Watchguard Fireware XTM WSM User guide

Brand: Watchguard

Model: Fireware XTM WSM

Category: Software

Type: User guide

WatchGuard System Manager v11.3 User Guide

Fireware XTM

WatchGuard System Manager

v11.3 User Guide

WatchGuard XTMDevices

Firebox XPeak e-Series

Firebox XCore e-Series

Firebox XEdge e-Series

ii WatchGuard System Manager

About this User Guide

The Fireware XTM WatchGuard System Manager User Guide is updated with each major product release.

For minor product releases, only the Fireware XTM WatchGuard System Manager Help system is updated.

The Help system also includes specific, task-based implementation examples that are not available in the

User Guide.

For the most recent product documentation, see the Fireware XTM WatchGuard System Manager Help on

the WatchGuard web site at: http://www.watchguard.com/help/documentation/.

Information in this guide is subject to change without notice. Companies, names, and data used in examples

herein are fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any

form or by any means, electronic or mechanical, for any purpose, without the express written permission

of WatchGuard Technologies, Inc.

Guide revised: 6/23/2010

mentioned herein, if any, are the property of their respective owners.

Complete copyright, trademark, patent, and licensing information can be found in the Copyright and

Licensing Guide, available online at: http://www.watchguard.com/help/documentation/.

Note This product is for indoor use only.

About WatchGuard

WatchGuard offers affordable, all-in-one network and content

security solutions that provide defense-in-depth and help meet

regulatory compliance requirements. The WatchGuard XTM line

combines firewall, VPN, GAV, IPS, spam blocking and URL filtering

to protect your network from spam, viruses, malware, and

intrusions. The new XCS line offers email and web content

security combined with data loss prevention. WatchGuard

extensible solutions scale to offer right-sized security ranging

from small businesses to enterprises with 10,000+ employees.

WatchGuard builds simple, reliable, and robust security

appliances featuring fast implementation and comprehensive

management and reporting tools. Enterprises throughout the

world rely on our signature red boxes to maximize security

without sacrificing efficiency and productivity.

For more information, please call 206.613.6600 or visit

www.watchguard.com.

Address

505 Fifth Avenue South

Suite 500

Seattle, WA 98104

Support

www.watchguard.com/support

U.S. and Canada +877.232.3531

All Other Countries +1.206.521.3575

Sales

U.S. and Canada +1.800.734.9905

All Other Countries +1.206.613.0895

User Guide iii

Table of Contents

Introduction to Network Security 1

About networks and network security 1

About Internet connections 1

About protocols 2

About IP addresses 3

Private addresses and gateways 3

About subnet masks 3

About slash notation 3

About entering IP addresses 4

Static and dynamic IP addresses 4

About DNS (Domain Name System) 5

About firewalls 6

About services and policies 7

About ports 8

Introduction to Fireware XTM 9

About Fireware XTM 9

Fireware XTM Components 10

WatchGuard System Manager 10

WatchGuard Server Center 11

Fireware XTM Web UI and Command Line Interface 12

Fireware XTMwith a Pro Upgrade 13

Service and Support 15

About WatchGuard Support 15

LiveSecurity Service 15

LiveSecurity Service Gold 16

Service expiration 16

Getting Started 19

Before you begin 19

Verify basic components 19

Get a Firebox or XTM device feature key 20

Gather network addresses 20
Select a firewall configuration mode 21
Decide where to install server software 22
Install WatchGuard System Manager software 22
Back up your previous configuration 22
Download WatchGuard System Manager 23
About software encryption levels 24
About the Quick Setup Wizard 24
Run the Web Setup Wizard 25
Run the WSM Quick Setup Wizard 28
Complete your installation 30
Customize your security policy 31
About LiveSecurity Service 31
Start WatchGuard System Manager 31
Connect to a Firebox or XTM device 31
Start WSMapplications 33
Additional installation topics 34
Install WSM and keep an older version 34
Install WatchGuard Servers on computers with desktop firewalls 35
Dynamic IP support on the external interface 35
About connecting the Firebox or XTM device cables 36
Connect to a Firebox or XTM device with Firefox v3 36
Disable the HTTP proxy in the browser 38
Find your TCP/IP properties 39
Configuration and Management Basics 43
About basic configuration and management tasks 43
About configuration files 43
Open a configuration file 43
Make a new configuration file 45
Save the configuration file 46
Make a backup of the Firebox or XTM device image 47
Restore a Firebox or XTM device backup image 48
iv WatchGuard System Manager

