Introduction to FireboxV

Applies To: Locally-managed Fireboxes

FireboxV is a Firebox model designed to run in the VMware ESXI or Microsoft Hyper-V environment. FireboxV can also run in the Linux KVM environment. These models use the same Fireware OS and management software as other Fireboxes. You can use WatchGuard System Manager, Fireware Web UI, WatchGuard Cloud, and the Command Line Interface (CLI) to manage a FireboxV virtual machine just as you manage any other Firebox.

For information on how to manage a FirebovV configuration in WatchGuard Cloud, go to Add FireboxV to WatchGuard Cloud (Cloud-Managed).

Models and Licensing

FireboxV devices are licensed in several different models, which provide different levels of scalability and performance:

  • Micro
  • Small
  • Medium
  • Large
  • Extra Large

When you activate your FireboxV device, a feature key is generated. The feature key adds a device serial number and enables the Fireware capabilities for the licensed FireboxV model model. The feature key is installed on the FireboxV virtual machine during setup.

For a comparison of the features and capabilities of each FireboxV model, review the Products section of the WatchGuard web site at www.watchguard.com.

Hypervisor Compatibility

WatchGuard FireboxV system requirements:

  • For information about VMware ESXi, Hyper-V for Microsoft Windows Server, and Hyper-V Server system requirements, go to the FireboxV System Requirements section of the Operating System Compatibility Matrix in Fireware Release Notes. (external link)
  • Linux KVM (Supported in Fireware v12.6.2 or higher)

Fireware OS Limitations

FireboxV uses the same Fireware OS and support the same features and subscription services as other Firebox models, with the exception of a few features that are hardware-dependent.

Fireware features not supported on FireboxV include:

  • Active/inactive FireCluster in VMware ESXi (FireCluster is not supported at all for Hyper-V or KVM )
  • Bridge mode network configuration
  • Hardware diagnostics CLI commands
  • Automatically save a support snapshot to a USB drive
  • Automatically restore a saved backup image from a USB drive
  • RapidDeploy configuration
  • FIPS mode

Virtual Switch Configuration

To work correctly, some Fireware networking features require that you configure the virtual switch on your network in promiscuous mode. These features are: 

  • Drop-in mode network configuration
  • Network bridge
  • Mobile VPN with SSL, with the Bridged VPN Traffic setting

To use these features in an ESXi environment, configure the vSwitch to operate in promiscuous mode.

Virtual switches in Microsoft Hyper-V do not support promiscuous mode, so these features are not supported in a Hyper-V environment.

To use multiple VLANs on a single interface in an ESXi environment, configure the VSwitch for the VLAN interface to use VLAN ID 4095 (All).

FireCluster vSwitch Configuration

There are additional switch requirements for an active/passive FireCluster in an ESXi environment:

  • Configure the vSwitch that connects to the FireCluster management interface to operate in promiscuous mode.
  • Configure any vSwitch that connects to a FireCluster external interface to accept MAC address changes.

For detailed steps to set up two FireboxV devices as a FireCluster, go to Configure a FireCluster on VMware ESXi.