Watchguard QMS User guide

WatchGuard

®

QMS

v2.0 User Guide

ii WatchGuard QMS

ADDRESS

505 Fifth Avenue South

Suite 500

Seattle, WA 98104

SUPPORT

www.watchguard.com/support

U.S. and Canada +877.232.3531

All Other Countries +1.206.521.3575

SALES

U.S. and Canada +1.800.734.9905

All Other Countries +1.206.613.0895

ABOUT WATCHGUARD

WatchGuard offers affordable, all-in-one network and content security solutions that

provide defense-in-depth and help meet regulatory compliance requirements. The

WatchGuard XTM line combines firewall, VPN, GAV, IPS, spam blocking and URL

filtering to protect your network from spam, viruses, malware, and intrusions. The new

XCS line offers email and web content security combined with data loss prevention.

WatchGuard extensible solutions scale to offer right-sized security ranging from small

businesses to enterprises with 10,000+ employees. WatchGuard builds simple, reliable,

and robust security appliances featuring fast implementation and comprehensive

management and reporting tools. Enterprises throughout the world rely on our

signature red boxes to maximize security without sacrificing efficiency and

productivity.

For more information, please call 206.613.6600 or visit www.watchguard.com

.

Notice to Users

Information in this guide is subject to change without notice. Companies, names, and data used in examples herein are

fictitious unless otherwise noted. No part of this guide may be reproduced or transmitted in any form or by any means,

electronic or mechanical, for any purpose, without the express written permission of WatchGuard Technologies, Inc.

Document version: 1.1

Guide revision: May 6, 2013

Copyright, Trademark, and Patent Information

any, are the property of their respective owners.

Complete copyright, trademark, patent, and licensing information can be found in the Copyright and Licensing Guide,

available online:

http://www.watchguard.com/help/documentation/

This product is for indoor use only.

User Guide iii

Table of Contents

Chapter 1 About the WatchGuard QMS .................................................................................................... 1

WatchGuard QMS Overview .............................................................................................................................. 1

User Accounts .................................................................................................................................................... 2

Spam Digest Notifications ............................................................................................................................. 2

Spam Digest Templates.................................................................................................................................. 2

Language Support............................................................................................................................................ 3

Policies .................................................................................................................................................................. 3

Trusted and Blocked Senders Lists ............................................................................................................. 3

Internal Deployment ....................................................................................................................................... 4

Network Firewall Configuration .................................................................................................................. 5

Chapter 2 System Administration ............................................................................................................. 7

Connect to the WatchGuard QMS ................................................................................................................... 7

Main Menu ............................................................................................................................................................... 8

Activity .................................................................................................................................................................. 8

Configuration ..................................................................................................................................................... 8

Support............................................................................................................................................................... 10

Console Activity Screen ................................................................................................................................ 11

Admin Menu ................................................................................................................................................ 11

Repair Menu................................................................................................................................................. 12

Misc Menu..................................................................................................................................................... 12

Configure the Admin User................................................................................................................................ 13

CRYPTOCard................................................................................................................................................. 15

SafeWord....................................................................................................................................................... 15

SecurID........................................................................................................................................................... 15

Add Additional Administrative Users ...................................................................................................... 16

Log in with Tiered Admin Privileges ........................................................................................................ 18

Admin Automatic Logout ............................................................................................................................ 18

Admin Login Lockout.................................................................................................................................... 18

External Proxy Server.......................................................................................................................................... 20

Chapter 3 Network and Mail Settings ..................................................................................................... 23

Network Configuration...................................................................................................................................... 23

Network Interface Configuration .............................................................................................................. 24

Advanced Parameters ................................................................................................................................... 25

Support Access ................................................................................................................................................ 25

Default Mail Relay ........................................................................................................................................... 28

iv WatchGuard QMS

Delivery Settings ............................................................................................................................................. 28

Default Mail Relay ...................................................................................................................................... 29

Failback Mail Relay..................................................................................................................................... 29

Delivery Failure and Delay Warnings.................................................................................................. 30

Advanced Mail Delivery Options............................................................................................................... 32

SMTP Notification ...................................................................................................................................... 33

Received Header......................................................................................................................................... 34

Queue Monitoring .......................................................................................................................................... 35

Upload Alias Lists ............................................................................................................................................ 36

