How to Choose the Right Zenarmor Subscription Plan
Choosing the right Zenarmor subscription plan depends on your security requirements, deployment architecture, traffic volume, and whether you have a distributed network infrastructure with remote users and sites that need to be protected. This guide provides a practical and structured approach to help home users, IT professionals, and businesses select the most appropriate Zenarmor subscription.
Zenarmor subscription plans are organized into three main categories:
-
Personal Plans are designed for non-commercial home users, labs, and personal networks
-
Business NGFW Plans are designed for businesses needing next-generation firewall security
-
SSE / SASE Plans are built for organizations securing remote/hybrid/mobile users and distributed networks
Each subscription category offers different capabilities, deployment options, and support levels. The full and up-to-date plan options are available at: Plans and Pricing - Zenarmor.
Figure 1. Zenarmor Subscription Plans
Zenarmor Plan Categories Overview
Zenarmor provides three main subscription categories designed for different use cases and security requirements. Understanding the differences between these categories will help you determine which one matches your environment.
1. Personal Plans
Personal subscriptions are designed for home users, students, small labs, and individuals who want to secure and monitor their home or personal networks with enhanced visibility and web filtering.
Zenarmor offers two subscription options for personal or non-commercial use:
-
Free Plan: Provides essential network protection and basic visibility features for small home or lab environments. Perfect for users who need entry-level security without extra configuration.
-
Plug and Secure Home Plan: Designed for home users requiring stronger protection, advanced content control, and centralized visibility via Zenconsole. Recommended for families or individuals with multiple devices, including IoT systems.
Personal plans are intended for non-commercial use only.
2. Business NGFW Plans
Business NGFW (Next-Generation Firewall) plans are built for organizations that require professional-grade security, centralized policy management, and advanced filtering capabilities. They are suitable for on-premise deployments and dedicated firewall setups.
These plans are well-suited for corporate and branch office networks that require consistent security enforcement and unified management across multiple sites.
3. SSE / SASE Plans
This category covers three advanced security solutions designed to protect users and ensure secure connectivity across distributed environments. They are ideal for organizations needing comprehensive enterprise-grade security while adopting Zero Trust principles and enabling off-corporate-network (hybrid or remote work) securely.
-
Plug and Secure SSE: Provides always-on, on-the-go protection for web and application access with advanced threat protection.
-
Plug and Secure ZTPA: Adds fast and simple Zero Trust Private Access for secure connectivity to private apps and services
-
Plug and Secure SASE: Combines SSE and ZTPA for comprehensive Zero Trust and network security in a unified solution.
These plans are typically preferred by distributed enterprises that require secure remote access and cloud-based protection without traditional VPN dependencies.
For detailed plan comparisons and the latest pricing, visit the Zenarmor Plans & Pricing page.
| Plan Category | Recommended For | Description |
|---|---|---|
| Personal Plans | Home & lab users | Simple network protection with quick setup. |
| Business NGFW Plans | Offices & growing businesses | Scalable firewall security for expanding environments. |
| SSE / SASE Plans | Distributed teams & remote users | Unified cloud-based security and Zero Trust access. |
How to Decide Which Plan Is Right for You
Selecting the most suitable Zenarmor subscription plan requires aligning your security requirements with the right deployment and capacity strategy.
Follow the step-by-step guide below to determine which plan best fits your environment confidently.
Step 1. Identify Your Deployment Model: Decide how Zenarmor will be deployed within your network. Whether you’re securing a single gateway, multiple locations, or remote users, Zenarmor provides flexible options for all deployment types.
For details about specific features and plan differences, please visit the Zenarmor Plans & Pricing page.
Step 2. Determine Your Licensing Capacity: Estimate how much protection your deployment requires. This could be the number of gateways, users, or devices, depending on how Zenarmor is deployed in your environment.
This step ensures your subscription fully covers your network without limitations.
Always calculate based on peak usage, not average usage, to avoid exceeding license limits later.
Step 3: Compare Plans and Select the Right Option: Review the available Zenarmor plans to match your deployment model and capacity needs. Each plan offers different feature sets and protection levels designed for various use cases.
To see the full list of features and limits, visit the Zenarmor Plans & Pricing page.
Determining the Number of Devices via OPNsense GUI
To specify the number of devices on your network via OPNsense GUI, you may follow the next steps:
-
Navigate to the Zenarmor → Settings → Subscription on your OPNsense Web UI.
-
Find the Number of Active Devices which is used for licensing on Subscription Status pane. "Number of Active Devices" corresponds to the daily number of unique local IPv4 addresses on your network.
Figure 2. Number of Active Devices used for Subscription
"Number of Active Devices" will give you insight into the number of devices for which you should get help to decide the right subscription plan to select.
Determining the Number of Devices via Zenconsole
To find the number of devices on your network via Zenconsole, you may follow the next steps:
-
Open your browser and log in to Zenconsole with your username and password.
-
Navigate to Settings on the left-hand sidebar.
-
Click Gateway Settings to expand the dropdown menu. This will list all your configured gateways.
-
Under the Gateway Settings section, choose the gateway you want to inspect (e.g., Irvine01-FW)
-
From the list of gateway configuration options, click Subscription near the bottom.
-
Find the Number of Active Devices on the Status pane.
Figure 3. Number of Active Devices used for Subscription on Zenarmor Cloud Portal (Zenconsole)
Before Making a Final Decision
Zenarmor doesn’t block devices exceeding your licensed device count.
Exceeding the number of licensed devices by 10% does not pose a problem. If this threshold is exceeded, you will experience some performance losses. Please check the subscription plans to decide which plan meets your needs.
When you have an HA Cluster System and need automatic configuration synchronization, you must purchase a separate Business subscription plan for each node. The HA Pair subscription is priced at 50% of the primary subscription plan.
Any License activation key can only be used on one node at a time. After activation of a license key in the firewall, when you reactivate the same key on another node, the license on the first node will be deactivated and will start running the engine with the Free edition.
Before you decide on a subscription plan, take into account the highest number of devices you have observed on your OPNsense GUI or Zenconsole to cover all devices in the subscription plan.
You can find a related FAQ here.