User Guide v
Use a USB drive for system backup and restore 49
About the USB drive 49
Save a backup image to a connected USB drive 49
Restore a backup image from a connected USB drive 49
Automatically restore a backup image from a USB drive 50
USB drive directory structure 52
Save a backup image to a USB drive connected to your management computer 53
Use an existing configuration for a new Firebox or XTM device model 53
Configure a replacement Firebox or XTM device 55
Save the configuration from the original Firebox or XTM device to a file 55
Get the feature key for the replacement Firebox or XTM device 56
Use the Quick Setup Wizard to configure basic settings 56
Update the feature key in the original configuration file and save to the new device 56
Reset a Firebox or XTM device to a previous or new configuration 57
Start a Firebox or XTM device in safe mode 57
Reset a Firebox X Edge e-Series or WatchGuard XTM 2 Series device to factory-default settings
58
Run the Quick Setup Wizard 58
About factory-default settings 58
About feature keys 60
When you purchase a new feature 60
See features available with the current feature key 60
Verify feature key compliance 61
Get a feature key from LiveSecurity 62
Add a feature key to your Firebox or XTM device 64
See the details of a feature key 66
Download a feature key 66
Enable NTP and add NTP servers 67
Set the time zone and basic device properties 68
About SNMP 69
SNMP polls and traps 69
Enable SNMP polling 70

Enable SNMP management stations and traps 71
About Management Information Bases (MIBs) 73
About WatchGuard Passphrases, Encryption Keys, and Shared Keys 74
Create a secure passphrase, encryption key, or shared key 74
Firebox or XTM device Passphrases 74
User Passphrases 75
Server Passphrases 75
Encryption Keys and Shared Keys 75
Change Firebox or XTM device passphrases 77
About aliases 78
Alias members 78
Create an alias 79
Define Firebox or XTM device global settings 81
Define ICMP error handling global settings 82
Enable TCP SYN checking 83
Define TCP maximum segment size adjustment global settings 83
Enable or disable Traffic Management and QoS 83
Change the Web UI port 83
Automatic Reboot 83
External Console 84
See also 84
Manage a Firebox or XTM device from a remote location 84
Locations of WatchGuard System Manager files 87
Locations of application and user-created files 87
Upgrade to a new version of Fireware XTM 89
Install the upgrade on your management computer 89
Upgrade the Firebox or XTM device 90
Use multiple versions of Policy Manager 91
About upgrade options 91
Subscription Services upgrades 91
Appliance and software upgrades 91
How to apply an upgrade 92
vi WatchGuard System Manager

User Guide vii
Renew security subscriptions 92
Renew subscriptions from Firebox System Manager 93
Network Setup and Configuration 95
About network interface setup 95
Network modes 96
Interface types 97
About network interfaces on the Edge e-Series 97
Mixed Routing Mode 98
Configure an external interface 98
Configure DHCP in mixed routing mode 102
About the Dynamic DNS service 104
Use dynamic DNS 104
Drop-in Mode 106
Use drop-in mode for network interface configuration 106
Configure related hosts 107
Configure DHCP in drop-in mode 108
Bridge Mode 111
Common interface settings 113
Disable an interface 116
Configure DHCPRelay 118
Restrict network traffic by MAC address 118
Add WINS and DNS server addresses 119
Configure a secondary network 120
About advanced interface settings 122
Network Interface Card (NIC)settings 122
Set Outgoing Interface Bandwidth 124
Set DF bit for IPSec 124
PMTU Setting for IPSec 125
Use static MAC address binding 125
Find the MAC address of a computer 126
About LAN bridges 126
Create a network bridge configuration 127

Assign a network interface to a bridge 128
About routing 130
Add a static route 130
About virtual local area networks (VLANs) 131
VLAN requirements and restrictions 131
About tagging 132
About VLANIDnumbers 132
Define a new VLAN 132
Assign interfaces to a VLAN 136
Network Setup Examples 137
Example: Configure Two VLANs on the Same Interface 137
Use your Firebox or XTM device with the 3G Extend wireless bridge 141
Multi-WAN 143
About using multiple external interfaces 143
Multi-WAN requirements and conditions 143
Multi-WAN and DNS 144
Multi-WAN and FireCluster 144
About multi-WAN options 144
Round-robin order 144
Failover 145
Interface overflow 145
Routing table 146
Serial modem (Firebox XEdge only) 146
Configure Round-robin 147
Before You Begin 147
Configure the interfaces 147
Find how to assign weights to interfaces 149
Configure Failover 149
Before You Begin 149
Configure the interfaces 149
Configure Interface Overflow 150
Before You Begin 150
viii WatchGuard System Manager

