From WatchGuard to OPNsense
WatchGuard Fireboxes are widespread among mid-sized companies. The protection features depend on security suites that are renewed annually, and management is increasingly moving into WatchGuard Cloud.
At a glance
- Source
- WatchGuard
- Target
- OPNsense Business Edition
- Cutover
- usually 1–2 hours
- Fallback
- until sign-off
Starting point
Why operators switch
A Firebox includes firewall, VPN and security services, bundled in Basic or Total Security suites. With every hardware generation and renewal, the cost question arises again.
Typical reasons
- annual suite licences for features that OPNsense provides at no extra cost
- management increasingly via the vendor cloud
- hardware replacement when licences or generations change
- preference for open code and a European vendor
Features
What becomes of your WatchGuard features
| WatchGuard | OPNsense | Note |
|---|---|---|
| Aliases, policies | Aliases, interface rules | logic is translated |
| SNAT, port forwarding | NAT | fully supported |
| Branch Office VPN | IPsec (IKEv2) | peers are coordinated |
| Mobile VPN (SSL, IKEv2) | WireGuard or OpenVPN with 2FA | new client profiles |
| IPS | Suricata IPS | ET Open, optional commercial |
| WebBlocker, Application Control | Zenarmor or proxy categories | policies are rebuilt |
| Gateway AntiVirus, APT Blocker | – | protection on endpoint and mail gateway |
| FireCluster | CARP cluster with state sync | maintenance without interruption |
| WatchGuard Cloud, Dimension | OPNcentral, API, syslog to SIEM | different concept, same goal |
| AuthPoint (MFA) | TOTP 2FA | authenticator app instead of vendor MFA |
Approach
How we migrate
Process
- Export of the Firebox configuration, analysis of policies
- Clean-up of unused policies and aliases
- Translation of policies, NAT and VPNs
- Rebuild of web and application filtering
- Cutover in a maintenance window, Firebox as fallback
- Follow-up support and documentation
What to watch out for
- Proxy policies: for each service we decide whether the packet filter, the proxy or Zenarmor is the right counterpart.
- Gateway AV and APT Blocker: we move this protection to the endpoint and mail gateway.
- AuthPoint: MFA is switched to TOTP.
The general process in five steps is described under Migrating to OPNsense.
FAQ
Questions about migrating from WatchGuard
Can we import the Firebox configuration?
No. We translate in a structured way and tidy up along the way.
What happens to Gateway AntiVirus?
Modern endpoint solutions and the mail gateway provide this protection better. The firewall concentrates on segmentation, IPS and access control.
Contact
Send us your configuration export
We will tell you what can be transferred directly, what cannot and what the migration will cost.