License Components (SKUs)

Overview

Every firewall unit, cloud VM and microsegmentation workload requires a license. When you issue the purchase order to Tufin, you will receive a license file containing an SKU for each license purchase. If you add additional firewall units or devices to your network, you can purchase additional licenses as needed.

SKUs by tier and type:

 

SecureTrack+

SecureChange+

Enterprise
Firewall unit TS-SECTRK-PLUS-FW-UNIT TS-SCWF-PLUS-FW-UNIT TS-ENTPRS-FW-UNIT
Cloud VM TS-SECTRK-PLUS-CLOUD-VM TS-SCWF-PLUS-CLOUD-VM TS-ENTPRS-CLOUD-VM

Microsegmentation workload

TS-SECTRK-PLUS-MICROSEG-WORKLOAD

TS-SCWF-PLUS-MICROSEG-WORKLOAD

TS-ENTPRS-MICROSEG-WORKLOAD

What is a firewall unit?

One firewall unit license lets you monitor any of the following:

  • Single physical or virtual firewall

  • Single physical or virtual active/standby firewall cluster

  • A Cisco ACI leaf

  • Blue Coat ProxySG

  • Azure Firewall

  • 4-pack of VMware-licensed NSX CPUs (counted according to VMware's licensing policy)

  • 5-pack of Meraki networks (regardless of the number of firewalls deployed in each network)

  • 10-pack of F5 BIG-IP LTM instances or partitions

  • 1000-pack of Zscaler users

  • 20 routers/switches (first 5000 routers/switches at no cost)

  • 20 SecureApp applications

  • 300-pack of Prisma Access users

  • Versa Networks edge devices (5-pack)

  • HPE CX10000 VRF with policy

  • HPE Aruba EdgeConnect (formerly Silver Peak) edge devices (5-pack)

  • Arista VeloCloud edge devices (5-pack)

  • Versa Networks edge devices (5-pack)

  • HPE Aruba EdgeConnect devices (5-pack)

Examples:

  • Five VMware-licensed NSX CPUs require the purchase of two firewall units.

  • 80 Zscaler users require the purchase off one firewall unit.

  • 508 Meraki networks require the purchase of 102 firewall units.

Devices that manage firewalls do not require a license.

What is a cloud VM?

One cloud VM license lets you monitor a single virtual machine (instance) deployed on a public cloud platform, for example an AWS EC2 instance or Azure/GCP virtual machine. Licenses can be purchased in packs of 100.

Example:

  • 320 VMs/instances require the purchase of 400 cloud VM units.

What is a microsegmentation workload?

A microsegmentation Workload is any a protected server or endpoint with an agent installed. One microsegmentation workload license lets you monitor one server or up to five endpoints. Licenses can be purchased in blocks of 100.

Examples:

  • 1850 Guardicore servers require the purchase of 1900 microsegmentation workload licenses.

  • 180 Guardicore servers + 22 endpoints require the purchase of 200 microsegmentation workload licenses.

Tiers and items included

Up to 5,000 routers/switches per customer are included without additional cost. Additional packs of 20 routers/switches can be purchased, each pack counting as one firewall unit.

The Enterprise tier includes up to 500 SecureApp applications per customer. Additional packs of 20 application can be purchased, each pack counting as one firewall unit.

If you are transitioning from a Tufin legacy licensing model to a solution tier you may be entitled to a heritage SKU prior to purchasing one of Tufin's solutions. For more information, contact Tufin Sales Support.

For details of Tufin's solution tiers, see Solution Tiers.

For more information on solutions and pricing, contact your Tufin partner or email [email protected].