User Guide ix
Configure the interfaces 151
Configure Routing Table 152
Before you begin 152
Routing Table mode and load balancing 152
Configure the interfaces 152
About the Firebox or XTM device route table 153
When to use multi-WAN methods and routing 154
Serial modem failover 155
Enable serial modem failover 155
Account settings 156
DNS settings 156
Dial-up settings 157
Advanced settings 157
Link Monitor settings 157
Advanced multi-WAN settings 159
About sticky connections 159
Set a global sticky connection duration 159
Set the failback action 160
About WAN interface status 161
Time needed for the Firebox or XTM device to update its route table 161
Define a link monitor host 161
Network Address Translation (NAT) 163
About Network Address Translation 163
Types of NAT 164
About dynamic NAT 164
Add firewall dynamic NAT entries 164
Configure policy-based dynamic NAT 167
About 1-to-1 NAT 168
About 1-to-1 NAT and VPNs 169
Configure firewall 1-to-1 NAT 170
Configure policy-based 1-to-1 NAT 172
Configure NAT loopback with static NAT 174

Add a policy for NATloopback to the server 175
NAT loopback and 1-to-1 NAT 176
About static NAT 180
Configure Static NAT 180
Configure server load balancing 181
NAT Examples 185
1-to-1 NAT example 185
Wireless Setup 187
About wireless configuration 187
About wireless access point configuration 188
Before you begin 189
About wireless configuration settings 190
Enable/disable SSID broadcasts 190
Change the SSID 191
Log authentication events 191
Change the fragmentation threshold 191
Change the RTS threshold 193
About wireless security settings 193
Set the wireless authentication method 193
Set the encryption level 194
Enable wireless connections to the trusted or optional network 195
Enable a wireless guest network 197
Enable a wireless hotspot 200
Configure user timeout settings 201
Customize the hotspot splash screen 201
Connect to a wireless hotspot 202
See wireless hotspot connections 203
Configure your external interface as a wireless interface 204
Configure the primary external interface as a wireless interface 204
Configure a BOVPN tunnel for additional security 207
About wireless radio settings on the Firebox X Edge e-Series Wireless device 208
Set the operating region and channel 209
x WatchGuard System Manager

User Guide xi
Set the wireless mode of operation 210
About wireless radio settings on the WatchGuard XTM2 Series Wireless device 211
Country is set automatically 212
Select the Band and Wireless mode 212
Select the Channel 213
Configure the wireless card on your computer 214
Dynamic Routing 215
About dynamic routing 215
About routing daemon configuration files 215
About Routing Information Protocol (RIP) 216
Routing Information Protocol (RIP) commands 216
Configure the Firebox or XTM device to use RIP v1 218
Configure the Firebox or XTM device to use RIP v2 219
Sample RIP routing configuration file 222
About Open Shortest Path First (OSPF) Protocol 223
OSPF commands 224
OSPF Interface Cost table 227
Configure the Firebox or XTM device to use OSPF 227
Sample OSPF routing configuration file 229
About Border Gateway Protocol (BGP) 231
BGP commands 233
Configure the Firebox or XTM device to use BGP 235
Sample BGP routing configuration file 237
FireCluster 239
About WatchGuard FireCluster 239
FireCluster status 241
About FireCluster failover 241
Events that trigger a failover 241
What happens when a failover occurs 242
FireCluster failover and server load balancing 242
Monitor the cluster during a failover 242
Features not supported with FireCluster 243

FireCluster network configuration limitations 243
FireCluster management limitations 243
About the Interface for management IPaddress 243
Configure the Interface for management IP address 243
Use the Management IP address to restore a backup image 244
Use the Management IP address to upgrade from an external location 244
Configure FireCluster 245
FireCluster requirements and restrictions 245
Cluster synchronization and status monitoring 246
FireCluster device roles 247
FireCluster configuration steps 247
Before you begin 248
Connect the FireCluster hardware 249
Switch and router requirements for an active/active FireCluster 251
Use the FireCluster Setup Wizard 256
Configure FireCluster manually 261
Find the multicast MAC addresses for an active/active cluster 266
Active/Passive Cluster ID and the Virtual MAC Address 268
Monitor and control FireCluster members 269
Monitor status of FireCluster members 270
Monitor and control cluster members 270
Discover a cluster member 270
Force a failover of the cluster master 271
Reboot a cluster member 272
Shut down a cluster member 272
Connect to a cluster member 273
Make a member leave a cluster 274
Make a member join a cluster 275
Remove or add a cluster member 275
Remove a device from a FireCluster 275
Add a new device to a FireCluster 277
Update the FireCluster configuration 277
xii WatchGuard System Manager

