Predictika · firewall appliance and security suite orders

An AI sales agent's firewall order, checked before it goes out

An AI sales agent prepares an order for Firebox T-series firewall appliances and a security suite: which model, how many VPN tunnels, mobile users and VLANs each site needs, and which security services the customer wants. Before the order goes out, the agent sends it to Predictika, which checks it against a declarative model of the published product data and returns a verdict and every reason.

Scope: Firebox T25, T45 and T85 appliances with the Standard Support, Basic, Prime and Total security suites: model limits and which services each suite includes. See everything this validator covers

This validator models the published limits and security suite contents of the Firebox T25, T45 and T85, not just the scenarios shown below.

  • Appliance limits — branch office VPN tunnels (10, 30, 60), mobile VPN users (10, 30, 60) and VLANs (10, 30, 75) for the T25, T45 and T85; the optional SFP+ or 4G/LTE module is listed only for the T85.
  • Sizing guidance — the users each model is listed as ideal for (5, 20, 50) and its rated full-scan UTM throughput (403, 557, 943 Mbps) and VPN throughput (300, 460, 680 Mbps); an order beyond these goes to a person for approval, because the figures are lab ratings.
  • Security suites — Standard Support, Basic, Prime and Total, each including the one before it: IPS, application control, WebBlocker, spamBlocker and Gateway AntiVirus from Basic; APT Blocker and DNSWatch from Prime; IntelligentAV, ThreatSync (XDR) and EDR Core in Total only. IntelligentAV and Access Portal are not available on the T25, and Shadow AI visibility is offered only on models launched after 2025, none of which is among these three.

Any T25, T45 or T85 order that touches these rules is in scope — not only the scenarios pictured here. Not covered: prices (none are shown), license terms, wireless, PoE and cellular variants of each model, the larger T-series and M-series rackmount models, FireboxV and Firebox Cloud, AuthPoint, Wi-Fi access points, and the Network Management and WatchGuard Cloud entitlements, which WatchGuard pages describe differently.

The AI sales agentBuilds the firewall order from the conversation and says it is ready to send.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

7 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI sales agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI sales agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where rules-based CPQ gets it wrong
Click to expand
    
Our assessment of what a typical rules-based CPQ (product rules, price rules and validation rules, as in Salesforce CPQ) does with the same cases. It is a judgment about effort and reliability, not a claim that nothing can be built.

    
What the validator caughtTypical rules-based CPQPredictika
Services that depend on the suite tierOnly with care
Each service is included from a certain suite up, so every optional service needs a rule that compares it with the chosen suite, and the table has to be kept current when WatchGuard repackages.		The wanted services and the chosen suite arrive together and every one is checked on every call.
A service that is missing on one modelOnly with workarounds
IntelligentAV and Access Portal are unavailable on the T25 only, so a model-specific exclusion has to be written for each service.		The model and each wanted service are checked together, and the reason names the model.
Limits that differ by modelOnly with care
Tunnel, mobile user and VLAN limits each step up by model; each needs its own table and its own message.		The limits come from one model table and every count is compared on every call.
Sizing that is a guideline, not a limitOnly with workarounds
Users and throughput ratings are lab figures, so exceeding them should be flagged for a person rather than blocked; a plain validation rule only blocks or passes.		Exceeding a rated figure routes the order to approval with the numbers in the message.
Every problem returned in one answerOnly with workarounds
Rules tend to fire as the order is saved or a step is completed, so a rep often fixes one error and meets the next.		All findings come back together, whatever order the options were added in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the quote; approval findings need a person to sign off; everything else is computed.

