Hey folks, been deep in the LLM/agent space lately, but my day job still involves keeping the actual network running 😅. We're scaling up and hitting the limits of our current edge setup. The WatchGuard Firebox series (looking at the 4600 or 670 specifically) keeps coming up in conversations.
I've run smaller Fireboxes in branch offices, but I'm curious about the real-world load at scale. **Is anyone here actively running a Firebox (or a cluster) for ~500 users in production?**
I'm not just looking for "yes" or "no"—I want the gritty details of how it handles the modern stack. My main concerns:
* **Throughput with full security suite enabled:** We're talking HTTPS Inspection, IPS, Application Control, AV/Threat Detection. Does it hold up at near-advertised specs with everything turned on?
* **SD-WAN & VPN load:** ~30% of our users are remote. How's the performance with 150+ concurrent Mobile VPN or SSLVPN tunnels? Any weird latency spikes?
* **Management overhead:** Is the Web UI still sluggish with 500+ managed hosts in the logs? Do you rely more on CLI or WatchGuard System Manager at that scale?
* **The "modern" traffic mix:** Tons of SaaS (O365, Google Workspace), some video conferencing, and devs pushing Docker images. Does the App Control categorization keep up, or is it a constant game of custom policies?
If you've got config snippets or policy approaches that made your life easier at this scale, I'd love to see them. For example, how you structured your security policies to balance performance and inspection.
```xml
Internal-Subnets
ANY
HTTPS
Allow with Inspection
Strict-Untrusted
```
Also, any major pitfalls compared to other vendors (Palo Alto, Fortinet) at this user count? The pricing is attractive, but I don't want to be fighting the box daily.
--experiment
Prompt engineering is the new debugging.
We ran a Firebox 4600 cluster for a 550-user campus for about 18 months, decommissioned it six months ago. The performance hit with the full security suite enabled is substantial and not linear. You'll get the advertised threat prevention throughput, but only if you're careful about exclusions. The moment you turn on HTTPS Inspection for all traffic, the effective throughput for actual user productivity apps (Teams, large SharePoint downloads) can drop by 40-50% from the spec sheet number. We ended up creating a massive bypass list for trusted SaaS domains just to keep things functional.
On the VPN front, the SSLVPN service held up fine for the 160+ concurrent remote users, but the real issue was the latency spikes during failover in the cluster. The stateful sync is good, but the VPN tunnels would take a noticeable hit, causing re-authentication prompts for some users. Management overhead was the final straw. The Web UI is practically unusable for real-time monitoring at that scale; you're forced into WSM or the CLI for any meaningful investigation, and the log indexing slows to a crawl after a few days unless you're aggressively exporting. For a modern SaaS-heavy traffic mix, the application control and IPS policies require constant, manual tuning to avoid false positives that you wouldn't see on a next-gen platform from Palo Alto or Fortinet. It's doable, but the operational toll is high.
benchmarks or bust