WatchGuard
®
System Manager
User Guide
WatchGuard System Manager v9.0
Fireware® v9.0
Fireware® Pro v9.0
Revised: 05/07/2007
ii WatchGuard System Manager
ADDRESS:
505 Fifth Avenue South
Suite 500
Seattle, WA 98104
SUPPORT:
www.watchguard.com/support
suppor[email protected]
U.S. and Canada +877.232.3531
All Other Countries +1.206.613.0456
SALES:
U.S. and Canada +1.800.734.9905
All Other Countries +1.206.521.8340
ABOUT WATCHGUARD
WatchGuard is a leading provider of network security solutions for small- to mid-
sized enterprises worldwide, delivering integrated products and services that are
robust as well as easy to buy, deploy and manage. The company’s Firebox X family of
expandable integrated security appliances is designed to be fully upgradeable as an
organization grows and to deliver the industry’s best combination of security,
performance, intuitive interface and value. WatchGuard Intelligent Layered Security
architecture protects against emerging threats effectively and efficiently and provides
the flexibility to integrate additional security functionality and services offered
through WatchGuard. Every WatchGuard product comes with an initial LiveSecurity
Service subscription to help customers stay on top of the security landscape with
vulnerability alerts, software updates, expert security instruction and superior
customer care. For more information, please call (206) 521-8340 or visit
www.watchguard.com
.
Notice to Users
Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are
fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means,
electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.
Copyright, Trademark, and Patent Information
Copyright© 1998 - 2007 WatchGuard Technologies, Inc. All rights reserved.
All trademarks or trade names mentioned herein, if any, are the property of their respective owners.
Management Software: 9.0
Appliance Software: Fireware® 9.0 and Fireware Pro 9.0
Document Version: 9.0-352-2832-001-2
Complete copyright, trademark, patent, and licensing
information can be found in the appendix of this User
Guide.
User Guide iii
Contents
CHAPTER 1 Introduction ............................................................................................................................. 1
WatchGuard System Manager Tools ................................................................................................. 2
About the WatchGuard System Manager Window ..................................................................... 2
Device Status ......................................................................................................................................... 3
Device Management ............................................................................................................................ 4
About WatchGuard Servers ................................................................................................................. 4
About Fireware and Fireware Pro ...................................................................................................... 5
CHAPTER 2 Getting Started ....................................................................................................................... 7
Installing WatchGuard System Manager ......................................................................................... 7
Installation requirements .................................................................................................................... 7
Collecting network information ........................................................................................................ 8
Selecting a firewall configuration mode .......................................................................................... 9
Selecting where to install server software .....................................................................................11
Setting up the management station ..............................................................................................11
Backing up your previous configuration ........................................................................................12
Quick Setup Wizard ..............................................................................................................................12
Firebox X Core and Peak e-Series Web Quick Setup Wizard ......................................................13
Quick Setup Wizard ............................................................................................................................14
Putting the Firebox into Operation .................................................................................................14
Starting WatchGuard System Manager .........................................................................................15
Connecting to a Firebox ....................................................................................................................16
Disconnecting from a Firebox ..........................................................................................................16
Starting security applications ..........................................................................................................16
After Your Installation ..........................................................................................................................17
Customizing your security policy .....................................................................................................17
Features of the LiveSecurity Service ................................................................................................18
Upgrading to a New Version of Fireware ......................................................................................18
Downgrading to WSM 8.3 or Earlier ...............................................................................................19
Installation Topics ..................................................................................................................................19
iv WatchGuard System Manager
Installing WSM and keeping an older version ...............................................................................19
Installing WatchGuard Servers on computers with desktop firewalls .....................................19
Adding secondary networks to your configuration .....................................................................20
Dynamic IP support on the external interface ..............................................................................20
Entering IP addresses .........................................................................................................................21
Installing the Firebox cables .............................................................................................................22
CHAPTER 3 Service and Support ..........................................................................................................23
LiveSecurity Service Solutions ..........................................................................................................23
LiveSecurity Service Broadcasts .......................................................................................................24
Activating LiveSecurity Service ........................................................................................................25
LiveSecurity Service Self Help Tools ...............................................................................................25
WatchGuard Users Forum ...................................................................................................................26
Product Documentation .....................................................................................................................26
Technical Support .................................................................................................................................27
LiveSecurity Service technical support ...........................................................................................27
LiveSecurity Gold ................................................................................................................................27
Firebox Installation Service ...............................................................................................................28
VPN Installation Service ....................................................................................................................28
Training and Certification ...................................................................................................................28
CHAPTER 4 Firebox Status Monitoring ..............................................................................................29
Starting Firebox System Manager ...................................................................................................29
Connecting to a Firebox ....................................................................................................................29
Opening Firebox System Manager ..................................................................................................30
Firebox System Manager Menus and Toolbar .............................................................................30
Setting refresh interval and pausing the display ..........................................................................32
Seeing Basic Firebox and Network Status ....................................................................................33
Using the Security Traffic display .....................................................................................................33
Monitoring status information ........................................................................................................33
Setting the center interface ..............................................................................................................34
Monitoring traffic, load, and status ................................................................................................34
Firebox and VPN tunnel status .........................................................................................................34
Monitoring Firebox Traffic ..................................................................................................................36
Setting the maximum number of log messages ..........................................................................36
Using color for your log messages ...................................................................................................37
Copying log messages .......................................................................................................................38
Learning more about a traffic log message ..................................................................................38
Clearing the ARP Cache .......................................................................................................................38
Using the Performance Console ......................................................................................................39
Types of counters ................................................................................................................................39
Defining counters ...............................................................................................................................39
Viewing the performance graph ......................................................................................................41
