On-box function licenses (IPS / Scrub)
Your edge firewall does basic filtering out of the box. Intrusion-blocking and flood-absorb are extra features you switch on for it — each costs an upfront fit-fee plus a monthly charge. Turn them off again any time. They are how you add capability without buying another box.
Detailed explanation
On-box FunctionLicenses: IPS/Threat adds intrusion coverage, Scrub adds volumetric absorb, each raising the inspected capacity for its attack class. A one-time capex to fit plus a recurring monthly sub; toggle via SetApplianceLicense. The hardware SKU (throughput / ports / U) is a separate axis from the license — a small box can be licensed up, but the license raises mitigation quality, not the box's forwarding ceiling.