Watchguard Firebox M4600 Reference guide

www.watchguard.com Page 1
How Modularity Works
Technical Brief
WatchGuard® Technologies, Inc.
Published: February 2016
INTRODUCTION
WatchGuard UTM (Unified Threat Management) appliances provide the protection that midsize
businesses and distributed enterprises need today to prevent infection from malware, ransomware, and
advanced threats. UTM capabilities provide the benefit of an all-in-one appliance with advanced security
controls, and WatchGuard Dimension, which ships standard on all WatchGuard appliances, provides
advanced threat visibility and network intelligence. But organizations need this protection from an
appliance that fits into their existing network. They cannot change network topology to fit their new
security appliance.
Network environments are getting more diverse with a vast array of options to choose from. Fiber is not
just found in the enterprise datacenter. Even small and midsize businesses have fiber connections from
their Internet Service Providers (ISPs), and switch equipment that provides 1 Gb or 10 Gb fiber.
WatchGuard’s Firebox M4600 and Firebox M5600 appliances both provide two empty bays that can be
used to add network modules to define a configuration that meet the needs of almost any network
configuration. There are three modular interface types to choose from, and they can be used in any
combination.
4 x 10 Gb Fiber
8 x 1 Gb Copper
8 x 1 Gb Fiber
Expandable network modules offer room to grow for the future. If the need for more network ports into
the firewall grows, the business doesn’t have to do a costly rip-and-replace. The network admin can
simply add a new module to the existing appliance to increase port density.

www.watchguard.com Page 2
How Does Modularity Work?
Figure 1: Optional modules to support the appropriate M4600 or M5600 configuration.
The image above is from the modular configuration tool on the WatchGuard website at
http://www.watchguard.com/wgrd-products/firebox-m4600-m5600/overview. This tool displays the
modules that are available for each appliance, and allows the user to interactively drag a module to an
empty bay to explore configuration options.
Note that the base configuration for an M4600 includes 8 x 1 G Ethernet ports. The maximum
throughput for that appliance is limited by the line speed of the network ports to a total of 8 Gbps.
Adding more ports with network modules unlocks the performance capacity of the appliance, allowing it
to achieve its maximum potential firewall throughput of 40 Gbps. Firewall throughput is measured using
1518 byte UDP packets through multiple port pairs.
The Firebox automatically detects installed interface modules when it is powered on. Interface modules
are not hot-swappable. To avoid damage to the system, admins need to power off the Firebox before
installing or removing interface modules.

www.watchguard.com Page 3
Modularity in the UI
The image below shows the default interface configuration for a Firebox M5600 appliance in the Web
UI. The Module column lists the port numbers for each modular interface. The letter indicates the
Firebox slot where the interface module is installed. The number indicates the port number as it is
labeled on the interface module. For example module A6 refers to port 6 on the interface module
installed in slot A.
Figure 2: This image shows the standard list of ports that correspond to slots A and B.

www.watchguard.com Page 4
Figure 3: This image shows how the list expands as a module is added to slot C.

www.watchguard.com Page 5
Network Interfaces on the Firebox M4600
The Firebox M4600 has eight built-in interfaces, and two interface module slots, A and B. You can install
an interface module in each slot. For each interface module, ports are numbered from 0–7 or 0–3.
Firebox M4600 Slot
Modular Interface Port Numbers
Interface Numbers
in Firebox Configuration
A
A0 –A7 (8 port)
A0 –A3 (4 port)
8 –15
8 –11
B
B0 –B7 (8 port)
B0 –B3 (4 port)
16 –23
16 –19
If any slot is empty, those interface numbers do not appear in the configuration, and the interface
numbers for other installed modular interfaces do not change.
Network Interfaces on the Firebox M5600
The Firebox M600 has one built-in interface, and four interface module slots, A, B, C, and D. Two
interface modules come preinstalled in slots A and B. For each interface module, ports are numbered
from 0–7 or 0–3.
Firebox M600 Slot
Modular Interface Port Numbers
Interface Numbers
in Firebox Configuration
A
A0 –A7 (8 port)
A0 –A3 (4 port)
8 –15
8 –11
B
B0 –B7 (8 port)
B0 –B3 (4 port)
16 –23
16 –19
C
C0 –C7 (8 port)
C0 –C3 (4 port)
16 –23
16 –19
D
D0 –D7 (8 port)
D0 –D3 (4 port)
24 –31
24 –27
If any slot is empty, those interface numbers do not appear in the configuration, and the interface
numbers for other installed modular interfaces do not change.

www.watchguard.com Page 6
Note about Transceivers
The M4600 and M5600 appliances do not include fiber transceivers. The 1 Gb ports support the SFP
standard, and the 10 Gb ports support the SFP+ standard. Transceivers and direct attach cables that
support these standards will work in the appliance. WatchGuard maintains a current hardware
compatibility list of transceivers that have been tested and confirmed to work with our appliances in our
Knowledge Base. That said, other off-the-shelf transceivers should work too.
Both Multi-Mode (Short Range, 1000Base-SX, 850nm) and Single-mode (1000Base-LX, 1310nm, up to
10km) are supported. Direct attach cables have also been tested and confirmed to work.
Product Information
WatchGuard SKUs for Network Modules
WatchGuard Firebox M 8 Port 1Gb Copper Module
WG8592
WatchGuard Firebox M 8 Port 1Gb SFP Fiber Module
WG8593
WatchGuard Firebox M 4 Port 10Gb SFP+ Fiber Module
WG8594
WatchGuard SKUs for Transceivers
Transceiver 1Gb Short-Range SFP for WatchGuard Firebox M
WG8585
Transceiver 10Gb Short-Range SFP+ for WatchGuard Firebox M
WG8583
ADDRESS:
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
WEB:
www.watchguard.com
NORTH AMERICA SALES:
+1.800.734.9905
INTERNATIONAL SALES:
+1.206.613.0895
ABOUT WATCHGUARD
WatchGuard® Technologies, Inc. is a global leader of integrated, multi-function business security
solutions that intelligently combine industry-standard hardware, best-in-class security features, and
policy-based management tools. WatchGuard provides easy-to-use, but enterprise-powerful
protection to hundreds of thousands of businesses worldwide. WatchGuard is headquartered in
Seattle, Wash. with offices throughout North America, Europe, Asia Pacific, and Latin America. To
learn more, visit WatchGuard.com.
No express or implied warranties are provided for herein. All specifications are subject to change and
any expected future products, features, or functionality will be provided on an if and when available
basis. ©2016 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo,
and WatchGuard Dimension are either registered trademarks or trademarks of WatchGuard
Technologies, Inc. in the United States and/or other countries. All other trademarks and tradenames
are the property of their respective owners. Part.No. WGCE66897_021916