Ask SecureGuard a question. Answers come from this site's docs only. I will cite a page. I will not invent a product claim.
Platform
One document. Everything else is output.
SecureGuard does not rewrite the firewall, the routing daemon, the IKE daemon or the IPS — those are best-in-class already. The product is the orchestration layer above them: a single canonical, object-based, zone-aware configuration, and an engine that turns it into each daemon's native config atomically.
The canonical document
What one config file has to cover
These are the top-level sections of the document itself. A perimeter device that manages tunnels but not the routes through them, or rules but not the NAT in front of them, pushes the coherence problem onto you. Keeping all of it in one validated document is what lets the engine refuse an incoherent change before it reaches a daemon.
Validation is referential, not cosmetic: a rule cannot name a zone that does not exist, a nameserver must be an address rather than a hostname the box cannot yet resolve, and an HA commit is rejected if the peer's interface topology differs.
config document · top-level sections
systeminterfaceszonesobjectsfirewallnatroutingvpnservicesclusterloggingqosthreat_feedssecurity_exclusionsidentitymanagementadminai_securitydynamic_dnsclient_vpnauthenticationalertingretentionlicensingsnmpaws_vpcmetricsflow_exportacmecloud_vpncloud_backupreverse_proxyExport is not a feature. A revision is a readable JSON document, so exporting for review, diffing two states and restoring from backup are the same operation.
Commit
A change that severs your session puts itself back
Editing a firewall remotely is the one administrative act that can lock you out of the thing you are editing. So a commit may arm a confirm window: configd applies the change and starts an auto-revert timer, and unless a matching confirm arrives it re-applies the previous revision. The revert runs under the same single-writer lock as any commit, so it cannot race one.
Nothing is configured directly. Every config state is an immutable, content-addressed snapshot with a parent pointer, so backup is a copy, export is a readable JSON document, and rollback is an id. HA config sync ships those revisions between nodes on a Business+ cluster.
Rollback is an id
Every state is an immutable snapshot addressed by the hash of its canonical JSON, with a parent pointer and an author. Re-applying an earlier one is the whole of rollback.
Logs, per service, live
Each daemon streams into one pipeline with a bounded ring buffer, so the console can show recent context instantly and then tail. Filter a live pf view down to one rule's label.
Nothing is hidden from you
The rendered artifacts, the audit log, a terminal and a support bundle are all in the console. This is a closed-source product that does not expect you to take its word for what it did.
The console
What the management UI actually contains
A PAN-OS-style shell: primary groups across the top, a section list down the side, and one content column. Nothing in it is a hand-typed address, port, interface or zone — every such field picks from the object catalog.
| Group | Screens |
|---|---|
| Dashboard | Overview |
| Network | Interfaces · Zones · Routing · DNS · Dynamic DNS · DHCP · QoS |
| Policy | Firewall Rules · NAT · Objects |
| Security | Flow Monitor · Web Traffic · Reports · Web Filter · Reverse Proxy · AI Insights · Threat Feeds · DoS Protection · Exclusions |
| VPN | IPSec · WireGuard · Amazon VPC · Cloud VPN · Client VPN · SiteLink · Tailscale · Rubix Link |
| System | Health · Performance · Network Health · Settings · Authentication · Certificates · SNMP · Secrets · Services · Alerting · Data & Logs · HA Cluster · Logs · Audit Log · Terminal · Support · License · Configuration · Backup / Restore · Upgrades |
Availability
Two boxes that are the same system
HA is one system-wide toggle and a dedicated port. Both nodes hold byte-identical config — the only thing that differs is which box is node 1, and that is a local fact kept out of the synced document on purpose.
Failover is layer-2 MAC/IP takeover, the Astaro/Sophos model rather than CARP: one cluster IP and one cluster MAC per data segment, held up by whichever node is active. No virtual routers, no VHIDs, no advskew, and because the MAC never changes, neighbor ARP caches do not even churn. pfsync mirrors connection state, so sessions survive the cutover.