Working with more than one Performance Console graph .......................................................42
Viewing Bandwidth Usage .................................................................................................................43
Viewing Number of Connections by Policy .................................................................................44
User Guide v
Viewing Information About Firebox Status ..................................................................................46
Status Report .......................................................................................................................................46
Authentication List .............................................................................................................................47
Blocked Sites ........................................................................................................................................48
Security Services ..................................................................................................................................49
Using HostWatch ...................................................................................................................................51
The HostWatch window ....................................................................................................................51
Controlling the HostWatch window ...............................................................................................52
Changing HostWatch view properties ...........................................................................................53
Blocking a site from HostWatch .......................................................................................................53
Pausing the HostWatch display .......................................................................................................53
CHAPTER 5 Basic Firebox Administration .........................................................................................55
Working with Licenses .........................................................................................................................55
Activating a new feature ...................................................................................................................55
Adding licenses ....................................................................................................................................57
Deleting a license ................................................................................................................................57
Seeing the active features .................................................................................................................58
Seeing the properties of a license ....................................................................................................59
Downloading a license key ...............................................................................................................59
Setting NTP Servers ..............................................................................................................................59
Setting a Friendly Name and Time Zone .......................................................................................60
Working with SNMP ..............................................................................................................................60
Enabling SNMP polling ......................................................................................................................61
Enabling SNMP traps .........................................................................................................................61
Using MIBs ............................................................................................................................................62
Changing the Firebox Passphrases .................................................................................................62
Recovering a Firebox ............................................................................................................................63
Resetting a Firebox X e-Series device ..............................................................................................63
Resetting a Firebox X Core or Peak (non e-Series) ........................................................................63
CHAPTER 6 Basic Configuration Setup ..............................................................................................65
Opening a Configuration File ............................................................................................................65
Opening a working configuration file ............................................................................................65
Opening a local configuration file ...................................................................................................67
Making a new configuration file .....................................................................................................67
Saving a Configuration File ................................................................................................................68
Saving a configuration to the Firebox ............................................................................................68
Saving a configuration to a local hard drive .................................................................................68
About Firebox Backup Images ..........................................................................................................68
Creating a Firebox backup image ...................................................................................................68
Restoring a Firebox backup image ..................................................................................................69
Working with Aliases ............................................................................................................................69
Alias members .....................................................................................................................................70
Creating an alias .................................................................................................................................70
Using Global Settings ...........................................................................................................................71
Defining ICMP error handling global settings ..............................................................................72
vi WatchGuard System Manager
Enabling TCP SYN checking ..............................................................................................................73
Defining TCP maximum segment size adjustment global settings ..........................................73
Defining global authentication settings ........................................................................................73
Allowing multiple concurrent logins ...............................................................................................74
Disabling Traffic Management and QoS .......................................................................................74
Using Global VPN Settings .................................................................................................................74
Creating Schedules ...............................................................................................................................75
Managing a Firebox from a Remote Location .............................................................................76
CHAPTER 7 Logging and Notification ................................................................................................79
Setting Up the Log Server ..................................................................................................................79
Changing the Log Server encryption key .......................................................................................81
Setting up the Firebox for a Designated Log Server .................................................................81
Adding a Log Server for a Firebox ....................................................................................................81
Setting Log Server priority .................................................................................................................82
Activating syslog logging ..................................................................................................................82
Enabling advanced diagnostics ......................................................................................................83
Setting Global Logging and Notification Preferences .............................................................84
Log file size and rollover frequency .................................................................................................85
Setting when log files rollover ..........................................................................................................85
Scheduling automated reports ........................................................................................................86
Controlling notification .....................................................................................................................87
Starting and stopping the Log Server .............................................................................................87
About Log Messages ............................................................................................................................87
Types of log messages ........................................................................................................................88
Log file names and locations ............................................................................................................89
Consolidating log files .......................................................................................................................89
Updating .wgl log files to .xml format ............................................................................................89
Using LogViewer ....................................................................................................................................90
LogViewer settings ..............................................................................................................................91
Creating a search rule ........................................................................................................................92
Searching in LogViewer .....................................................................................................................93
Viewing the current log file in LogViewer .......................................................................................94
Copying LogViewer data ...................................................................................................................94
CHAPTER 8 Network Setup and Configuration ............................................................................95
Configuring Firebox Interfaces .........................................................................................................96
Configuring the external interface ..................................................................................................98
