• FireboxV and Firebox Cloud: virtual editions for Proxmox, VMware, Azure or AWS, useful to protect a private cloud such as those we describe in Proxmox and Ceph high availability.

As with Fortinet, the throughput to remember is the one with all protections on, roughly a quarter of the datasheet’s “firewall” figure.

Basic or Total Security Suite

The appliance is sold with a one, three or five-year subscription.

• Basic Security Suite: antivirus, IPS, web and application filtering, anti-spam, standard support. Enough for a small site without sensitive data.
• Total Security Suite: all of the above, plus APT Blocker, sandboxing of unknown files, DNSWatch, DNS filtering, ThreatSync, correlation with WatchGuard’s EDR on endpoints, and priority support. That is what we install nine times out of ten: the price difference is small compared with the added protection.

Over three years, the subscription weighs more than the appliance. A Firebox with a lapsed subscription stops updating and loses its protections.

What WatchGuard does particularly well

• WatchGuard Cloud: administration, logs and reports for every site in a single console, with no server to install. Ideal for a network of branches.
• AuthPoint: WatchGuard’s MFA, integrated with VPN, remote desktop and cloud apps, with a simple mobile app. We cover it in our MFA guide.
• Readable reports: dashboards that speak to a manager, not only to an engineer.
• Managed WiFi access points from the same console, with the same security rules.

Firebox or FortiGate

We offer both, and the choice depends on context, as detailed in FortiGate or WatchGuard for an SMB. In short: FortiGate for complex, multi-site networks and advanced SD-WAN, Firebox for SMBs that want a clear console, integrated MFA and simple delegated administration.

Our typical deployment

1. Audit of the existing network and traffic.
2. Model selection with 30% growth margin, Total Security Suite over three years.
3. Configuration: segmentation, HTTPS inspection, DNS filtering, geo-blocking, VPN with AuthPoint.
4. Connection to WatchGuard Cloud and to our monitoring.
5. Monthly report folded into your managed services contract.

A Firebox deploys in one day on a 50-person site, outside production hours to avoid any outage.