VMware Cloud Foundation add-on licensing covers products that Broadcom sells alongside VMware Cloud Foundation (VCF) and VMware vSphere Foundation (VVF) but licenses separately from the primary per Core subscription. Broadcom’s VCF 9.1 documentation notes that add-ons “do not necessarily follow the same licensing model as VCF and vSphere Foundation”, and that an add-on license can be used only after a primary license is assigned to the vCenter instance.[1] Three families of add-on have their own Specific Program Documentation (SPD) and metric. VMware vDefend Firewall is licensed per Core with deployment-specific ratios, VMware Avi Load Balancer per Service Unit, and VMware Live Recovery per protected virtual machine, with protected capacity in TiB for its cloud component.[2][3][4]
Several capabilities that were standalone products before 2024 continue as add-ons. The End of Availability table replaced NSX firewall editions with “VMware Firewall” (later vDefend), the Advanced Load Balancer with the Avi Load Balancer add-on, and Site Recovery Manager with an add-on service that became VMware Live Recovery. See VMware perpetual licensing end of availability.
Editions
| Add-on | Editions or components | Metric | SPD version cited |
|---|---|---|---|
| VMware vDefend Firewall | vDefend Firewall; vDefend Firewall with Advanced Threat Prevention (ATP); vDefend ATP Add-on | Core, with Deployment Specific Purchase Requirements; Concurrent User for Firewall for Desktop | May 2024[2] |
| VMware Avi Load Balancer | On-premises software with optional cloud-based features | Service Unit | November 2024[3] |
| VMware Live Recovery | VMware Live Cyber Recovery (formerly VMware Cloud Disaster Recovery); VMware Live Site Recovery (formerly Site Recovery Manager) | Protected VM; protected TiB for Live Cyber Recovery | May 2024[4] |
The two vDefend ATP editions include “a Cloud Service for user interface and analysis and storage of network traffic and artifacts for the same duration as Customer’s Subscription term”.[2] Live Site Recovery documentation (9.0.5) states that the on-premises Live Recovery capabilities, Live Site Recovery with vSphere Replication and vSAN Data Protection, “are sold as a VCF advanced service called Advanced Cyber Compliance”. Customers on VVF or pre-version 9 vSphere may instead buy a standalone Site Recovery Manager license.[6]
Some capabilities are components of VCF rather than add-ons. The June 2026 VCF SPD lists vSphere Kubernetes Service and, where the SKU includes it, VCF Private AI Services as per-Core components of VCF.[7] The VCF 9.1 documentation adds that from November 3, 2025 some VCF subscriptions also include a license for VMware Private AI Foundation with NVIDIA.[1]
Metrics
| Metric (catalog row) | Add-on | Unit as the SPD states it |
|---|---|---|
| Core (VMware vDefend Firewall) | vDefend Firewall, all editions | “applicable number of Cores as outlined on the section Deployment Specific Purchase Requirements” |
| Concurrent User (VMware Firewall for Desktop) | vDefend in VDI and RDS clusters | Concurrent Users or Authorized Users |
| Service Unit | Avi Load Balancer | “a unit of measure that is dependent on the environment in which the Service Engine of the Software is deployed” |
| Protected Virtual Machine | VMware Live Recovery | “licensed per protected Virtual Machine (VM)” |
| Protected capacity (TiB) | VMware Live Cyber Recovery | logical used storage of protected VMs plus retained incremental cloud backups |
Sources: vDefend SPD, Avi SPD and VMware Live Recovery SPD.[2][3][4]
Counting / floors
vDefend Firewall
The vDefend SPD (May 2024) converts protected capacity into purchased Cores according to how the firewall is deployed:[2]
| Deployment type | Purchased vDefend Cores | Protected capacity |
|---|---|---|
| Distributed Firewall | 1 | 1 Core of Distributed Firewall |
| Gateway Firewall | 4 | 1 Core of Gateway Firewall |
| Container Security with Antrea | 1 | 1 Core of Container Security with Antrea |
| Agent for Bare Metal workloads | 1 | 4 Cores of Bare Metal |
| Offload to a DPU (in addition to the Distributed or Gateway entitlement) | 4 | 1 DPU |
| VMware Firewall for Desktop | 1 | 2.5 Concurrent Users |
“If multiple types of deployment are shared on the same host, each deployment will independently require the appropriate number of licenses.”[2] For desktop use, the SPD requires a license “for every Concurrent User or Authorized User using the Broadcom Software in the Cluster”, and applies it only to clusters running virtual desktops, session hosts and their management tools. Worked example (illustrative, derived from the table): a host protected by the Distributed Firewall on 32 Cores that also runs a Gateway Firewall edge on 8 Cores needs 32 + (4 × 8) = 64 vDefend Cores.
