> For the complete documentation index, see [llms.txt](https://docs.plenit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-deploy-a-watchguard-fireboxv-in-the-cloud.md).

# How to Deploy a WatchGuard FireboxV in the Cloud

Deploy and configure a virtual WatchGuard FireboxV firewall from the Marketplace.

WatchGuard FireboxV is a virtual firewall for perimeter security, VPN, routing, and traffic filtering.

As a VNF, you deploy it in a **Servers** and connect it to your networks.

> #### 👍 What you get
>
> A deployed FireboxV, connected to your networks and ready to configure security policies and services.

In this guide, you will learn to:

* Create a VNF server with the image **WatchGuard FireboxV 12.11.3**.
* Complete the appliance initial wizard.
* Enable and configure its additional interfaces.
* Register the license, if your case requires it.

For an equivalent deployment with Fortinet, see [How to Deploy a FortiGate VNF in the Cloud](/docs-en/productos/servers/how-to/how-to-deploy-a-fortigate-vnf.md).

### Before you begin

You need:

* An active subscription for **Servers** and permission to create servers.
* The networks where you will connect the FireboxV: **Direct IP**, **Standard**, **VPC** or **Layer 2**.
* A maintenance window if the firewall will replace a production device.

Access to the WatchGuard portal is not necessary to deploy or test the VNF. You will need it if you migrate a license, register the device, or activate paid security services.

> #### 📘 Registration can wait
>
> You can complete the deployment and basic configuration before licensing the FireboxV.

### Step 1. Create the FireboxV server

In the dashboard, go to **New subscription → New Servers subscription**.

Define a name that identifies its role and location. For example:

* `fireboxv-core-madrid`
* `wg-firewall-hq`
* `fireboxv-client-prod`

<figure><img src="https://3894148717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxksPMyYRDCe4qKkhbpcY%2Fuploads%2FBN3VCnlJA9ONK435AdkP%2FCrea%20un%20nuevo%20servidor%20para%20alojar%20el%20VNF%20WatchGuard%20FireboxV.jpg?alt=media&amp;token=65fe63c8-e21f-41f3-a4fc-455d6231fda8" alt=""><figcaption><p>Create a new server to host the WatchGuard FireboxV VNF</p></figcaption></figure>

### Step 2. Select zone and resources

Choose the region and zone where the server will reside. They should fit the rest of the infrastructure.

As a starting point, assign **4 vCPU** and **8 GB of RAM**. Adjust those resources according to expected traffic, VPNs, and active security services.

Keep the VNF system disk on the small volume required by the image. Add additional disks if you need more space. A maximum of **1 TB** per disk is recommended, although you can add several.

<figure><img src="https://3894148717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxksPMyYRDCe4qKkhbpcY%2Fuploads%2FoG7VU3q9KFX6hiEHbLMW%2FAjusta%20los%20recursos%20seg%C3%BAn%20el%20tr%C3%A1fico%20esperado%20y%20el%20tama%C3%B1o%20del%20cliente%20(1).jpg?alt=media&amp;token=754b4ed8-fd1c-47ed-9949-0c5de014a693" alt=""><figcaption><p>Adjust the resources according to expected traffic and customer size</p></figcaption></figure>

### Step 3. Select the FireboxV image

In the **Images** section, open the **Marketplace** and select **WatchGuard FireboxV 12.11.3**.

<figure><img src="https://3894148717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxksPMyYRDCe4qKkhbpcY%2Fuploads%2FpnnhAVEbc5gCa7hO4fvM%2FSelecciona%20la%20imagen%20oficial%20WatchGuard%20FireboxV%20desde%20el%20Marketplace.jpg?alt=media&amp;token=cf130367-9686-4923-90aa-739c861dc041" alt=""><figcaption><p>Select the official WatchGuard FireboxV image from the Marketplace</p></figcaption></figure>

### Step 4. Configure the networks before booting

Assign the interfaces your design needs. Include at least one management interface. For it, a **Direct IP** or **Standard**.

Add additional interfaces for internal networks, the DMZ, or any other security zone.

<figure><img src="https://3894148717-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FxksPMyYRDCe4qKkhbpcY%2Fuploads%2FOGRwzRUJQeQtKAo6nQqK%2FConfigura%20la%20interfaz%20de%20gesti%C3%B3n%20y%20las%20interfaces%20adicionales%20necesarias.jpg?alt=media&amp;token=48fdc18c-ba0f-4f3f-8be1-0b782befbe6d" alt=""><figcaption><p>Configure the management interface and any additional required interfaces</p></figcaption></figure>

#### Initial interface behavior

FireboxV applies its own initial configuration to its interfaces:

| Interface        | Initial role   | Initial address | DHCP     | Status   |
| ---------------- | -------------- | --------------- | -------- | -------- |
| `eth0`           | External (WAN) | DHCP client     | Client   | Active   |
| `eth1`           | Trusted (LAN)  | `10.0.1.1/24`   | Server   | Active   |
| `eth2` and later | Optional       | `10.0.x.1/24`   | Disabled | Disabled |

The networks **Direct IP**, **Standard** and **VPC** assign addresses via DHCP. However, additional interfaces initially appear disabled in FireboxV.

