While we strive to provide accurate and helpful responses, AI-generated content may not always be accurate, complete, or up-to-date, and it is not a substitute for human judgment. Always verify important information before taking any action.

Firewalla AI Assistant (Ask AI) – the latest smart assistant built right into your Firewalla.

Whether you need help understanding an alarm, learning about unknown domains, or identifying unknown devices, this new AI-powered feature simplifies your experience and helps you decide how to control and protect your network.

• Available on Firewalla Gold, Purple, and Orange series boxes.
• Firewalla AI Assistant will remain in beta as we continue to refine and improve it.

Disclaimer:

• Firewalla AI Assistant is optional. It is off by default and only runs when you choose to use it. It does not stay active in the background. 
• To hide the Firewalla AI feature, you can toggle it off under Protect from your box's main screen.
• Personal or sensitive information is never sent to the cloud or used for AI model training.
• Firewalla AI is free to use. No subscription required.

• How do I use Firewalla AI Assistant?
• Rate Limiting: Shared Token Pool System
• FAQs

How do I use Firewalla AI Assistant?

• Get insights into alarms
• Learn about unknown domains
• Identify devices
• Understand network performance and events
• Firewalla MSP - Firewalla AI Assistant
  • Search Flows with Firewalla AI
  • AI-powered MSP Active Protect

More cool features will come in the future.

Get insights into alarms

Firewalla AI Assistant can help you understand more about your alarms. If you ever receive an alarm that you don’t understand (e.g., an Abnormal Upload alarm to an unknown domain), you can "ask AI" to explain it to you. 

Ask AI is available for these alarm types:

• Security Activity Alarms (excluding SSH Password Guessing and Port Scan)
• Abnormal Upload
• Large Upload
• Gaming Activity
• Video Activity
• Porn Activity
• New Device

For Security Activity, Abnormal Upload, and Large Upload Alarms, Firewalla AI can also better analyze and query destinations, explain what the site is, and why the access may have been flagged in the first place.

To ask AI about an alarm on the Firewalla App:

• Navigate to the Alarms page from the box’s main screen.
• Tap the AI button on an alarm from the list.
• Or, tap on an alarm to go to its details > tap Ask AI about this alarm. 

Learn about unknown domains

Firewalla AI Assistant can help you look up unknown domains that your devices may access. If you ever see a network flow to or from an unfamiliar domain, simply ask AI to look into it.

Ask AI will be available for:

• Network Flows, including Top Upload and Top Download Destinations
• Blocked Flows, including Top Blocked Destinations

From your flow history:

• Go to your network or blocked flows.
• On the History or Blocked Flows tab > select a flow > tap Ask AI about this domain

Or, for top domains:

• Go to your network or blocked flows.
• Tap the Upload or Download tab for network flows or the Top Blocked tab for blocked flows.
• Select a Top Destination, then tap Ask AI about this domain.

Identify devices

Firewalla AI Assistant can help you identify unknown devices that join your network. Ask AI to look into any device to understand what kind of device it could be and who it may belong to. 

Firewalla AI is available for all devices. To ask AI about devices:

• Go to any Device detail page.
• Scroll down > tap Ask AI about this device.

Understand network performance and events

Firewalla AI Assistant can help analyze your recent Network Events and suggest some troubleshooting steps you can try. 

To ask AI about Events:

1. Tap on the Network Performance section from your main screen.
2. Tap AI in the summary section.
3. Alternatively, tap on Recent Events > Ask AI about the events.

Firewalla MSP - Firewalla AI Assistant

Firewalla AI Assistant is also available directly from the MSP portal to support your web-based workflows.

• Available for all boxes managed by MSP (including Blue Plus).
• Activates only when used, with no background processing.
• No personal data is sent to the cloud or used for training.

On the MSP Interface, Ask AI is currently available for:

• Abnormal Upload, Large Upload, Gaming Activity, Video Activity, Porn Activity, and New Device alarm.
• Domains in network flows, reports, and the main dashboard.
• Devices in the devices list.
• Network Events and Network Performance.

Search Flows with Firewalla AI

Search flows using Firewalla AI. Just type naturally, and Firewalla AI will automatically generate the correct search syntax for you.

Type your query in the Flows Search Bar, then click the Firewalla AI button, or click the gradient-colored text that appears below your search (Shortcut: press Enter after typing in natural language.) 

For example, you could ask AI to check for "gaming on my laptop" or "all Reddit traffic since August."

