WatchGuard Firebox M6850
WatchGuard FireCloud. Security that travels with your users.
FireCloud moves firewall and web protection into the cloud, so your people get the same policies at home, on the road, or at a client site. Choose Internet Access for teams that run entirely in the cloud, or Total Access to add zero trust access to the apps and servers back at the office. Both are managed in WatchGuard Cloud.
Shop by Edition
FireCloud Internet Access
Cloud firewall and secure web gateway protection for remote users whose apps all live in the cloud.
Shop FireCloud Internet Access →
FireCloud Total Access
Everything in Internet Access, plus zero trust access to private apps and servers in place of your remote access VPN.
Shop FireCloud Total Access →WatchGuard FireCloud at a Glance
| Edition | Best For | User Bands | Deployment | Key Feature |
|---|---|---|---|---|
| FireCloud Internet Access | Fully remote teams with every app in the cloud | 1 to 50 up to 5,001+ | Cloud service, no hardware | FWaaS and Secure Web Gateway |
| FireCloud Total Access | Hybrid teams with apps in the cloud and on premises | 1 to 50 up to 5,001+ | Cloud service plus a FireCloud Gateway | Adds ZTNA for private apps, replacing remote access VPN |
What Sets FireCloud Apart
Access by App, Not by Network
A remote access VPN hands users the whole network once they log in. FireCloud Total Access verifies each user, device, and session, then opens only the apps you have approved for that person. If a password gets phished, the attacker lands in one app instead of your entire LAN, and your audits get a lot simpler.
One Console for Users, Firewalls, and Endpoints
FireCloud lives in WatchGuard Cloud, the same place you manage Firebox firewalls, AuthPoint MFA, and WatchGuard Endpoint Security. Reusable policy templates and native reporting mean you set rules once and see remote user activity right next to the rest of your network.
Your Firebox Can Be the Gateway
Supported Firebox models on current Fireware can act as the FireCloud gateway for private resources over a WireGuard tunnel. If you already run a Firebox at the office, remote users can reach apps on that network through it with no extra servers to stand up.
Threats Stopped Before They Reach the Laptop
FireCloud inspects traffic in the cloud before it gets to the device. Suspicious sites are filtered, phishing is blocked, and downloads are scanned in real time, whether the user is at home or on hotel Wi-Fi. There is nothing to rack, so rollout takes hours instead of weeks.
WatchGuard FireCloud FAQ
Both editions protect users on the Internet with Firewall as a Service (FWaaS) and a Secure Web Gateway (SWG), all managed in WatchGuard Cloud. Internet Access stops there, which makes it a good fit for fully remote teams that run every app in the cloud. Total Access includes everything in Internet Access and adds Zero Trust Network Access (ZTNA), so users can reach private apps, file shares, and servers on your network without a traditional remote access VPN.
FireCloud is licensed per user. We carry both editions in user bands from 1 to 50 users up to 5,001 and more, with terms from 1 to 5 years. Pick the band that covers your current headcount. If you add people later, you can activate more users and WatchGuard co-terms them with your existing license, recalculating a single expiration date for the whole account.
Yes, with FireCloud Total Access. You set up a FireCloud Gateway in front of the private resources you want to publish, then create access rules for which users can reach them. The gateway can be a FireCloud Virtual Gateway, a Server Gateway installed on a Windows server through the WatchGuard Agent, or a Firebox on supported models and Fireware versions. The gateway needs TCP 443 and UDP 4501 open so it can connect to FireCloud. Internet Access does not include private resource access.
No. FireCloud is delivered from the cloud, so Internet Access needs no hardware at all. Total Access needs a gateway for private resources, and that can be a virtual gateway or a Windows server you already run. If you have a supported Firebox, it can act as the gateway too, so you are not adding another box to the rack.
That is exactly what it is built for. A traditional remote access VPN puts users on the network once they log in. Total Access checks the user, device, and context for every session and only opens the specific apps you have approved, which limits how far an attacker can get with stolen credentials. You can roll it out to a small group first and retire the VPN once everyone has moved over.
Yes. FireCloud integrates with WatchGuard AuthPoint for MFA and SSO, ThreatSync for XDR, and WatchGuard Endpoint Security, so identity, device, and network protection all line up under the same policies in WatchGuard Cloud.
FireCloud licenses are delivered by email, and orders placed before 3pm EST are emailed the same day. To activate, log in to the WatchGuard Support Center, select My WatchGuard, then Activate Products, and enter your license key. The users are added to your FireCloud account, and you manage everything from WatchGuard Cloud.
Yes. WatchGuard offers a free 30 day FireCloud Total Access trial for up to 250 users, so you can test web protection and private app access on real users before you buy. Reach out and our team will help you get it started.
Yes. You can upgrade from Internet Access to Total Access when you need private app access. Going the other direction is a bigger decision: WatchGuard notes that downgrading from Total Access to Internet Access permanently removes your existing gateway and private resource configurations.
Not sure which WatchGuard FireCloud edition is right for you?
Tell us how many users you need to cover, whether they need to reach servers or apps on your network, and whether you run a Firebox today. As a WatchGuard One Gold Partner, our certified team will recommend the right edition, user band, and term.
Get a Licensing Recommendation
Login and Registration Form
Existing User