Avi Load Balancer
The Avi SPD (November 2024) sets Service Unit consumption by environment:[3]
- Virtual Service Engine: “each licensed Service Unit can service a single Core.”
- Bare metal, where the whole Node is a single Service Engine: each Service Unit services four Cores, “and each Processor must have a minimum of five (5) Service Units licensed.”
- Bandwidth-limited Service Engines: two Service Units for every five Service Engines limited to 25 Mbps, and seven Service Units for every ten Service Engines limited to 200M.
On-premises and cloud-based deployments “will separately require the appropriate number of Service Units”. The optional cloud features fall under the Avi Load Balancer SaaS Listing rather than the SPD.[3]
VMware Live Recovery
The Live Recovery SPD licenses each protected VM and recommends “a minimum 3-year term”. Live Cyber Recovery also requires protected capacity, with “A minimum purchase of 10 TiB per subscription region”.[4] The January 2026 FAQ defines a protected VM as “one unique combination of protection method and protection target endpoint instance”. A VM protected by both Live Site Recovery and Live Cyber Recovery, a combination limited to array-based replication, “will require two VMware Live Recovery entitlements”.[5]
For Live Site Recovery, “The same license is installed on both the protected and the recovery site”. One-way protection of 100 VMs needs a 100-VM license, while bi-directional protection of 100 VMs each way needs 200. Live Site Recovery checks licenses whenever a VM is added to or removed from a protection group, and stops further protection when licenses are out of compliance.[6]
Excess use is a compliance matter. The SPD requires customers who exceed purchased quantities to buy more. The FAQ states that after May 6, overages are no longer billed in arrears and that uncovered usage “might result in restrictions in the service capability”.[4][5]
Virtualization & partitioning
vDefend counts the Cores it protects or occupies by deployment type, not the Cores licensed for VCF, so a VCF host does not automatically carry vDefend entitlement. The DPU rule treats a SmartNIC data processing unit as a separately licensed device. Avi counts Cores of the Service Engine rather than of the load-balanced application servers.[2][3]
Cloud / BYOL
The Live Recovery SPD states that the customer “must not (and must not allow Customer’s Third-Party Agents to) use or deploy the Software on, or with, any Cloud Services”. Its hosting clause allows only Internally Developed Applications delivered to third parties.[4] The January 2026 FAQ adds that Live Site Recovery capabilities may be used in hyperscaler VMware environments (Azure VMware Solution, Google Cloud VMware Engine, Amazon Elastic VMware Service and Oracle Cloud VMware Solution) “just like any other VVF and VCF deployment”, provided the required entitlements are purchased.[5] Live Cyber Recovery is itself a Broadcom-operated SaaS: the FAQ states that the AWS account used for cloud storage is owned and managed by VMware.[5]
For VMware Cloud Service Providers, vDefend Firewall, vDefend Firewall with ATP and the ATP Add-on can be consumed “on a committed contract and overage basis” and are metered through VCF usage meter 9.0.[8] See VMware Cloud Service Provider Program.
Programs
The add-on SPDs name no ULA or enterprise agreement. Add-ons are ordered on the same Broadcom Transaction Document as VCF or VVF and, in VCF 9.x, assigned in VCF Operations as add-on licenses after a primary license.[1] The vDefend SPD also limits use of the product APIs to integration with the customer’s cloud management, network management and billing systems.[2]
Out of scope
- vSAN add-on (per TiB) and included vSAN TiB: see VMware vSphere and VMware Cloud Foundation licensing.
- VMware Private AI Foundation with NVIDIA, Data Services Manager and Advanced Cyber Compliance SPDs: not retrieved. Their metrics are not recorded here beyond what the VCF SPD and VCF 9.1 documentation state.
- vDefend Security Services Platform and later vDefend editions announced after the May 2024 SPD.
- Avi Load Balancer SaaS Listing (cloud-based features).
- Add-on price lists: not published.