The M290 That Arrived Licensed But Not Activated
A 260-user company is replacing a Firebox T35 that runs a 3-year Total Security Suite expiring in 45 days. The reseller ships an M290 plus a feature key, and the invoice lists 'Total Security Suite, 3 yr' as a separate line item, no trade-up SKU mentioned. The admin claims the M290 in WatchGuard Cloud, pastes in the feature key, and powers it on. In WatchGuard Cloud the device shows online, but IPS, APT Blocker and WebBlocker are greyed out with 'Activation required', and a 30-day evaluation counter is still ticking down. The T35 is still inline as the production firewall. The IT manager asks whether the team can just run both firewalls in parallel until the T35 subscription lapses so nothing is lost.
1. Is the greyed-out service state a licensing fault or a configuration fault? Give the checks you would run, in order, and name the most likely root cause.
Read the worked answer
The continuing evaluation counter is the giveaway: no subscription is actually attached to this device, so this is a licensing/identity problem dressed up as a configuration problem.
Order of checks:
- Compare serial numbers. A feature key is bound to one serial. If the reseller pulled the key for a different unit (or a demo unit), the import can appear to succeed while nothing activates. Compare the serial on the M290's device page against the key record.
- Confirm management mode. A Cloud-managed Firebox draws entitlement from the WatchGuard Cloud subscription attached to the account/device, not from a locally imported key. If the device was claimed to the wrong account, or claimed but the subscription was applied to a different inventory entry, services stay locked. Check the subscription entry under the device in Cloud and the expiry date shown.
- Confirm suite level. Basic Security vs Total Security changes which services exist at all; a Basic key on a unit expected to run APT Blocker and WebBlocker will grey those out permanently, not temporarily.
- Only then look at configuration. Proxy/policy settings cannot activate a subscription.
Most likely root cause: the key was generated for the wrong serial or attached to the wrong Cloud inventory record, which is why the unit still shows evaluation days remaining. Resolve with the reseller before touching policy config.
2. The manager wants both firewalls running in parallel until the T35 expires. What actually happens at day 45, and what cutover sequence do you recommend?
Read the worked answer
Two separate entitlements are involved, and they do not merge.
- The T35's Total Security Suite is tied to the T35 serial and its own expiry date. It cannot be moved onto the M290, and having the M290 online does not extend it.
- At day 45 the T35 drops to whatever its base entitlement allows: the security services stop updating/enforcing and technical support lapses. The device keeps passing traffic, which is the dangerous part: the customer believes they are protected and is not.
- Running in parallel buys zero coverage. It only delays the cutover work into the week the old subscription dies, which is the worst possible time to discover a missing policy or a broken NAT rule on the new box.
Recommended sequence:
- Resolve the M290 key/serial problem first; verify all services show an expiry date rather than an evaluation countdown.
- Stage the M290 configuration off-line (imported config from the T35 where the hardware interfaces match, then fix interface naming, external IPs and any model-specific limits).
- Cut over with at least two weeks of margin before day 45, keeping the T35 powered off but racked as a cold spare with a known-good config export.
- If the customer truly needs a warm spare, that requires its own subscription on the T35 - confirm the cost rather than assuming the old suite covers it.
- Ask the reseller explicitly whether a trade-up SKU should have been used; trade-up pricing usually assumes the old unit is retired, and that affects what happens to the T35 at cutover.
3. Two admins, no on-premises management server, a mix of on-site and remote staff. Should this M290 be managed from WatchGuard Cloud or from the local Web UI, and what is the cost of changing your mind later?
Read the worked answer
Both are viable; the decision is about operational model, not features.
Choose WatchGuard Cloud if:
- Admins work remotely and want configuration, firmware and reporting in one place.
- The customer wants templates/multi-device consistency for future sites.
- Zero-touch provisioning matters for spares and replacements.
Choose local Web UI if:
- The customer's policy forbids outbound management channels from the firewall itself.
- Deep custom configuration is needed in areas where Cloud exposes a narrower surface than the local UI (verify feature by feature for the Fireware version in use - do not assume parity).
- The site has flaky internet and admins need in-band access that does not depend on the Cloud connection.
The cost of changing your mind: switching management mode is not a checkbox. It generally means removing the device from the Cloud account or re-claiming it, and re-establishing the configuration and any Cloud-only reporting history. Treat it as a migration with a maintenance window, not a toggle.
Pragmatic answer for this scenario: manage in Cloud, but always keep a local break-glass admin account in the Firebox database so a Cloud or internet outage does not lock the team out of the device.