Adding Secondary Networks ..........................................................................................................100
Adding WINS and DNS Server Addresses ...................................................................................101
Configuring Dynamic DNS ...............................................................................................................102
Configuring Routes .............................................................................................................................104
Adding a network route ..................................................................................................................104
Adding a host route ..........................................................................................................................104
Configuring Advanced Settings for an Interface .....................................................................105
Setting Firebox Interface Speed and Duplex ...............................................................................105
User Guide vii
Setting maximum bandwidth and marking type ......................................................................106
Setting DF bit for IPSec (external interfaces only) ......................................................................106
Using a Firebox with a Drop-in Configuration ..........................................................................106
Configuring related hosts ...............................................................................................................107
Virtual Local Area Networks (VLANs) ............................................................................................108
Tagging ...............................................................................................................................................109
Defining a New VLAN ........................................................................................................................109
Using DHCP ........................................................................................................................................111
Using DHCP relay ..............................................................................................................................112
Specifying VLANs for an Interface .................................................................................................112
CHAPTER 9 Network Setup with Multiple External Interfaces ............................................115
Multi-WAN Requirements and Conditions .................................................................................115
MultiWAN Options ..............................................................................................................................116
About the WAN Failover method ...................................................................................................116
About multi-WAN in round-robin order ......................................................................................116
About multi-WAN with the routing table .....................................................................................116
About the Interface Overflow method .........................................................................................117
Configuring the Multi-WAN Routing Table Option .................................................................118
Looking at the Firebox route table ................................................................................................118
Configuring the Multi-WAN Round-robin Option ...................................................................119
Configuring the Multi-WAN Failover Option .............................................................................120
Configuring the Multi-WAN Interface Overflow Option .......................................................122
Checking WAN Interface Status .....................................................................................................123
Configuring Advanced Multi-WAN Settings ..............................................................................125
Sticky Connections ...........................................................................................................................126
Failback ..............................................................................................................................................126
CHAPTER 10 Network Address Translation (NAT) ......................................................................129
Types of NAT ..........................................................................................................................................129
Adding firewall dynamic NAT entries ............................................................................................130
Reordering dynamic NAT entries ...................................................................................................131
Using 1-to-1 NAT ..................................................................................................................................131
Defining a 1-to-1 NAT rule ..............................................................................................................132
Configuring firewall 1-to-1 NAT .....................................................................................................133
Configuring Policy-Based Dynamic or 1-to-1 NAT ...................................................................133
Configuring policy-based 1-to-1 NAT ...........................................................................................134
Configuring policy-based dynamic NAT ......................................................................................134
Configuring Static NAT ......................................................................................................................135
CHAPTER 11 Authentication .................................................................................................................137
How User Authentication Works ....................................................................................................137
About authentication timeout values ..........................................................................................138
Using authentication from the external network ......................................................................138
Using authentication through a gateway Firebox to another Firebox ..................................139
Authentication Server Types ...........................................................................................................139
viii WatchGuard System Manager
Using a backup authentication server .........................................................................................140
Configuring the Firebox as an Authentication Server ............................................................140
Authentication types ........................................................................................................................140
Defining a new user for Firebox authentication .........................................................................142
Defining a new group for Firebox authentication .....................................................................144
Using a local user account for Firewall user, PPTP, and MUVPN authentication .................144
Configuring RADIUS Server Authentication ..............................................................................144
Configuring SecurID Authentication ............................................................................................147
Configuring LDAP Authentication ................................................................................................148
Using LDAP optional settings .........................................................................................................149
Configuring Active Directory Authentication ..........................................................................152
Using Active Directory optional settings ......................................................................................153
Defining Users and Groups in Policy Definitions .....................................................................153
Defining users and groups for Firebox authentication .............................................................154
Defining users and groups for third-party authentication ......................................................154
Using users and groups in policy definitions ...............................................................................155
CHAPTER 12 Firewall Intrusion Detection and Prevention ...................................................157
Using Default Packet Handling Options .....................................................................................157
Spoofing attacks ...............................................................................................................................158
IP source route attacks .....................................................................................................................158
Port space and address space attacks ..........................................................................................158
Flood attacks .....................................................................................................................................159
Unhandled packets ..........................................................................................................................159
Distributed denial of service attacks .............................................................................................159
Setting Blocked Sites ..........................................................................................................................160
Blocking a site permanently ...........................................................................................................160
Blocking spyware sites .....................................................................................................................161
Using an external list of blocked sites ...........................................................................................162
Creating exceptions to the Blocked Sites list ...............................................................................162
Setting logging and notification parameters .............................................................................162
Blocking sites temporarily with policy settings ...........................................................................164
Blocked sites and Traffic Monitor ...................................................................................................164
Blocking Ports .......................................................................................................................................164
Blocking a port permanently ..........................................................................................................165
Automatically blocking IP addresses that try to use blocked ports ........................................165
Setting logging and notification for blocked ports ....................................................................166
CHAPTER 13 Policies ..................................................................................................................................167
Creating Policies for your Network ...............................................................................................167