    
1The quote has 0 appliances; at least 1 is needed.
2The quote asks for security services that start with the Basic Security Suite (such as IPS, application control, WebBlocker, spamBlocker and Gateway AntiVirus), but the Standard Support suite does not include them.
3APT Blocker is included from the Prime Security Suite up; the selected suite does not include it.
4DNSWatch is included from the Prime Security Suite up; the selected suite does not include it.
5Shadow AI visibility is included from the Prime Security Suite up; the selected suite does not include it.
6Shadow AI visibility is offered only on models launched after 2,025 (the T115-W, T125, T145, T175, T185 and newer M-series models); the T25, T45 and T85 are not among them.
7IntelligentAV is included only in the Total Security Suite.
8IntelligentAV is not available on the Firebox T25.
9ThreatSync (XDR) is included only in the Total Security Suite.
10EDR Core is included only in the Total Security Suite.
11Access Portal is not available on the Firebox T25.
12The quote needs 11 branch office VPN tunnels; the selected model supports at most 10.
13The quote needs 31 mobile VPN users; the selected model supports at most 30.
14The quote needs 76 VLANs; the selected model supports at most 75.
15An optional SFP+ or 4G/LTE module is quoted, but the published comparison lists that option only for the Firebox T85.
16The quote is for 21 users; the model is listed as ideal for 20 users, so a person should confirm the sizing.
17The customer needs 558 Mbps of full-scan UTM throughput; the model is rated at 557 Mbps in lab conditions that vary with the environment, so a person should confirm the sizing.
18The customer needs 461 Mbps of VPN throughput; the model is rated at 460 Mbps (IMIX) in lab conditions that vary with the environment, so a person should confirm the sizing.
19The quote needs 12 branch office VPN tunnels; the selected model supports at most 10.
20The quote needs 25 mobile VPN users; the selected model supports at most 10.
21The quote needs 20 VLANs; the selected model supports at most 10.
22The quote is for 9 users; the model is listed as ideal for 5 users, so a person should confirm the sizing.
23The customer needs 350 Mbps of VPN throughput; the model is rated at 300 Mbps (IMIX) in lab conditions that vary with the environment, so a person should confirm the sizing.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Branch sites: Six store sites with 12 tunnels and 14 VLANs each

    
The agent's request. Please quote 6 Firebox T25 appliances with the Basic Security Suite. Each site has 4 users, 12 branch office VPN tunnels, 8 mobile VPN users and 14 VLANs, and needs 350 Mbps of full-scan UTM throughput and 250 Mbps of VPN throughput. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Too many branch office VPN tunnels. The quote needs 12 branch office VPN tunnels; the selected model supports at most 10.
    • 
      
  • Too many VLANs. The quote needs 14 VLANs; the selected model supports at most 10.
    • 
    

    
2. Branch sites: The agent resubmits after fixing the errors

    
The agent's request. Please quote 6 Firebox T45 appliances with the Basic Security Suite. Each site has 4 users, 12 branch office VPN tunnels, 8 mobile VPN users and 14 VLANs, and needs 350 Mbps of full-scan UTM throughput and 250 Mbps of VPN throughput. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 6 appliance(s), each rated for 30 branch office VPN tunnels, 30 mobile VPN users and 30 VLANs.
    • 
    

    
3. Advanced security services: Four regional offices that want advanced services

    
The agent's request. Please quote 4 Firebox T85 appliances with the Basic Security Suite. Each site has 45 users, 40 branch office VPN tunnels, 50 mobile VPN users and 60 VLANs, and needs 800 Mbps of full-scan UTM throughput and 600 Mbps of VPN throughput. Include APT Blocker, DNSWatch, Shadow AI visibility. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • APT Blocker not in the suite. APT Blocker is included from the Prime Security Suite up; the selected suite does not include it.
    • 
      
  • DNSWatch not in the suite. DNSWatch is included from the Prime Security Suite up; the selected suite does not include it.
    • 
      
  • Shadow AI not in the suite. Shadow AI visibility is included from the Prime Security Suite up; the selected suite does not include it.
    • 
      
  • Shadow AI not on this model. Shadow AI visibility is offered only on models launched after 2,025 (the T115-W, T125, T145, T175, T185 and newer M-series models); the T25, T45 and T85 are not among them.
    • 
    

