Barracuda WAF appliances block OWASP Top 10 attack categories including SQL injection, cross-site scripting, command injection, and remote file inclusion. They also stop automated bot traffic, volumetric and application-layer DDoS attacks, API abuse, malicious file uploads, and threats targeting JSON and REST APIs. The Adaptive Profiling engine builds a behavioral baseline for your application and flags requests that fall outside normal patterns, catching threats that static rule sets miss.

Hardware models (WAF 360 through WAF 1060) are physical 1U rackmount appliances for organizations with dedicated on-premises infrastructure. The Virtual WAF Vx series delivers the same protection as a software appliance running on VMware ESXi, Microsoft Hyper-V, or KVM. Both families offer identical OWASP protection, SSL offload, Adaptive Profiling, and bot mitigation. The choice comes down to whether you have physical rack space available or prefer a software-defined deployment inside your existing virtualization environment.

The primary sizing factors are peak throughput, the number of backend servers you need to protect, and your availability requirements. The WAF 360 and 460 fit small businesses protecting a few public-facing sites at 50 to 200 Mbps. The WAF 660 and 860 handle mid-market organizations with multiple apps or heavier API traffic at 1 to 5 Gbps, and the WAF 860 adds active-passive high availability. The WAF 960 and 1060 cover enterprise environments that need 10 Gbps or more and active-active HA. Call or chat with a Firewalls.com engineer and we will size the right model to your actual traffic numbers.

Yes. Every Barracuda WAF model performs SSL/TLS offload. The appliance decrypts HTTPS sessions at the perimeter, inspects the decrypted payload for threats, and re-encrypts before forwarding traffic to your backend servers. This closes the visibility gap that attackers rely on when hiding malicious payloads inside encrypted connections. SSL offload also reduces the processing burden on your application servers, which can improve response times under load.

Yes. Our Firewall Configuration Service covers initial setup, application policy creation, SSL certificate installation, and 7 calendar days of post-deployment support from a certified engineer. For ongoing management, FireGuard Managed Services assigns a U.S.-based certified engineer to handle firmware updates, rule changes, and 24/7 threat monitoring on the appliance you already own. Contact us before you purchase and we will recommend the right level of service for your environment.

An active Energize Updates subscription is required for new attack signatures, firmware releases, and vendor support access. Once the subscription expires, your appliance stops receiving updated threat definitions, leaving you exposed to attack patterns discovered after your last update. It also cuts off access to Barracuda technical support. Firewalls.com tracks renewal windows and quotes pricing before your coverage runs out so your protection stays current without manual follow-up on your end.

Yes, on qualifying models. The WAF 860 supports active-passive HA, which means a standby unit takes over automatically if the primary fails. The WAF 960 and 1060 support both active-passive and active-active HA configurations, letting both units share the traffic load during normal operation. Virtual WAF Vx appliances can be deployed in an HA pair within your hypervisor environment using the same mechanism.

Yes. Firewalls.com accepts POs, Net 30 terms, and tax-exempt purchases for corporate, education, and government buyers. Our team can quote hardware, Energize Updates subscriptions, and configuration services as a single line-item purchase. Call 317-225-4117 or submit the Request a Quote form and a certified engineer will reply within one business hour with pricing.