About Policy Manager .......................................................................................................................168
Opening Policy Manager ................................................................................................................168
About the Policy Manager window ...............................................................................................168
Changing the Policy Manager View ..............................................................................................169
Selecting colors for Policy Manager text ......................................................................................170
..............................................................................................................................................................171
Adding a policy .................................................................................................................................171
User Guide ix
Making a custom policy template .................................................................................................173
Adding more than one policy of the same type ..........................................................................174
Deleting a policy ...............................................................................................................................174
Configuring Policy Properties .........................................................................................................175
Setting access rules, sources, and destinations ..........................................................................175
About policy-based routing ...........................................................................................................177
Setting a proxy action ......................................................................................................................179
Setting a custom idle timeout ........................................................................................................179
Setting logging properties ..............................................................................................................180
Configuring static NAT for a policy ................................................................................................181
Setting an operating schedule .......................................................................................................182
Applying Traffic Management actions .........................................................................................183
Setting ICMP error handling ...........................................................................................................183
Applying NAT rules ...........................................................................................................................184
Using QoS Marking for a policy .....................................................................................................184
Setting traffic priority for a policy ..................................................................................................185
Enabling sticky connections for a policy ......................................................................................185
Setting Policy Precedence ................................................................................................................186
Using automatic order .....................................................................................................................186
Setting precedence manually .........................................................................................................186
CHAPTER 14 Proxied Policies ................................................................................................................187
About Proxy Actions, Rules, and Rulesets ...................................................................................187
Adding rulesets ..................................................................................................................................188
Using the advanced rules view .......................................................................................................189
Customizing Logging and Notification for Proxy Rules .........................................................190
Configuring log messages and notification for a proxy policy ................................................190
Configuring log messages and alarms for a proxy rule ............................................................190
Using dialog boxes for alarms, log messages, and notification ..............................................191
Configuring the SMTP Proxy ...........................................................................................................192
Configuring general settings ..........................................................................................................194
Configuring greeting rules ..............................................................................................................195
Configuring ESMTP parameters .....................................................................................................195
Configuring authentication rules ..................................................................................................196
Defining content type rules ............................................................................................................197
Defining file name rules ..................................................................................................................197
Configuring the Mail From and Mail To rules ..............................................................................197
Defining header rules .......................................................................................................................198
Defining antivirus responses ..........................................................................................................198
Changing the deny message ..........................................................................................................198
Configuring the IPS (Intrusion Prevention System) for SMTP ...................................................198
Configuring spamBlocker ...............................................................................................................199
Configuring proxy and antivirus alarms for SMTP .....................................................................199
Configuring the FTP Proxy ...............................................................................................................199
Configuring general settings ..........................................................................................................200
Defining commands rules for FTP .................................................................................................200
Setting download rules for FTP ......................................................................................................201
x WatchGuard System Manager
Setting upload rules for FTP ............................................................................................................201
Enabling intrusion prevention for FTP ..........................................................................................201
Configuring proxy alarms for FTP .................................................................................................201
Configuring the HTTP Proxy ............................................................................................................201
Configuring settings for HTTP requests .......................................................................................202
Configuring general settings for HTTP responses ......................................................................204
Setting header fields for HTTP responses .....................................................................................204
Setting content types for HTTP responses ....................................................................................205
Setting cookies for HTTP responses ...............................................................................................205
Setting HTTP body content types ..................................................................................................205
Defining antivirus responses for HTTP .........................................................................................205
Changing the deny message ..........................................................................................................206
Enabling intrusion prevention for HTTP .......................................................................................206
Defining proxy and antivirus alarms for HTTP ...........................................................................207
Configuring the DNS Proxy ..............................................................................................................207
Configuring general settings for the DNS proxy .........................................................................207
Configuring DNS OPcodes ..............................................................................................................208
Configuring DNS query types .........................................................................................................209
Configuring DNS query names ......................................................................................................210
Enabling intrusion prevention for DNS ........................................................................................210
Configuring DNS proxy alarms ......................................................................................................210
Configuring the TCP Proxy ...............................................................................................................210
Configuring general settings for the TCP proxy ..........................................................................210
Enabling intrusion prevention for TCP .........................................................................................211
CHAPTER 15 Historical Reports ............................................................................................................213
Creating and Editing Reports ..........................................................................................................213
Starting Historical Reports ..............................................................................................................213
Starting a new report .......................................................................................................................214
Editing an existing report ................................................................................................................215
Deleting a report ...............................................................................................................................215
Viewing the reports list ....................................................................................................................215
Backing up report definition files ..................................................................................................216
Setting Report Properties .................................................................................................................216
