Security Services and Subscriptions
Service families
Know what each subscription does and where it acts:
- IPS - signature and anomaly-based intrusion prevention
- Gateway AntiVirus (GAV) - scans SMTP, POP3, HTTP, FTP, HTTPS (with deep inspection)
- APT Blocker - cloud sandbox for suspicious files
- IntelligentAV - machine-learning static file analysis
- WebBlocker - URL category filtering, exceptions per action
- spamBlocker - SMTP/POP3 spam scoring, tagging, quarantine
- Reputation Enabled Defense (RED) - cloud reputation score per URL/domain
- Application Control - recognises applications by signature regardless of port
- DNSWatch / DNS filtering - blocks malicious DNS resolution
- Data Loss Prevention, ThreatSync/TDR - content rules and endpoint-network correlation
Bundles
Basic Security Suite covers the core set (IPS, GAV, WebBlocker, spamBlocker, Application Control, RED); Total Security Suite adds advanced layers such as APT Blocker, IntelligentAV, DNSWatch, DLP and TDR. Exact bundles vary by model and region - confirm in the WatchGuard Portal rather than memorising lists.
Traps
The biggest one: a service is enabled in a proxy action, and that proxy action must be attached to the policy. Subscribing does not automatically protect traffic. HTTPS traffic escapes URL filtering, AV and application control unless deep inspection is on. An expired subscription disables enforcement without breaking connectivity.
Rule of thumb: for any policy, ask three questions - is it a proxy, does its proxy action have the service enabled, and does the subscription cover that service?