Chapter 4 User Accounts .......................................................................................................................... 37

Create User Accounts ......................................................................................................................................... 37

LDAP User Accounts ........................................................................................................................................... 41

Define Directory Servers............................................................................................................................... 41

Import Settings ........................................................................................................................................... 44

Mirror LDAP Accounts as Local Users ................................................................................................. 44

Remote Authentication ..................................................................................................................................... 47

Configure LDAP Remote Authentication ............................................................................................... 47

Chapter 5 WatchGuard XCS Configuration ............................................................................................ 49

Add Mail Routes for the WatchGuard QMS ................................................................................................ 49

Chapter 6 WatchGuard QMS Configuration ........................................................................................... 53

WatchGuard QMS Configuration ................................................................................................................... 53

Additional Quarantine Functions.............................................................................................................. 55

Template Text................................................................................................................................................... 57

Spam Digest Subject and From Fields................................................................................................ 57

Conditional Text ......................................................................................................................................... 58

Template Variables.................................................................................................................................... 59

Action URL Variables................................................................................................................................. 60

Date and Time Formats............................................................................................................................ 61

Upload Trusted and Blocked Senders Lists ........................................................................................... 64

Trusted and Blocked Sender List Downloads ....................................................................................... 64

Language Editor................................................................................................................................................... 65

Chapter 7 User Quarantine Settings ....................................................................................................... 69

Enable User Quarantine Access...................................................................................................................... 69

Spam Quarantine............................................................................................................................................ 70

Quarantine Settings ....................................................................................................................................... 71

Change Password ........................................................................................................................................... 72

Administrative Links ...................................................................................................................................... 73

Chapter 8 Policies ..................................................................................................................................... 75

Policy Overview.................................................................................................................................................... 75

Policy Hierarchy ............................................................................................................................................... 75

Configure Policies ........................................................................................................................................... 76

Domain Policies.................................................................................................................................................... 78

Re-order Groups .............................................................................................................................................. 81

Assign Group Policies.................................................................................................................................... 82

Upload Group Policy Lists............................................................................................................................ 82

Orphaned Groups ........................................................................................................................................... 82

Upload and Download User Address Lists............................................................................................. 83

Chapter 9 System Management .............................................................................................................. 85

Backup and Restore ............................................................................................................................................ 85

User Guide v

Backup File Name ........................................................................................................................................... 85

Start a Backup................................................................................................................................................... 86

FTP Backup Options .................................................................................................................................. 86

SCP Backup Options.................................................................................................................................. 87

Restore from Backup...................................................................................................................................... 88

FTP Restore Options.................................................................................................................................. 88

Restore from SCP........................................................................................................................................ 89

Backup and Restore Errors........................................................................................................................... 90

Get a Feature Key from LiveSecurity ........................................................................................................ 92

Add a Feature Key........................................................................................................................................... 93

Update a Feature Key .................................................................................................................................... 94

Reboot and Shutdown....................................................................................................................................... 95

Chapter 10 Reports and Logs ...................................................................................................................101

Reports.................................................................................................................................................................. 101

Create Reports............................................................................................................................................... 102

Configure Reports........................................................................................................................................ 104

Search the System Log Messages .......................................................................................................... 108

All WatchGuard QMS Log Files .................................................................................................................... 109

Previous Searches............................................................................................................................................. 110

Log Search Configuration ......................................................................................................................... 112

Chapter 11 System Status and Monitoring ............................................................................................. 115

Dashboard........................................................................................................................................................... 115

Recent Mail Activity..................................................................................................................................... 116

System Status ................................................................................................................................................ 117

Utility Functions ........................................................................................................................................... 117

Diagnostics..................................................................................................................................................... 118

Hostname Lookup .................................................................................................................................. 118

SMTP Probe ............................................................................................................................................... 119

Ping Utility ................................................................................................................................................. 120

Current Admin and WebMail Users .................................................................................................. 121

Configuration Information .................................................................................................................. 121

Email History Search ................................................................................................................................... 126

Advanced Search ......................................................................................................................................... 126

Configure SNMP ........................................................................................................................................... 130

Permitted Clients.......................................................................................................................................... 131

MIB Files........................................................................................................................................................... 132

Configure Alarms ......................................................................................................................................... 134

vi WatchGuard QMS

User Guide 1

1

About the WatchGuard QMS

WatchGuard QMS Overview

The WatchGuard QMS device enables spam messages from the WatchGuard XCS to be directed to a local

quarantine area that provides spam storage for each individual user. Because spam filters occasionally result

in false positives (legitimate email classified as spam), spam quarantine gives end users the ability to manage

their quarantined message. They can identify and release any false positives and delete actual spam messages.