Specifying a report time interval ...................................................................................................216
Specifying report sections ...............................................................................................................217
Consolidating report sections ........................................................................................................217
Setting report properties .................................................................................................................218
Viewing network interface relationships .....................................................................................219
Exporting Reports ...............................................................................................................................219
Exporting reports to HTML format ................................................................................................220
Exporting reports to NetIQ format ................................................................................................220
Using Report Filters ............................................................................................................................220
Creating a new report filter .............................................................................................................221
Editing a report filter ........................................................................................................................222
Deleting a report filter .....................................................................................................................222
Applying a report filter .....................................................................................................................222
User Guide xi
Running Reports ..................................................................................................................................222
Report Sections and Consolidated Sections .............................................................................222
Report sections ..................................................................................................................................222
Consolidated sections ......................................................................................................................225
CHAPTER 16 Management Server Setup and Administration ............................................227
WatchGuard Management Server Passphrases ........................................................................227
Setting Up the Management Server .............................................................................................229
Changing the Management Server Configuration .................................................................230
Adding or removing a Management Server license ..................................................................230
Recording diagnostic log messages for the Management Server ..........................................231
Configuring the Certificate Authority ..........................................................................................231
Configuring properties for the CA certificate ..............................................................................231
Configuring properties for client certificates ...............................................................................232
Configuring properties for the Certificate Revocation List (CRL) .............................................233
Recording diagnostic log messages for the Certificate Authority service .............................233
Backing up or Restoring the Management Server Configuration .....................................234
Moving the WatchGuard Management Server to a New Computer ................................234
Connecting to a Management Server ..........................................................................................234
CHAPTER 17 Device Management Setup .......................................................................................237
Configuring Fireboxes as Managed Clients ...............................................................................237
Configuring a Firebox X Core or X Peak running Fireware as a managed client ..................237
Configuring a Firebox III or Firebox X Core running WFS as a managed client ....................239
Configuring Edges and SOHOs as Managed Clients ...............................................................240
Preparing a new or factory default Firebox X Edge for management ....................................241
Importing Firebox X Edge devices into a Management Server ................................................242
Preparing an installed Firebox X Edge for management ..........................................................242
Configuring a Firebox SOHO 6 as a managed client .................................................................244
Adding Devices ....................................................................................................................................245
CHAPTER 18 Device Management Properties .............................................................................247
Viewing the Managed Devices .......................................................................................................247
Viewing the Device Management Page ......................................................................................248
Configuring Device Management Properties ...........................................................................249
Updating a Device ...............................................................................................................................252
Removing a Device .............................................................................................................................252
Network Setup (Edge devices only) ..............................................................................................252
Adding a VPN Resource .....................................................................................................................253
Starting Firebox and Edge Tools ....................................................................................................253
VPN Tunnels ...........................................................................................................................................254
Using the Firebox X Edge Policy Section ....................................................................................254
CHAPTER 19 Firebox X Edge Templates and Aliases ................................................................255
Scheduling Firebox X Edge Firmware Updates ........................................................................255
Viewing and deleting firmware updates ......................................................................................257
xii WatchGuard System Manager
Creating and Applying Edge Configuration Templates .........................................................258
Adding a pre-defined policy with the Add Policy wizard ..........................................................259
Adding a custom policy with the Add Policy wizard ..................................................................259
Cloning an Edge Configuration Template ...................................................................................261
Applying an Edge Configuration Template to devices ..............................................................261
Using Aliases .........................................................................................................................................263
Naming aliases on the Management Server ...............................................................................263
Defining aliases on a Firebox X Edge ............................................................................................264
CHAPTER 20 Managed BOVPN Tunnels ..........................................................................................267
About Managed BOVPN Tunnels ...................................................................................................267
VPN Failover .......................................................................................................................................267
Global VPN settings ..........................................................................................................................268
VPN Resources and Templates ........................................................................................................268
Configuring a Firebox as a Managed Firebox Client ...............................................................268
Adding VPN Resources ......................................................................................................................268
Getting the current resources from a device ...............................................................................269
Creating a new VPN resource .........................................................................................................269
Adding more hosts or networks .....................................................................................................270
Adding Policy Templates ..................................................................................................................270
Adding Security Templates ..............................................................................................................271
Making Tunnels Between Devices .................................................................................................272
Editing a Tunnel ...................................................................................................................................273
Removing Tunnels and Devices .....................................................................................................273
Removing a tunnel ...........................................................................................................................273
Removing a device ...........................................................................................................................274
CHAPTER 21 Manual BOVPN Tunnels ...............................................................................................275
About Manual VPN Tunnels .............................................................................................................275
VPN and failover ...............................................................................................................................275
Global VPN settings ..........................................................................................................................275
Configuring Gateways .......................................................................................................................276
Defining the credential method ....................................................................................................277
Defining gateway endpoints ..........................................................................................................278
Configuring mode and transforms (Phase 1 settings) ..............................................................280
Adding a Phase 1 transform ...........................................................................................................281
