When the WatchGuard Inspector runs against a Firebox, it retrieves interface information directly from the device using the following CLI command:

The output may display:

However, the front of the appliance may have fewer Ethernet ports physically available.

Additionally, some interfaces may appear with identifiers such as:

These interfaces may appear to “double” the expected count.

The WatchGuard Inspector does not calculate or estimate interface counts.

It collects interface data directly from the Firebox CLI using:

Any interface shown in this command output will be included in Inspector results.

WatchGuard appliances, such as the M27,0 use a shared hardware platform design.

At the chipset level, the system may support more interfaces than are physically exposed as Ethernet ports.

During boot, Fireware enumerates all supported interfaces at the hardware level, including:

These are included in the reported “physical interface count.”

Interfaces labeled with prefixes such as:

are internal hardware-mapped interfaces.

They typically represent:

These interfaces are valid at the OS level but may not correspond to physical Ethernet ports on the chassis.

They commonly show:

The term “physical interface count” in CLI output refers to:

The number of hardware-level interfaces recognized by Fireware.

It does not strictly mean the number of Ethernet ports on the front of the device.

This distinction can lead to confusion when reviewing Inspector output.

No.

This is expected WatchGuard behavior and reflects how Fireware enumerates interfaces internally.

The Inspector is accurately reporting the device’s CLI output.

Users most frequently notice this behavior after:

In these scenarios, additional enumerated interfaces may become visible in CLI output.

We recommend reviewing the interface status and type in addition to the count.

Interfaces that are:

are typically internal or unused interfaces and do not indicate additional physical ports.

This behavior is expected.