The WatchGuard QMS offloads spam quarantine resources to a separate system to relieve processing and disk

space on the primary WatchGuard XCS system or cluster.

When integrated with the WatchGuard XCS, the Intercept Anti-Spam engine redirects messages for a specific

spam classification to the WatchGuard QMS. For example, messages in the Probably Spam category can be

quarantined to allow users to review them at a later time and either delete them or release them to their inbox.

About the WatchGuard QMS

2 WatchGuard QMS

Spam digest notifications are sent periodically to end users. End users can then review, delete, and release

mail, or add a sender to their trusted or blocked senders list. End users can log in to the WatchGuard QMS to

manage their specific quarantine settings, select the language template for their spam digest message, and

manage their trusted and blocked senders lists. The WatchGuard QMS supports organizations with both

single and multiple domains.

User Accounts

The WatchGuard QMS requires a user account for each user to store their quarantined spam messages.

There are three ways to add accounts to the WatchGuard QMS:

 Manual creation of Local Accounts — Administrators can manually add each local user account or

use uploaded lists. This method is recommended only for small deployments with a manageable

number of users.

 Automatic creation of Local Accounts — If the WatchGuard QMS receives a message to be

quarantined and that user account does not already exist, the WatchGuard QMS can automatically

create a local account based on the email address of a recipient. This method is recommended for

organizations that do not use LDAP directory services or organizations that support multiple

independent domains.

 LDAP Import of User Accounts — User account information can be imported from an LDAP directory

and the accounts mirrored locally on the WatchGuard QMS. Remote authentication can be enabled to

authenticate users with the LDAP directory server when they log in to the WatchGuard QMS.

Spam Digest Notifications

The spam digest is a notification sent out from the WatchGuard QMS to each user. It identifies how many

messages are currently in the spam quarantine area for that user, and displays the message headers of each

message (such as the Sender and Subject fields) for the user to review. With the spam digest message, users

do not have to log in to the WatchGuard QMS to manage the spam in their quarantine area.

From the links in the spam digest message, users can perform any of these tasks:

 View — Displays the contents of a message.

 Not Spam — Delivers a message to the inbox and adds the sender to the trusted senders list for that

user.

 Delete — Deletes the message from the quarantine.

 Delete All — Deletes all the spam messages shown in the digest message. This link is located at the

end of the digest.

 Block — Adds the sender to the blocked senders list for that user.

Spam Digest Templates

Administrators can customize the templates for the spam digest message. Administrators can apply separate

spam digest templates for different domains or users with the policy feature of the WatchGuard QMS.

The templates are also used to create spam digest messages in different languages. The templates are in

HTML-like format. They include several customized variables and controls to provide a default template of the

content that is sent to end users as part of the spam digest message.

The user cannot log in to this account until the administrator assigns a password for the account,

or configures the system to automatically generate a password for the user.

User Guide 3

About the WatchGuard QMS

Language Support

The WatchGuard QMS provides support for several different languages for use with the spam digest

notification message. Users can specify the language in which they prefer to receive the spam digest. With

policies, administrators can apply separate language templates for different domains and users.

The default templates offer these languages:

 Danish

 English

 Finnish

 French

 German

 Italian

 Japanese

 Norwegian

 Spanish

 Swedish

Policies

Powerful policy features enable administrators to create spam quarantine policies for multiple domains or

users. System settings, such as expiry times, disk space quotas, and spam digest message templates, can be

applied to different domains and users. For example, some users can have different disk quotas set depending

on how much spam they receive. Spam summary templates can be customized for different domains and

include support for multiple languages.

Trusted and Blocked Senders Lists

With the Trusted Senders List, end users can add specific email addresses that are trusted for Anti-Spam

processing purposes. With the Blocked Senders List, end users can specify a list of addresses from which they

do not want to receive mail. These senders are blocked and cannot send mail to that specific user through the

WatchGuard XCS. If a sender is on the blocked senders list, the message can either be rejected with

notification or discarded by the WatchGuard XCS.