Editing and deleting gateways ......................................................................................................282
Making Tunnels between Gateway Endpoints .........................................................................282
Configuring routes for the tunnel ..................................................................................................283
Adding new routes ...........................................................................................................................284
Configuring Phase 2 settings ..........................................................................................................284
Adding a Phase 2 proposal .............................................................................................................286
Editing and deleting a tunnel .........................................................................................................287
Changing order of tunnels ..............................................................................................................287
Making a Tunnel Policy ......................................................................................................................288
Setting up Outgoing Dynamic NAT through a BOVPN Tunnel ...........................................288
User Guide xiii
About VPN Failover .............................................................................................................................289
Configuring multiple gateway pairs .............................................................................................290
CHAPTER 22 Certificates and the Certificate Authority ..........................................................293
Certificates in a WatchGuard VPN ..................................................................................................293
Managing the Certificate Authority ..............................................................................................294
Managing certificates with the CA Manager ..............................................................................295
Managing Certificates from WSM ..................................................................................................296
Viewing, Requesting, and Importing Certificates ....................................................................297
Viewing current certificates ...........................................................................................................297
Removing a certificate .....................................................................................................................298
Requesting a certificate ...................................................................................................................298
Importing certificates ......................................................................................................................299
Retrieving the Certificate Revocation List (CRL) .......................................................................299
Retrieving the CRL from a file .........................................................................................................300
Retrieving the CRL from an LDAP server ......................................................................................300
CHAPTER 23 Remote User VPN with PPTP .....................................................................................301
Configuration Checklist .....................................................................................................................301
Encryption levels ...............................................................................................................................301
Configuring WINS and DNS Servers .............................................................................................302
Enabling RUVPN with PPTP ..............................................................................................................303
Enabling RADIUS authentication ..................................................................................................303
Setting encryption for PPTP tunnels .............................................................................................304
Adding IP Addresses for RUVPN Sessions ...................................................................................304
Adding New Users to the PPTP_Users Authentication Group ...........................................305
Configuring Policies to Allow Incoming RUVPN Traffic .........................................................306
By individual policy ..........................................................................................................................306
Using the Any policies ......................................................................................................................307
Preparing the Client Computers ....................................................................................................307
Installing MSDUN and service packs ............................................................................................307
Creating and Connecting a PPTP RUVPN on Windows XP ...................................................308
Creating and Connecting a PPTP RUVPN on Windows 2000 ...............................................308
Running RUVPN and Accessing the Internet .............................................................................309
Making outbound PPTP connections from behind a Firebox .............................................309
CHAPTER 24 WebBlocker ........................................................................................................................311
Installing the Software Licenses .....................................................................................................311
Getting Started with WebBlocker ..................................................................................................312
Automating WebBlocker database downloads .........................................................................313
Activating WebBlocker ......................................................................................................................313
Configuring WebBlocker ...................................................................................................................316
Adding new servers ..........................................................................................................................317
Selecting categories to block ..........................................................................................................317
Defining WebBlocker exceptions ...................................................................................................317
Defining advanced WebBlocker options ......................................................................................320
xiv WatchGuard System Manager
Defining Additional WebBlocker Actions ...................................................................................321
Adding WebBlocker Actions to a Policy ......................................................................................321
Scheduling WebBlocker Actions ....................................................................................................321
CHAPTER 25 spamBlocker ......................................................................................................................323
About spamBlocker ............................................................................................................................323
spamBlocker actions ........................................................................................................................323
spamBlocker tags .............................................................................................................................324
spamBlocker categories ..................................................................................................................324
Installing the Software License ......................................................................................................324
Activating spamBlocker ....................................................................................................................325
Configuring spamBlocker .................................................................................................................326
Adding spamBlocker exceptions ....................................................................................................328
Setting Global spamBlocker Parameters .....................................................................................329
Creating Rules for Bulk and Suspect Email on Email Clients ................................................330
Sending spam or bulk email to special folders in Outlook .......................................................330
Reporting False Positives and False Negatives .........................................................................330
Monitoring spamBlocker Activity ..................................................................................................331
Customizing spamBlocker Using Multiple Proxies ..................................................................331
CHAPTER 26 Signature-Based Security Services ........................................................................333
Installing the Software Licenses .....................................................................................................334
About Gateway AntiVirus .................................................................................................................334
Activating Gateway AntiVirus ........................................................................................................335
Configuring Gateway AntiVirus ......................................................................................................336
Creating alarms or log entries for antivirus responses ..............................................................337
Configuring GAV engine settings ...................................................................................................338
Configuring the update server .......................................................................................................338
Using Gateway AntiVirus with more than one proxy ................................................................339
Unlocking an attachment locked by Gateway AntiVirus ..........................................................339
Updating the antivirus software ....................................................................................................339
Activating Intrusion Prevention Service (IPS) ............................................................................339
Configuring Intrusion Prevention ..................................................................................................341
Configuring intrusion prevention for HTTP or TCP ....................................................................342
Configuring Intrusion Prevention for FTP, SMTP, or DNS ...........................................................344
Configuring the IPS update server .................................................................................................344
Configuring signature exceptions .................................................................................................344