Promotion is deliberately conservative — the same MAC on two switch ports is a fault, so a node promotes only when the peer has been absent for the hold time and it holds the HA link.
Status. HA is tested and shipping on Business+: dedicated HA port, layer-2 MAC/IP takeover, config sync and pf state sync. HA.
Mirrored hardware, enforced
A pre-commit consistency gate rejects a commit whose interface topology differs from the peer, rather than letting you discover it at failover.
Virtual deployments: MAC takeover means the hypervisor must allow it — MAC address changes and forged transmits on VMware/ESXi, MAC spoofing on Hyper-V. Without those, the takeover frames are dropped by the vSwitch. Details →
Build status
What ships today
An item ships when it runs, not when it is designed.
Shipping
Canonical config model + validation gate
Every section listed above, with referential-integrity checks across the whole document. A config that does not validate is never rendered or applied.
Shipping
Commit pipeline and revisions
Validate → render → apply, atomically, with an optional confirmed-commit window that auto-reverts under the single-writer lock. Content-addressed revision store with parent pointers.
Shipping
Renderers, with golden tests
pf, rc.conf (interfaces/pfsync), FRR, strongSwan, Kea, Unbound, Suricata, QoS/dummynet, WireGuard, client VPN, SiteLink and SNMP.
Shipping
Management API and web console
configd’s local control API, apid over it with admin auth, RBAC and audit, and a PAN-OS-style console covering the navigation above.
Shipping
HA cluster
Active/passive, tested. One dedicated HA port, layer-2 MAC/IP takeover, config sync and pf state sync. Business+ license.
Shipping
TLS inspection
Squid ssl-bump with an on-box intercept CA. pf redirects :443 only; QUIC is dropped. Zone-scoped, with banking, health, and government splice so those sessions are not decrypted.
Shipping
Threat-intel fetcher
feedd pulls IP EDLs into pf tables, plus GeoIP and classify-only feeds. Priority updates and threat feeds are a Home+ license.
Shipping
Web Filter, Safe Search, DoH block
Hostname, SNI and DNS filtering without decrypt. Path and file-type rules need TLS inspection, which is shipping.
Shipping
Application match on firewall rules
Match by DNS NXDOMAIN and TLS SNI, and by Squid when decrypt is on. Hostname and SNI matching — not full protocol decode.
Shipping
Flow telemetry and the AI scoring engine
flowd collects pf state, pflog and Suricata EVE; aid fuses the confidence signals and enforces the graduated response with its guardrails and safe defaults. Observe and suggest ship on every tier.
Shipping
Model routing
Named providers (a private OpenWebUI, a frontier API, or both) with per-purpose roles for triage, deep analysis and summarization.
Shipping
On-box license verification
Ed25519 signature check against an embedded vendor key, node binding, tier-derived features, and graceful degradation on expiry.
Shipping
FreeBSD image build
A 6 GB ZFS-on-root appliance image plus a signed-capable system image, verified producing artifacts on a FreeBSD 14.3 builder.
Coming soon
Coming soon
- Application control — Named applications, not only hostname, SNI, and DNS.
- Anti-spam — Not on the appliance today.
- Identity in policy — User or group as a traffic match. Directory login on Business+ already ships; this does not.
- Off-box analysis — Behavioral models beyond on-box propose/commit.
- Orchestrator / fleet hub — Free Linux download today (firewalls dial out; hub never dials in). Not a Business license feature and not a paid CM SKU.
- Endpoint email-alert ingest — Orchestrator will capture AI-summarized alerts from any endpoint protection email stream. Coming soon. Not shipping.
Not App-ID. Not AntiSpam.
Deploying at the edge of something that matters? Tell us the shape of the network and we will tell you plainly whether today's build fits it.
Install on hardware or a VM you can rebuild
The image is ZFS-on-root and takes the whole disk — pick a host you can wipe. Community is the same image as every other tier. Request an activation code, install, and hand the appliance the node ID it shows you.