WatchGuard Firebox license renewals: what MSPs need to know

WatchGuard Cloud management is licensed to a Firebox as part of a suite subscription. Optional Data Retention licenses add cloud log and report days on top. A newly activated Firebox is eligible for a free 30-day trial of the security services.

Suites are sold in 1-, 3-, and 5-year terms through resellers, and WatchGuard caps support subscriptions at a five-year maximum length. Reseller SKUs follow a model-service-term pattern, for example WGT20351 for a T20 Total Security Suite 1-year renewal and WGT20353 for the 3-year.

WatchGuard does not publish a multi-year discount percentage. Reseller price lists show 3-year terms priced below three times the 1-year price, so the multi-year term is usually the better buy when the hardware still has years of support left.

A subscription expires at 12:00 AM on the day after the expiration date in the Firebox feature key. WatchGuard's documentation says that when a subscription service expires, that service does not operate and its configuration options are disabled.

The services that stop are Gateway AntiVirus, IntelligentAV, Intrusion Prevention, WebBlocker, spamBlocker, Reputation Enabled Defense, Access Portal, Application Control, APT Blocker, Botnet Detection, Tor Exit Node Blocking, Network Discovery, EDR Core, DNSWatch, and Geolocation. The Firebox retains its configuration and continues to enforce policies, but the subscription security services no longer work.

Two behaviors catch people out. WebBlocker denies all websites when its license has expired unless the license-bypass setting was set to Allowed beforehand, so an expired WebBlocker can look like an outage. And Policy Manager refuses to save configuration changes while a configured subscription is expired.

When Support expires, the device loses phone and web support, software updates, and RMA, and it cannot be upgraded to or reinstalled with any Fireware release dated after the support expiration.

There is no documented grace period for the security services. Cloud-managed Fireboxes get a seven-day grace period to keep connecting and logging to WatchGuard Cloud, after which the device shows Not Connected but stays editable through the Web UI.

WatchGuard back-dates late renewals. If the license lapsed less than six months ago, the renewal starts on the original expiration date, so the lapsed months come out of the new term. If it lapsed more than six months ago, the start date is set to six months in the past. Upgrades between tiers start at the activation date and are not back-dated.

WatchGuard states that it charges a reinstatement fee for any subscription allowed to lapse. The fee amount is not published, and it appears on the distributor quote rather than the price list, so budget for it when a renewal comes in late.

For Firebox suites, co-terming is done by the reseller: WatchGuard documents that your reseller can create a custom renewal quote that synchronizes the renewal dates for multiple subscription services. In practice that means asking the distributor for a term that ends on a specific date rather than a whole number of years.

WatchGuard has a formal co-term mechanism, with merged licenses and a weighted-average expiration, for Data Retention, AuthPoint, Endpoint, and CloudDR licenses. That mechanism is not documented for Firebox suites, which is why the reseller quote is the path.

The most useful co-term target is the hardware's end-of-life date. Renewals are only sold until end of life, so a term that runs past it is paying for months the device cannot use.

WatchGuard defines end of sale as the last date distributors can buy the product, and end of life as the end of development and support. End of life generally occurs up to five years after end of sale, and renewals remain available for previously purchased hardware until end of life.

In September 2024 WatchGuard announced renewal surcharges of up to 16 percent on end-of-sale models, so a renewal on an aging Firebox can cost more than the same term on a current one.

Dates below come from WatchGuard's end-of-life policy page. For the T85-PoE the original end-of-sale announcement said December 31, 2030, while the policy table now says July 1, 2031; the policy table is treated as authoritative here.

• Fireware Web UI: System > Feature Key shows an Expiration column per service, and Dashboard > System shows days remaining.
• Policy Manager: Setup > Feature Keys. Policy Manager also warns on save at 90, 60, 30, 15, and 1 days before expiration.
• WatchGuard Cloud: the device summary's License Details panel shows license type, status, and expiration, and a folder-level tile shows the next license expiration across devices.
• WatchGuard Support Center: sign in at login.watchguard.com, open My WatchGuard > Manage Products, and read the Support Expiration column; expand Device Services for the individual subscriptions.
• Email: WatchGuard sends renewal notices starting 60 days before expiration to the contact on the activation record, which is often the reseller rather than the client.

WatchGuard directs customers to buy renewals through a WatchGuard reseller. Once the renewal is purchased, the license is activated at myproducts.watchguard.com and the Firebox synchronizes its feature key, either automatically or from the Feature Key page.