Copying IPS settings to other policies ...........................................................................................345
Getting GAV/IPS Status and Updates ...........................................................................................345
Seeing service status ........................................................................................................................345
Updating signatures or engines manually ..................................................................................346
Viewing the update history .............................................................................................................347
CHAPTER 27 Dynamic Routing ............................................................................................................349
Routing Daemon Configuration Files ...........................................................................................349
Using RIP .................................................................................................................................................350
User Guide xv
RIP Version 1 .......................................................................................................................................350
RIP Version 2 .......................................................................................................................................353
Using OSPF .............................................................................................................................................355
OSPF daemon configuration ..........................................................................................................355
Configuring Fireware Pro to use OSPF ..........................................................................................358
Using BGP ...............................................................................................................................................359
CHAPTER 28 Traffic Management and Quality of Service .....................................................365
About Traffic Management and QoS ............................................................................................365
Guaranteeing bandwidth ...............................................................................................................365
Restricting bandwidth .....................................................................................................................366
Setting traffic priority .......................................................................................................................366
Configuring Outgoing Interface Bandwidth .............................................................................366
Guaranteeing Bandwidth for a Policy ..........................................................................................367
Applying the Traffic Management action to a policy ................................................................368
Using Traffic Management in a multi-WAN environment ........................................................368
Setting Connection and Bandwidth Limits ................................................................................369
About QoS Marking ............................................................................................................................369
Per-interface and per-policy ...........................................................................................................370
Marking types and values ...............................................................................................................370
Enabling QoS Marking for an interface ........................................................................................371
Enabling QoS Marking for a policy ...............................................................................................372
QoS Marking and IPSec traffic .......................................................................................................372
CHAPTER 29 High Availability ..............................................................................................................373
About WatchGuard High Availability ...........................................................................................373
High Availability Requirements ......................................................................................................374
Selecting a Primary High Availability Firebox ...........................................................................374
Configuring HA for Firebox X e-Series Devices .........................................................................374
Configuring the secondary High Availability Firebox ................................................................375
Enabling High Availability ..............................................................................................................375
Configuring HA for Firebox X (non e-Series) Devices .............................................................376
Manually Controlling High Availability ........................................................................................378
Backing up an HA configuration ...................................................................................................379
Upgrading Software in an HA Configuration ............................................................................379
Using HA with Signature-based Security Services ..................................................................379
Using HA with Proxy Sessions .........................................................................................................379
Using HA with Third-Party Certificates ........................................................................................380
APPENDIX A Copyright and Licensing .............................................................................................381
Licenses ...................................................................................................................................................387
SSL Licenses ........................................................................................................................................387
Apache Software License, Version 2.0, January 2004 ................................................................389
PCRE License ......................................................................................................................................391
GNU Lesser General Public License ................................................................................................392
GNU General Public License ............................................................................................................397
xvi WatchGuard System Manager
Sleepycat License ..............................................................................................................................400
Sourcefire License .............................................................................................................................401
Expat-MIT HTML Parser Toolkit License ........................................................................................405
Curl Software MIT-X License ............................................................................................................405
APPENDIX B WatchGuard File Locations .........................................................................................407
Default File Locations .........................................................................................................................408
APPENDIX C Types of Policies ...............................................................................................................411
Packet Filter Policies ...........................................................................................................................411
Any .......................................................................................................................................................411
archie ..................................................................................................................................................412
auth .....................................................................................................................................................412
BGP ......................................................................................................................................................412
Citrix ....................................................................................................................................................412
Clarent-Command ...........................................................................................................................413
Clarent-Gateway ..............................................................................................................................413
CU-SeeMe ...........................................................................................................................................413
DHCP-Server or DHCP-Client ..........................................................................................................414
DNS ......................................................................................................................................................414
Entrust .................................................................................................................................................414
finger ...................................................................................................................................................414
FTP .......................................................................................................................................................415
Gopher ................................................................................................................................................415
GRE ......................................................................................................................................................415
HBCI .....................................................................................................................................................415
HTTP ....................................................................................................................................................416
HTTPS ..................................................................................................................................................416
IDENT ...................................................................................................................................................416
IGMP ....................................................................................................................................................417
IKE ........................................................................................................................................................417
IMAP ....................................................................................................................................................417
IPSec ....................................................................................................................................................417