End users can log in to the WatchGuard QMS and create their own list of trusted and blocked senders. These

lists can be imported by the WatchGuard XCS to provide a global trusted and blocked senders list that is used

when the WatchGuard XCS processes new mail.

The trusted and blocked senders list on the WatchGuard QMS must be imported to the WatchGuard

XCS system used with the WatchGuard QMS. The lists are applied as the message arrives on the

WatchGuard XCS.

About the WatchGuard QMS

4 WatchGuard QMS

WatchGuard QMS Deployment

There are two primary ways that theWatchGuard QMS can be deployed: as an internal deployment or as a

hosted deployment.

Internal Deployment

With a basic internal deployment, the WatchGuard QMS is installed on the same network as the WatchGuard

XCS. Incoming mail is processed by the WatchGuard XCS and any spam to be quarantined is redirected from

the WatchGuard XCS to the WatchGuard QMS. Spam digest notifications and released messages from the

quarantine are delivered through the WatchGuard XCS to the internal mail servers, where they are received

by the end user. End users can log in to the WatchGuard QMS to manage their specific quarantine settings,

select the language template for their spam digest message, and manage their trusted and blocked senders

lists.

User Guide 5

About the WatchGuard QMS

Hosted Deployment

With a hosted service deployment, the WatchGuard QMS is deployed at the same location as the WatchGuard

XCS and is accessible to external hosted servers and users. The WatchGuard QMS must supports multiple

domains because the WatchGuard XCS processes and routes all mail to the recipient domain email servers.

Network Firewall Configuration

For the WatchGuard QMS to process messages effectively when located behind a network firewall, various

networking ports must be configured on the network firewall.

This table describes the list of ports required for each service. If you do not use some of the features shown in

the table, the corresponding ports can remain closed:

Port Description From

Internet

To

Internet

From

Internal

Network

To

Internal

Network

Protocol

21 FTP for System

Backups

XTCP

22 SCP (Backup or

Offload)

X TCP

25 SMTP (standard port

for sending and

receiving of mail)

XXX XTCP

53 DNS queries X X TCP/UDP

80 Web Mail Access X X TCP

123 Network Time

Protocol (NTP)

X X UDP

389 LDAP X TCP

443 Software Updates X TCP

443 Secure Web Mail

Access

XX TCP

About the WatchGuard QMS

6 WatchGuard QMS

443 Web UI connections X X TCP

514 Syslog X UDP

636 LDAPS X TCP

1812 RADIUS Server X UDP

10101 Support Access X X TCP

Port Description From

Internet

To

Internet

From

Internal

Network

To

Internal

Network

Protocol

User Guide 7

2

System Administration

Connect to the WatchGuard QMS

You can use these web browsers to connect to the Web UI:

 Internet Explorer 7, 8, and 9 (Windows XP, Windows 2000, Windows 2003, Windows Vista, Windows 7)

 Firefox 3 and greater (Windows, Linux, Mac)

Make sure your screen resolution is set to a minimum of 1024x768.

To administer the WatchGuard QMS with the Web UI:

1. Open a web browser and go to the IP address of the WatchGuard QMS.

For example,

http://10.0.1.20

The login page appears.

2. Type the default Username and Password.

When you connect to the system for the first time after installation, the default settings are:

 Username — admin

 Password — admin

A security certificate notification appears in the browser because the system uses a self-signed

certificate. You can safely ignore the warning (Internet Explorer) or add a certificate exception

(Mozilla Firefox).

System Administration

8 WatchGuard QMS

Main Menu

The main menu has these main categories:

Activity

The Activity menu provides a variety of information on system status and activity. It includes the main

Dashboard, message history, mail queue and quarantine management, and reports and log messages. This

menu includes these features:

Status

 Dashboard

 Status & Utility

 Alarms

 Mail Queue

History

 Message History

 System History

 Manage Quarantine

Reports

 Schedule

 View

Logs

 Mail

 System

 Previous Searches

 All

Configuration

From the Configuration menu, you can configure many system settings.