User Guide xiii
Configure FireCluster logging and notification 277
About feature keys and FireCluster 278
See the feature keys and Cluster Features for a cluster 279
See or update the feature key for a cluster member 279
See the FireCluster feature key in Firebox System Manager 281
Create a FireCluster backup image 282
Restore a FireCluster backup image 283
Make the backup master leave the cluster 283
Restore the backup image to the backup master 283
Restore the backup image to the cluster master 283
Make the backup master rejoin the cluster 284
Upgrade Fireware XTM for FireCluster members 284
Disable FireCluster 286
Authentication 287
About user authentication 287
User authentication steps 288
Manage authenticated users 289
Use authentication to restrict incoming traffic 289
Use authentication through a gateway Firebox 290
Set global authentication values 291
Set global authentication timeouts 292
Allow multiple concurrent logins 293
Limit login sessions 293
Automatically redirect users to the login portal 294
Use a custom default start page 295
Set Management Session timeouts 295
Enable Single Sign-On 295
About the WatchGuard Authentication (WG-Auth) policy 295
About Single Sign-On (SSO) 296
Before You Begin 298
Set up SSO 298
Install the WatchGuard Single Sign-On (SSO) agent 298

Install the WatchGuard Single Sign-On (SSO) client 299
Enable Single Sign-On (SSO) 300
Authentication server types 302
About using third-party authentication servers 302
Use a backup authentication server 302
Configure your Firebox or XTM device as an authentication server 303
Types of Firebox authentication 303
Define a new user for Firebox authentication 306
Define a new group for Firebox authentication 308
Configure RADIUS server authentication 309
Authentication key 309
RADIUSauthentication methods 309
Before you begin 309
Use RADIUSserver authentication with your Firebox or XTM device 309
How RADIUS server authentication works 311
Configure VASCO server authentication 314
Configure SecurID authentication 316
Configure Active Directory authentication 318
About Active Directory optional settings 320
Find your Active Directory search base 320
Change the default port for the Active Directory server 321
Configure LDAP authentication 322
About LDAP optional settings 324
Use Active Directory or LDAP Optional Settings 324
Before You Begin 324
Specify Active Directory or LDAP Optional Settings 325
Use a local user account for authentication 328
Use authorized users and groups in policies 328
Define users and groups for Firebox authentication 328
Define users and groups for third-party authentication 328
Add users and groups to policy definitions 329
Policies 331
xiv WatchGuard System Manager

User Guide xv
About policies 331
Packet filter and proxy policies 331
About adding policies to your Firebox or XTM device 332
About Policy Manager 332
Open Policy Manager 333
Change the Policy Manager view 334
Change colors used for Policy Manager text 336
Find a policy by address, port, or protocol 337
Add policies to your configuration 338
See the list of policy templates 339
Add a policy from the list of templates 340
Add more than one policy of the same type 341
See template details and modify policy templates 342
Disable or delete a policy 342
About policy precedence 343
Automatic policy order 343
Policy specificity and protocols 344
Traffic rules 344
Firewall actions 345
Schedules 345
Policy types and names 345
Set precedence manually 345
Create schedules for Firebox or XTM device actions 345
Set an operating schedule 347
About custom policies 348
Create or edit a custom policy template 348
Import and export custom policy templates 350
About policy properties 351
Policy tab 351
Properties tab 351
Advanced tab 351
Proxy settings 352

Set access rules for a policy 352
Configure policy-based routing 355
Set a custom idle timeout 357
Set ICMP error handling 357
Apply NAT rules 357
Set the sticky connection duration for a policy 358
Proxy Settings 359
About proxy policies and ALGs 359
Proxy configuration 360
Proxy and AV alarms 360
About rules and rulesets 361
About proxy actions 370
Use predefined content types 372
About Application Blocker Configurations 373
Intrusion prevention in proxy definitions 376
Add a proxy policy to your configuration 377
About the DNS proxy 378
Policy tab 379
Properties tab 379
Advanced tab 380
DNS proxy: General settings 380
DNS proxy: OPcodes 381
DNS proxy: Query types 382
DNS proxy: Query names 383
About MX (Mail eXchange) records 384
About the FTP proxy 385
Policy tab 387
Properties tab 387
Advanced tab 388
FTP proxy: General settings 388
FTP proxy: Commands 389
FTP proxy: Content 390
xvi WatchGuard System Manager