A designated Preferred Reseller can see all of a customer's devices and licenses in the Support Center and works directly with WatchGuard to create renewal quotes. If your MSP is not the Preferred Reseller on a client's account, the renewal notices and the quoting shortcut go to whoever is.

Through distribution, the request needs the Firebox serial number, the suite, and the term. In our experience with TD SYNNEX the quote comes back as a spreadsheet keyed to the serial, and a co-term to end of life has to be asked for explicitly.

MSP Renewals stores each Firebox with its serial number, its suite (Total Security Suite, Basic Security Suite, or Standard Support), the term you normally sell, and the expiration date you enter or sync. It alerts at 90, 30, and 5 days, drafts the renewal quote at 90 days, and can send the pricing request to your distributor automatically with the serial, suite, term, and your reference number.

The pricing request also carries the model's end-of-life date, taken from WatchGuard's policy page, for the T20, T25, T40, T45, T80, T85-PoE, M270, M290, M370, M470, M590, and M690, and asks the distributor to co-term to it if a full term is not available. When the client approves, the device's expiration rolls forward by the term you sold and the countdown restarts.

Does a WatchGuard Firebox stop passing traffic when the license expires?

WatchGuard documents that the Firebox retains its configuration and that subscription security services no longer work after expiration. Firewall policies continue to be enforced; Gateway AntiVirus, IPS, WebBlocker, APT Blocker, DNSWatch, and the other subscription services stop. One exception to watch: WebBlocker denies all web traffic when expired unless its license-bypass setting was set to Allowed in advance.

Is there a grace period on WatchGuard security services?

No grace period is documented for the security services; they stop at 12:00 AM the day after the expiration date in the feature key. Cloud-managed Fireboxes get seven days to keep connecting to WatchGuard Cloud before they show as Not Connected.

If a WatchGuard license lapsed, does the renewal start today or on the old expiration date?

On the old expiration date if the lapse is under six months, so the lapsed time is deducted from the new term. Over six months, WatchGuard sets the start date six months in the past. WatchGuard also charges a reinstatement fee on lapsed subscriptions; the amount is not published.

What is the difference between Basic Security Suite and Total Security Suite?

Basic covers IPS, Application Control, WebBlocker, spamBlocker, Gateway AntiVirus, Reputation Enabled Defense, and Network Discovery with standard support. Total adds APT Blocker, DNSWatch, IntelligentAV, ThreatSync XDR, and EDR Core, with Gold support and longer cloud log retention.

How long can I renew a Firebox after it goes end of sale?

Until its end-of-life date, which WatchGuard says generally falls up to five years after end of sale. The T20, T40, T80, M270, M370, and M470 reach end of life on July 1, 2028. Renewals on end-of-sale models have carried surcharges since September 2024.

Can I co-term several WatchGuard licenses to one date?

Yes, through your reseller. WatchGuard documents that a reseller can build a custom renewal quote that synchronizes renewal dates across subscriptions. Ask the distributor for a term ending on the date you want, most usefully the hardware's end-of-life date.

1. WatchGuard — Security services (Basic and Total Security Suite contents)
2. WatchGuard — Total Security Suite
3. WatchGuard KB — Support levels included with each suite
4. WatchGuard KB — What happens when a subscription expires; reinstatement fee
5. WatchGuard — Support levels (five-year maximum length)
6. WatchGuard Help Center — Subscription expiration (expiry time, warnings)
7. WatchGuard Help Center — Subscription expiration behavior in Fireware
8. WatchGuard Help Center — About Firebox licenses in WatchGuard Cloud
9. WatchGuard Help Center — Cloud and Data Retention license expiration (seven-day grace)
10. WatchGuard Help Center — WebBlocker behavior on expiration
11. WatchGuard Help Center — Back-dating of expired licenses
12. WatchGuard — Renewal Subscription Center
13. WatchGuard Help Center — Data Retention license co-terming
14. WatchGuard — End-of-life policy and model dates
15. WatchGuard — End-of-sale announcement, Firebox M290
16. WatchGuard — End-of-sale announcement, Firebox M590/M690
17. WatchGuard — End-of-sale announcement, Firebox T85-PoE
18. WatchGuard — 2024 price adjustment notice (end-of-sale surcharges)
19. WatchGuard Help Center — Renew security subscriptions
20. WatchGuard Help Center — About feature keys
21. WatchGuard Help Center — Firebox device summary in WatchGuard Cloud
22. WatchGuard Help Center — License expiration in the Support Center
23. WatchGuard Help Center — Manage resellers (Preferred Reseller)
24. Reseller reference — WatchGuard renewal SKU patterns and multi-year pricing