In short
WatchGuard SASE is FireCloud plus Firebox. FireCloud Total Access combines firewall as a service, a secure web gateway and ZTNA behind one agent, managed in WatchGuard Cloud and licensed per user; Firebox appliances protect offices and provide SD-WAN. Forever Systems can quote and set up both for UK organisations.
Get a quote for WatchGuard SASE
Tell us roughly how many users or sites you have and we will come back to you with options and a quote.
What is WatchGuard SASE?
WatchGuard lists SASE in its product range and describes FireCloud Total Access (opens in a new tab) as a "hybrid secure access service edge (SASE)" service, available since 25 September 2025. The hybrid part is the split of roles:
| Part | What it covers |
|---|---|
| FireCloud | Remote and hybrid users: firewall as a service, secure web gateway and, on Total Access, ZTNA, through a single agent |
| Firebox | Offices, branches and on-premises networks: next-generation firewall and SD-WAN |
| WatchGuard Cloud | One console for FireCloud policy and visibility, shared with WatchGuard's other cloud-managed products |
WatchGuard says FireCloud Total Access integrates with AuthPoint (MFA and SSO), ThreatSync (XDR) and WatchGuard Endpoint Security, linking identity, endpoints and network. Sources: WatchGuard FireCloud Total Access (opens in a new tab) and WatchGuard's announcement (opens in a new tab), checked 9 November 2026. The FireCloud product itself is covered in depth on WatchGuard FireCloud (opens in a new tab).
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
FireCloud Internet Access, Total Access and the Zero Trust Bundle
| Tier | What WatchGuard lists |
|---|---|
| Internet Access | Secure web gateway with threat blocking and user-based firewalling, managed in WatchGuard Cloud; no private app access |
| Total Access | Unified web protection, an integrated per-user firewall, application-level ZTNA, full VPN replacement and secure private app access |
| Zero Trust Bundle | Adds correlation with identity and endpoint risk, so web, firewall and ZTNA policy take device and identity trust into account |
WatchGuard says FireCloud "replaces network-level VPN access with application-level Zero Trust" and hides internal applications from the internet. For most organisations replacing a remote access VPN, Total Access is the starting point. How ZTNA works in general is on ztna.org.uk (opens in a new tab).
Firebox SD-WAN at the branch
The network half of WatchGuard SASE is the Firebox. WatchGuard's SD-WAN documentation (opens in a new tab) describes SD-WAN as a routing feature that spreads traffic across several WAN connections:
- Mixed links, including broadband, leased lines (opens in a new tab) and MPLS, in one configuration
- Routing decisions based on loss, latency and jitter measured by Link Monitor probes
- Failover, or round robin across healthy links on current Fireware versions
Firebox models for offices are on our hardware store under WatchGuard (opens in a new tab). Together, Firebox at sites and FireCloud for users give a single-vendor route under WatchGuard Cloud; see single vendor SASE for the trade-offs.
Is WatchGuard SASE the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How WatchGuard SASE is licensed
WatchGuard licenses FireCloud Total Access per user. Firebox appliances are bought for each site with their security subscriptions. Licensing detail, without prices, is on WatchGuard FireCloud licensing (opens in a new tab). Subscriptions can be billed monthly, terms confirmed at quote; ask us for a quote.
Who WatchGuard SASE suits
| Your situation | Why it fits |
|---|---|
| Already running Firebox at your offices | Add FireCloud for remote users under the same WatchGuard Cloud console |
| Remote access VPN due for replacement | Total Access provides application-level ZTNA and web protection behind one agent |
| Using AuthPoint or WatchGuard Endpoint Security | FireCloud integrates with both for identity and device context |
| Small IT team, several sites | One vendor for site firewalls, SD-WAN and remote user security |
Other platforms are compared on SASE vendors, including Sophos SASE and Barracuda SecureEdge.
What Forever Systems does
Forever Systems can quote and set up WatchGuard SASE. We can assess your Firebox estate, WAN links and remote access, choose the FireCloud tier, pilot it with one team and then move everyone off the VPN, with support scope confirmed at quote. Contact us to talk it through.
How Forever Systems helps with SASE
Forever Systems supplies several SASE and Security Service Edge (SSE) platforms, so we can recommend the one that fits your sites, your people and the network and security kit you already run.
- Assess first: we look at your current VPN, firewalls, WAN links and identity set-up, and the applications people need to reach
- Help you choose: single-vendor or dual-vendor SASE, or Security Service Edge (SSE) first and SD-WAN later, matched to what you need now
- Pilots and phased roll-out: we can help you start with one group of users or one site, then extend policy step by step
- Licensing in one place: subscriptions can be billed monthly, with terms confirmed at quote
We work with businesses, schools, charities and public sector organisations. Pricing depends on users, sites, components and term, so ask us for a quote.
Frequently asked questions
Does WatchGuard offer SASE?
Yes. WatchGuard describes FireCloud Total Access as a hybrid SASE service, combining firewall as a service, a secure web gateway and ZTNA, with Firebox appliances protecting offices.
What is the difference between FireCloud Internet Access and Total Access?
Internet Access provides web protection and user-based firewalling. Total Access adds application-level ZTNA, VPN replacement and secure access to private applications.
Do we need a Firebox to use FireCloud?
Not for remote users: FireCloud is cloud-delivered through an agent. Firebox appliances protect offices and provide SD-WAN, so many organisations use both.
How is WatchGuard FireCloud licensed?
Per user. Firebox appliances and their subscriptions are licensed per site. Terms are confirmed at quote.
Is WatchGuard SASE managed in one console?
FireCloud is managed in WatchGuard Cloud, which WatchGuard also uses for its other cloud-managed security products.
Still have a question about WatchGuard SASE?
Ask us and a member of our team will get back to you.
More SASE guides
Sophos SASESophos Workspace Protection: browser, ZTNA and DNS protection for endpoints.Barracuda SecureEdgeBarracuda SecureEdge: Secure SD-WAN, zero trust access, firewall as a service and web security in one SASE platform.