    
4. Advanced security services: The agent resubmits after fixing the errors

    
The agent's request. Please quote 4 Firebox T85 appliances with the Prime Security Suite. Each site has 45 users, 40 branch office VPN tunnels, 50 mobile VPN users and 60 VLANs, and needs 800 Mbps of full-scan UTM throughput and 600 Mbps of VPN throughput. Include APT Blocker, DNSWatch. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 4 appliance(s), each rated for 60 branch office VPN tunnels, 60 mobile VPN users and 75 VLANs.
    • 
    

    
5. Clinic network: Three clinics on the Total suite

    
The agent's request. Please quote 3 Firebox T25 appliances with the Total Security Suite. Each site has 5 users, 8 branch office VPN tunnels, 40 mobile VPN users and 8 VLANs, and needs 350 Mbps of full-scan UTM throughput and 250 Mbps of VPN throughput. Include IntelligentAV, Access Portal, ThreatSync. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • IntelligentAV not on the T25. IntelligentAV is not available on the Firebox T25.
    • 
      
  • Access Portal not on the T25. Access Portal is not available on the Firebox T25.
    • 
      
  • Too many mobile VPN users. The quote needs 40 mobile VPN users; the selected model supports at most 10.
    • 
    

    
6. Clinic network: The agent resubmits after fixing the errors

    
The agent's request. Please quote 3 Firebox T45 appliances with the Total Security Suite. Each site has 18 users, 8 branch office VPN tunnels, 40 mobile VPN users and 8 VLANs, and needs 350 Mbps of full-scan UTM throughput and 250 Mbps of VPN throughput. Include IntelligentAV, Access Portal, ThreatSync. It is ready to send.

    
Verdict: Blocked.

    
    
      
  • Too many mobile VPN users. The quote needs 40 mobile VPN users; the selected model supports at most 30.
    • 
    

    
7. Clinic network: The agent resubmits after fixing the errors

    
The agent's request. Please quote 3 Firebox T85 appliances with the Total Security Suite. Each site has 18 users, 8 branch office VPN tunnels, 40 mobile VPN users and 8 VLANs, and needs 350 Mbps of full-scan UTM throughput and 250 Mbps of VPN throughput. Include IntelligentAV, Access Portal, ThreatSync. It is ready to send.

    
Verdict: Allowed.

    
    
      
  • Order summary. 3 appliance(s), each rated for 60 branch office VPN tunnels, 60 mobile VPN users and 75 VLANs.
    • 
    

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. An AI sales agent prepares an order for Firebox T-series firewall appliances and a security suite: which model, how many VPN tunnels, mobile users and VLANs each site needs, and more. Before the order goes out, the agent sends it to Predictika, which checks it against a declarative model of the published product data and returns a verdict and every reason.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please quote 4 Firebox T85 appliances with the Basic Security Suite. Each site has 45 users, 40 branch office VPN tunnels, 50 mobile VPN users and 60 VLANs, and needs 800 Mbps of full-scan UTM throughput and 600 Mbps of VPN throughput. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with four findings, all in one answer. APT Blocker is included from the Prime Security Suite up; the selected suite does not include it. DNSWatch is included from the Prime Security Suite up; the selected suite does not include it. Shadow AI visibility is included from the Prime Security Suite up; the selected suite does not include it. The other one is on screen.
    6. 
      
  6. The validator returned four blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the quote are checked against each other.
    7. 
      
  7. What this shows: for services that depend on the suite tier, a rules-based CPQ is error-prone for this.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the security suite to prime and the Shadow AI visibility to no.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All four earlier findings are cleared.
    13. 
      
  13. Four problems caught in one call, fixed in one pass, and a clean quote. That is the value of Predictika's validator: catching mistakes before they reach the customer. Now you can try the other scenarios yourself.
    14.