User Guide xvii

FTP proxy: AntiVirus 391

About the H.323 ALG 392

VoIPcomponents 392

ALGfunctions 392

Policy tab 393

Properties tab 394

Advanced tab 394

H.323 ALG: General Settings 395

H.323 ALG: Access Control 396

H.323 ALG: Denied Codecs 397

About the HTTP proxy 398

Policy tab 399

Properties tab 400

Advanced tab 400

HTTP request: General settings 401

HTTP request: Request methods 402

HTTP request: URL paths 404

HTTP request: Header fields 404

HTTP request: Authorization 405

HTTP Response: General settings 407

HTTP Response: Header fields 407

HTTP Response: Content types 408

HTTP Response: Cookies 409

HTTP Response: Body content types 410

HTTP proxy exceptions 410

HTTP proxy:WebBlocker 411

HTTP proxy:Application Blocker 412

HTTP proxy: AntiVirus 412

HTTP proxy:Intrusion Prevention 412

HTTP proxy: Reputation Enabled Defense 413

HTTP proxy: Deny message 414

Enable Windows updates through the HTTPproxy 416

Use a caching proxy server 416

About the HTTPS proxy 417

Policy tab 417

Properties tab 418

Advanced tab 418

HTTPS proxy: Content inspection 419

HTTPS proxy: Certificate names 421

HTTPS proxy:WebBlocker 421

HTTPS proxy: General settings 422

About the POP3 proxy 423

Policy tab 423

Properties tab 424

Advanced tab 424

POP3 proxy: General settings 425

POP3 proxy: Authentication 427

POP3 proxy: Content types 428

POP3 proxy: File names 429

POP3 proxy: Headers 431

POP3 proxy: AntiVirus 432

POP3 proxy: Deny message 433

POP3 proxy: spamBlocker 434

About the SIP proxy 435

VoIPcomponents 436

ALGfunctions 436

Policy tab 436

Properties tab 437

Advanced tab 437

SIP ALG: General Settings 437

SIP ALG: Access Control 439

SIP ALG: Denied Codecs 440

About the SMTP proxy 442

Policy tab 442

xviii WatchGuard System Manager

User Guide xix
Properties tab 442
Advanced tab 443
SMTP proxy: General settings 443
SMTP proxy: Greeting rules 446
SMTP proxy: ESMTP settings 447
SMTP proxy: Authentication 448
SMTP proxy: Content types 448
SMTP proxy: File names 450
SMTP proxy: Mail From/Rcpt To 450
SMTP proxy: Headers 451
SMTP proxy: AntiVirus 452
SMTP proxy: Deny message 453
SMTP proxy: spamBlocker 454
Configure the SMTPproxy to quarantine email 454
Protect your SMTP server from email relaying 454
About the TCP-UDP proxy 456
Policy tab 456
Properties tab 456
Advanced tab 457
TCP-UDP proxy: General settings 457
TCP-UDPproxy: Application blocking 457
Traffic Management and QoS 459
About Traffic Management and QoS 459
Enable traffic management and QoS 459
Guarantee bandwidth 460
Restrict bandwidth 461
QoS Marking 461
Traffic priority 461
Set Connection Rate Limits 462
About QoS Marking 462
Before you begin 462
QoS markingfor interfaces and policies 463

QoS marking and IPSec traffic 463
Marking types and values 463
Enable QoS Marking for an interface 465
Enable QoS Marking or prioritization settings for a policy 466
Enable QoS Marking for a managed BOVPN tunnel 467
Traffic control and policy definitions 469
Define a Traffic Management action 469
Add a Traffic Management action to a policy 470
Add a Traffic Management action to a BOVPN firewall policy 471
Default Threat Protection 473
About default threat protection 473
About default packet handling options 474
Set logging and notification options 475
About spoofing attacks 475
About IP source route attacks 476
About port space and address space probes 477
About flood attacks 479
About unhandled packets 481
About distributed denial-of-service attacks 482
About blocked sites 483
Permanently blocked sites 483
Auto-blocked sites/Temporary Blocked Sites list 483
Block a site permanently 483
Create Blocked Site Exceptions 485
Import a list of blocked sites or blocked sites exceptions 486
Block sites temporarily with policy settings 486
Change the duration that sites are auto-blocked 486
About blocked ports 487
Default blocked ports 487
Block a port 489
WatchGuard Server Setup 491
About WatchGuard Servers 491
xx WatchGuard System Manager