IRC ........................................................................................................................................................417
Intel Video Phone ..............................................................................................................................418
Kerberos v 4 and Kerberos v 5 .........................................................................................................418
L2TP .....................................................................................................................................................418
LDAP ....................................................................................................................................................418
LDAP-SSL ............................................................................................................................................418
Lotus Notes .........................................................................................................................................419
MS-SQL-Monitor ...............................................................................................................................419
MS-SQL-Server ...................................................................................................................................419
MS-Win-Media ..................................................................................................................................419
NetMeeting ........................................................................................................................................419
NFS .......................................................................................................................................................420
NNTP ....................................................................................................................................................420
NTP ......................................................................................................................................................420
OSPF ....................................................................................................................................................420
User Guide xvii
pcAnywhere .......................................................................................................................................421
Ping ......................................................................................................................................................421
POP2 and POP3 .................................................................................................................................421
PPTP .....................................................................................................................................................421
RADIUS and RADIUS-RFC ................................................................................................................422
RADIUS-Accounting and RADIUS-Acct-RFC ................................................................................422
RDP ......................................................................................................................................................422
RIP ........................................................................................................................................................423
RSH ......................................................................................................................................................423
RealPlayerG2 .....................................................................................................................................423
Rlogin ..................................................................................................................................................423
SecurID ................................................................................................................................................423
SMB (Windows Networking) ..........................................................................................................424
SMTP ....................................................................................................................................................424
SNMP ...................................................................................................................................................424
SNMP-Trap ..........................................................................................................................................424
SQL*Net ..............................................................................................................................................425
SQL-Server ..........................................................................................................................................425
SSH .......................................................................................................................................................425
SunRPC ................................................................................................................................................425
Syslog ..................................................................................................................................................426
TACACS ................................................................................................................................................426
TACACS+ .............................................................................................................................................426
TCP .......................................................................................................................................................426
TCP-UDP .............................................................................................................................................427
Telnet ...................................................................................................................................................427
Timbuktu ............................................................................................................................................427
Time .....................................................................................................................................................427
Traceroute ..........................................................................................................................................427
UDP ......................................................................................................................................................428
UUCP ...................................................................................................................................................428
WAIS ....................................................................................................................................................428
WinFrame ...........................................................................................................................................428
WG-Auth .............................................................................................................................................429
WG-Firebox-Mgmt ............................................................................................................................429
WG-Logging .......................................................................................................................................429
WG-Mgmt-Server ..............................................................................................................................429
WG-SmallOffice-Mgmt ....................................................................................................................429
WG-WebBlocker ................................................................................................................................430
WHOIS .................................................................................................................................................430
X11 .......................................................................................................................................................430
Proxied Policies .....................................................................................................................................430
DNS-proxy ..........................................................................................................................................431
FTP-proxy ...........................................................................................................................................431
HTTP-proxy ........................................................................................................................................431
SMTP-proxy ........................................................................................................................................431
TCP-proxy ...........................................................................................................................................432
xviii WatchGuard System Manager
User Guide 1
CHAPTER 1 Introduction
WatchGuard® System Manager gives you an easy and efficient way to manage your network security.
With one computer as a management station, you can view, manage, and monitor each Firebox® device
in your network.
The basic components of WatchGuard System Manager are the WatchGuard System Manager window,
and the three WSM server components. WatchGuard System Manager also provides access to other
WatchGuard tools, including Policy Manager and Firebox System Manager. The following diagram
shows the components of WatchGuard System Manager and how you can access and navigate among
them.
Components of WatchGuard System Manager
WatchGuard System Manager Tools
2 WatchGuard System Manager
WatchGuard System Manager Tools
When you purchase a WatchGuard® Firebox X Core or Peak, you get access to a full suite of management
and monitoring tools.
WatchGuard System Manager
WatchGuard System Manager (WSM) is your primary application for connecting to and managing
Firebox® devices and WatchGuard Management Servers. WSM supports mixed environments. You can
manage different Firebox devices that use different versions of software. You can also centrally manage
Firebox X Edge devices.
Policy Manager
Policy Manager is the user interface for firewall configuration tasks. Policy Manager includes a full set of
preconfigured packet filters and proxies. You can also make a custom packet filter in which you set the
ports, protocols, and other parameters. Other features of Policy Manager help you to stop attacks such
as SYN Flood attacks, spoofing attacks, and port or address space probes.
Firebox System Manager
Firebox System Manager gives you one interface to monitor all components of your Firebox. From Fire-
box System Manager, you can see the real-time status of the Firebox and its configuration.
About the WatchGuard System Manager Window
The WatchGuard® System Manager window has menus and icons you can use to start other tools, as
shown in the figure below.
The WatchGuard System Manager window also has two tabs that you can use to monitor and manage
your Firebox devices and environment: Device Status and Device Management.
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
Page is loading ...
/