After the first boot, enable them and configure them as **DHCP Client**. In a **Layer 2**, configure the IP address manually.

### Step 5. Complete the initial wizard

When the server is up, open the FireboxV web interface using the management network IP.

You can also manage it with **WatchGuard System Manager (WSM)** or through the CLI. Use the web interface for the first boot.

Initial credentials depend on the image. Change them during the wizard and store the new passwords in a safe place.

> 📸 **Suggested screenshot:** FireboxV access screen.\
> **Caption:** Access the web interface with the administrator user.

In the wizard, choose **Create a new configuration** for a new deployment. If you are migrating an existing device, you can restore a compatible backup.

#### Configure the External interface

The **External** interface is the WAN uplink. Select **DHCP** or a static IP address, depending on the outbound network.

In most cloud deployments, DHCP is enough. You can skip the connectivity test if the topology is not complete yet.

#### Configure the Trusted interface

The **Trusted** acts as the internal LAN. By default it uses `10.0.1.1/24` and provides DHCP.

Define the network range and decide who will hand out the addresses:

* Keep FireboxV DHCP if there is no other DHCP service.
* Disable it if you already have a DHCP server on that network.

#### Protect the administration accounts

FireboxV includes two main profiles:

| Account  | Access                         |
| -------- | ------------------------------ |
| `admin`  | Full administration            |
| `status` | Configuration and status query |

Use strong, different passwords. You can use `status` to grant read-only access.

Do not enable broad remote management during the wizard. Limit it afterward to specific administration IPs, such as an office or a bastion host.

Also configure the correct time zone. That way you can correlate the logs with those on the platform.

### Step 6. Enable the additional interfaces

After completing the wizard, review each additional NIC connected on the platform:

1. Go to **Network → Interfaces** in FireboxV.
2. Select the corresponding interface, for example `eth2`.
3. Mark it as **Enabled**.
4. Configure its addressing according to the type of network.

> 📸 **Suggested screenshot:** list of interfaces with a disabled additional interface.\
> **Caption:** Additional interfaces appear disabled by default.

#### Networks with DHCP

For **Direct IP**, **Standard** or **VPC**, change the interface IP mode to **DHCP Client**. Then verify that it receives the address assigned in the subscription.

> 📸 **Suggested screenshot:** interface configuration with **DHCP Client**.\
> **Caption:** Configure the NIC as a DHCP client to use the IP assigned by the platform.

#### Layer 2 networks

The networks **Layer 2** do not provide DHCP by default. Configure a manual IP address within the range defined for that network.

### Step 7. Apply the initial security settings

After deployment, review these measures:

* Change the administration HTTPS port to a non-standard one, such as `8443`.
* Restrict administrative access by source IP.
* Review and adapt the default policies to the customer's security model.
* Install WatchGuard System Manager if you need monitoring, reporting, or centralized management.

### Step 8. Validate the deployment

Check the following before considering the service operational:

* You can access the web interface or WSM.
* Each interface has the correct IP address.
* There is connectivity between the networks that need to communicate.
* The device time matches the configured time zone.

### Troubleshooting

| Problem                                       | Common cause                          | What to do                                                    |
| --------------------------------------------- | ------------------------------------- | ------------------------------------------------------------- |
| An additional interface has no connectivity   | It is disabled or has an incorrect IP | Enable it and use DHCP Client, or configure a manual IP in L2 |
| You cannot access from the management network | Incorrect IP, port, or policy         | Check the IP, HTTPS port, and access policies                 |
| The logs show an incorrect time               | Time zone misconfigured               | Adjust the time zone in FireboxV                              |
| Traffic goes out, but does not come back      | Missing routes or rules               | Check routing and policies at both ends                       |
| WSM does not connect                          | Incorrect credentials, IP, or port    | Verify the username, password, address, and port              |

### Optional: register and license FireboxV

Registration is useful if you are migrating from a physical appliance or need services such as antivirus, IPS, web filtering, or reputation.

If you already have a physical Firebox:

1. Sign in to the WatchGuard portal with the partner or customer account.
2. Locate the registered physical device.
3. Follow WatchGuard's procedure to move or associate the license with the FireboxV.

Once the license is associated, download the **Feature Key** from the virtual device. Save it in the customer's internal repository.

In the FireboxV web interface, open the licensing section, paste the full Feature Key, and save the changes. The associated subscriptions will become available and you can review their expiration dates.

### Conclusion

The deployment consists of creating the VNF, assigning the appropriate networks, and completing the initial wizard.

Then, enable the additional interfaces and adjust their addressing. Register and license the device only when you need to migrate licenses or activate advanced services.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.plenit.com/docs-en/productos/servers/how-to/how-to-deploy-a-watchguard-fireboxv-in-the-cloud.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.