WatchGuard Firebox M4850 review: Affordable high-performance enterprise network security

It's been a busy year for WatchGuard; along with a family of table-top Firebox appliances, it also launched a range of five rack-mount models. Not content to rest on its laurels, WatchGuard now delivers yet another new family of rack-mount appliances with a laser-sharp focus on high performance.

The range comprises three models, with the Firebox M4850 on review representing the entry point and targeting mid-sized businesses yearning for a major speed upgrade without being faced with complex enterprise level prices. All three appliances sport an Intel Granite Rapids-D HCC Xeon 6 SoC (system on chip), with the M4850 endowed with a 12-core model – the M5850 gets 20 cores while the top-dog M6850 receives 24 cores.

Add in 32GB of fast DDR5 memory, and you have some impressive performance claims. The M4850 boasts a high 66.5Gbps raw firewall throughput, 19.1Gbps for full UTM scans with antivirus (AV), the intrusion prevention service (IPS), and application controls all activated, and 8.8Gbps for full scan HTTPS content inspection.

The appliance offers a good range of high-speed network ports, and WatchGuard claims an industry first for a firewall platform. All three Fireboxes have an OCP 3.0 expansion slot with optional modules including a dual-port QSFP28 100GbE card.

WatchGuard Firebox M4850 review: Hardware features

The M4850 presents eight RJ45 Gigabit, four fibre Gigabit SFP, six fibre 10GbE SFP+, and a pair of 25GbE SFP28. The M5850 ups the 25GbE port count to four while the M6850 increases the 10GbE SFP+ port to ten and adds a pair of 100GbE QSFP28.

The rear OCP 3.0 port is the Gen5 x8 variety, and WatchGuard offers a good range of expansion options. Along with the dual 100GbE card, you can choose from quad 2.5GbE or 25GbE SFP28 modules.

Power is handled by dual 600W hot-plug PSUs while cooling is looked after by four (slightly noisy) hot-plug fan modules. An RJ45 port is provided for direct access to the appliance's CLI, with two USB ports available for system backups, restores and support diagnostics.

WatchGuard Firebox M4850 review: Subscription simplification

No need to worry about complex subscriptions and expensive optional add-ons, as WatchGuard offers only two subscriptions. All base Firebox models with a support contract come as standard with firewall, software-defined WAN (SD-WAN), and clientless VPN access portal services enabled.

Choose the Basic Security Suite (BSS) subscription, and you get gateway antivirus (GAV), web filtering, antispam, HTTPS inspection, IPS, application controls, network discovery, and WatchGuard's RED (reputation-enabled defence) cloud-based URL filtering. Moving up to the Total Security Suite (TSS) subscription enables every available security service, including the advanced persistent threat (APT) blocker with cloud sandboxing and ThreatSync XDR for collection, correlation and automated responses for threat events from all Fireboxes.

There's even more as TSS adds WatchGuard's DNSWatch service, which monitors client DNS requests and blocks them from accessing known malicious domains. The IntelligentAV anti-malware service augments the GAV with the Cylance AI-based engine scanning files such as Office documents, Windows portable executables, and PDFs.

You can manage the appliance in standalone mode, but both subscriptions include access to the WatchGuard Cloud portal with the latter extending log and report data retention to 1 year and 30 days respectively – features some other vendors charge extra for. TSS also enabled WatchGuard's Gold support, which provides 24/7 access to technicians, live calls for critical issues, a one-hour SLA for high-level issues, unlimited support cases and advanced hardware replacement.

WatchGuard Firebox M4850 review: Cloud management and Rai

Deploying the M4850 for cloud management is simple as we registered it with our WatchGuard support account and from the WatchGuard Cloud portal, allocated it to our site and chose the cloud management and monitoring option. A wizard helps with basic network configuration and all you need to do next is power the appliance up and leave it to connect to the cloud portal, after which it disables local management access.

The portal can remotely manage all compliant WatchGuard fireboxes, Wi-Fi access points, AuthPoint, EPDR, FireCloud and AI-powered ThreatSync + NDR services. A smart new feature is WatchGuard's Rai (Red AI), which correlates security feeds and telemetry from every cloud-managed product, regardless of their location, and presents a highly informative dashboard with AI-generated daily summaries of all activity.

Primarily aimed at MSPs, Rai is designed to cut through alert smokescreens and streamline problem resolution by automatically investigating and responding to security incidents. Rai impressed us during testing as we have three Fireboxes, EPDR and FireCloud running in the lab, and the dashboard told us everything we needed to know about their security posture, the number of incidents and all automated actions.

WatchGuard Firebox M4850 review: Security features

The M4850 makes the most of its port-fest as it defaults to mixed routing mode, allowing you to segment your network by configuring each port as separate interfaces, each with its own IP address and DHCP services, and designate them as external, trusted, optional, or custom. Other options are drop-in mode, which creates one logical network for all interfaces, and bridge mode if you want to place the appliance between an existing LAN and gateway.

The TSS subscription enables a wealth of security features, but the portal makes light work of configuration as all key services are presented in one page. From the content scanning section, you can enable both AV scanners, the APT blocker and spamBlocker for applying anti-spam policies to inbound SMTP, IMAP and POP3 traffic.

The network blocking section covers botnet detection, IPS, port and site blocks, detection of Tor (The Onion Router) exit points, and default packet handling. WatchGuard's WebBlocker and application control services are both accessed from the content filtering section, with the former offering 166 URL categories that can be allowed, blocked, or set to display a warning page to users.

App controls are equally impressive with nearly 1,300 predefined app and protocol signatures provided, and both services can be applied to a firewall rule by assigning a single action policy. VPN features are abundant with the M4850 supporting 5,000 branch offices and 10,000 mobile VPNs.

WatchGuard Firebox M4850 review: Is it worth it?

Yes. WatchGuard Online lists the Firebox M4850 with a 1-year TSS subscription for £22,610 excluding VAT, rising to £41,646 for a 3-year subscription. This compares very favourably with the competition in this space and WatchGuard's simplified licensing cuts through any subscription confusion.

The M4850 offers plenty of ports for your money with native 25GbE support and the OCP 3.0 expansion slot adding extra levels of flexibility and valuable future-proofing. The Intel Xeon 6 SoC delivers an impressive performance boost, security services are impeccable, and WatchGuard's Rai will appeal to busy MSPs.

WatchGuard Firebox M4850 specifications