AI-powered MSP Active Protect

In MSP 2.10.2, MSP Active Protect uses Firewalla AI to further reduce false positives, improve behavioral alarms, and identify suspicious connections more easily. With extended data visibility, Firewalla AI delivers better risk evaluation and smarter suggestions. 

Once fully enabled, Firewalla AI will actively analyze all Security Activity and Abnormal Upload alarms, evaluate risk, and identify suspicious connections.

Learn more about MSP Active Protect here.

Rate Limiting: Shared Token Pool System

Running AI models, especially large ones, requires significant computing power. Each question you ask is processed by powerful servers using specialized hardware (like GPUs), which consumes much energy and costs money.

To make Firewalla AI access fair and efficient, we use a shared token pool across all users. 

What is a token?

• A token is a small piece of text that AI uses to understand your question and generate a response.
• For example, the sentence “How’s the weather today?” uses around 6 tokens. Longer messages use more tokens.

How the shared pool works

• All users draw from the same pool of tokens. (Firewalla pre-pays this pool of tokens)
• Each Firewalla AI question and answer uses tokens from this pool.
• When the pool runs low, new Firewalla AI requests will first reduce the output token count. (Answers will be shortened by 30-70%.)
• If the pool reduces further, you’ll see a message saying Firewalla AI access is unavailable — just try again a bit later. 
• The shared limit refreshes hourly.

Special handling for Firewalla MSP users (TBD)

• Firewalla MSP users can access an additional reserve pool via their shared container during high-demand times. 
   

FAQs

• Is the Firewalla AI Assistant free?
• Can I turn off the Firewalla AI assistant?
• How does Firewalla AI Assistant use my data? 
• How does AI process user requests?

Is the Firewalla AI Assistant free?

The infrastructure needed for Firewalla AI is extremely expensive to operate. We will do our best to pay for a shared pool of tokens for all users.

Can I turn off the Firewalla AI assistant?

Yes. From your box’s main screen, tap on the Protect icon and turn off Firewalla AI.

• Even if Firewalla AI is on, nothing will be sent to the cloud unless you "ask" (using the feature actively). 

To turn off Firewalla AI in MSP, click Protect on the left navigation panel and disable Firewalla AI.

How does Firewalla AI Assistant use my data? 

Firewalla AI Assistant runs in the AWS (or Google) cloud. The LLM (model) is too large to run on a standard consumer PC, MAC, or Linux device. 

• Private Data: Personal or sensitive information — including personally identifiable information (PII), financial, or medical data — is never used for AI model training.
• Non-Private Data: We may use anonymized, non-sensitive, or aggregated usage data to improve generative AI models. Any improvements made using this data are exclusively retained within Firewalla and are never shared externally (for example, when you vote "thumbs up" or "thumbs down" on a Firewalla AI response, we will use that to tune the model).

We use multiple LLMs from AWS and Google, combined with our intelligence data.

• This includes data such as which sites are considered good or bad, site category (like porn), common device profiles, etc.
• It does not include customer data.

AI in Alarm Actions for Firewalla MSP and Firewalla App

For Firewalla to process alarms and generate alarm recommendations via the App or MSP, the following information will be sent to the LLM. This LLM is hosted by AWS, and there is no persistent session; the majority of the data passed is the alarm itself. 

• Device — Device name (NO SOURCE IP, NO HOME IP)
• Destination — Domain if available, else IP address, else "unknown destination."
• Alarm Type — Raw alarm subtype string (UPLOAD ALARM, for example)
• Enforcement — Whether the alarm is auto-blocked
• Traffic Direction  
• Connection — Protocol + port descriptor
• Destination Domain Information, IP Information, Country of the IP (public information)
• Threat Analysis From Firewalla + Third Party (Firewalla's own data)
• Device Upload History — Historical upload byte stats, only when risk is below threshold (e.g., "Avg daily upload: 12 MB; today: 4.2 GB")

How does Firewalla AI process user requests?

Here's an example of how Firewalla AI works:

• Firewalla AI sends a message to an LLM server in the cloud (Example: "A device XYZ is uploading 100MB to a random site at 10 a.m., is this good or bad? What are your recommendations?").
  • Firewalla will also send useful metadata from the alarm detail screen, device detail screen, or flow detail screen to the LLM to complement the text question. 
• The LLM generates a response, which is then displayed on your app.
• If you provide feedback ("thumbs up", "thumbs down", or custom feedback), Firewalla will relay that feedback to the LLM to help it improve.