Network

The Network menu enables you to configure items related to the system networking features:

 Interfaces

 Static Routes

 Web Server

 External Proxy Server

 SNMP

User Guide 9

System Administration

Mail

The Mail menu enables you to configure features related to mail processing and delivery:

 Access

 Delivery

 Aliases

Quarantine

The Quarantine menu enables you to configure the User Spam Quarantine features:

 User Spam Quarantine

 Trusted/Block Senders

 Spam Digest Templates

 Language Editor

Policies

The Policies menu enables you to configure system policies:

 Policies

 User Policy

 Group Policy

 Domain Policy

 Diagnostics

Miscellaneous

The Miscellaneous menu enables you to configure the general settings of various features:

 Logs

 Customization

 Alarms

 Reports

System Administration

10 WatchGuard QMS

Administration

The Administration menu includes options you can use to manage the WatchGuard QMS, such as user

account administration, backup and restore, software updates, and feature key management. This menu

includes these features:

Accounts

The User Accounts menu enables you to configure local user accounts and authentication:

 Administrator

 Local Accounts

 Mirror Accounts

 Remote Authentication

 SecurID

Directory Servers

The Directory Servers menu enables you to configure your Directory Services and related features

that rely on LDAP:

 Servers

 Users

 Aliases

Backup/Restore

The Backup/Restore menu enables you to back up and restore the system configuration and data:

 Backup & Restore

 Daily Backup

Software Updates

The Software Updates menu enables you to manage system software updates and the Security

Connection:

 Updates

 Security Connection

System

The System menu includes other system administrative settings, such as feature key and system

certificates:

 Feature Key

 SSL Certificates

 Reboot & Shutdown

Support

The Support menu offers several options for you to obtain additional support for the product.

This menu includes these features:

 Technical Support

 Problem Reporting

 Online Manual

 Online Access (main WatchGuard web site)

User Guide 11

System Administration

System Console

The system console supports a limited subset of administrative tasks and we recommend you use it only for

initial installation and network troubleshooting. Use the Web UI for routine administration of your

WatchGuard QMS.

When you access the console for the first time after installation, the default login credentials are admin for the

UserID, and admin for the Password. The password can be changed from the browser administration

interface.

Console Activity Screen

The console activity screen provides you with basic activity and statistics information for this system.

Press any key to log in to the console with the admin login credentials.

Admin Menu

The Admin menu contains these options:

 Exit — Exits the console.

 Hardware Information — Displays the processor type, available memory, and network interface

information.

 Configure Interfaces — Enables you to modify the host and domain name, IP address, Gateway, DNS

and NTP servers for all network interfaces.

 Security Connection — Enables automatic software updates.

 Shutdown — Shuts down the system.

 Reboot — Shuts down and restarts the system.

System Administration

12 WatchGuard QMS

Diagnostics Menu

The Diagnostics menu contains these options:

 Activity Display — Displays CPU use, network traffic and mail message activity.

 Ping — Enables you to test network connectivity to other systems with the ping utility. You can use an

IP address or host name.

 Traceroute — Displays the routing steps between the system and a destination computer.

 Reset Network Interface — Resets network interfaces. This feature is useful to correct connection

issues.

 Display Disk Usage — Displays the amount of used and available disk space.

 Display System Processes — Displays information about processes that run on the system.

Repair Menu

The Repair menu contains these options:

 Reset SSL Certificates — Sets certificate information back to the factory defaults. Any uploaded

certificates or private keys are deleted.

 Delete Strong Authentication for Admin — Removes strong authentication for the admin user login

so you can use the console password.

Misc Menu

The Misc (Miscellaneous) menu contains these options:

 Set Time and Date — Sets the time and date for the system.

 Set Time Zone — Sets your local time zone settings.

 Configure UPS — Enables you to configure the link to an Uninterruptible Power Supply (UPS) for

automatic shutdown in the event of a power failure. A UPS keeps a system running for several minutes

after a power outage, enabling the system to shut down gracefully. The signal is sent through a serial

COM port on the WatchGuard QMS that is connected to the UPS.

 UPS Protocol — Select the protocol to use to communicate with the UPS.

 Enable UPS Monitor — Select Yes to enable the UPS monitor. When this option is enabled, the

WatchGuard QMS detects alarms from the UPS that it is running on battery and begins a graceful

shutdown of the WatchGuard QMS. If this is set to No the system is not automatically shut down,

and should be manually shut down before the UPS battery power is exhausted.

 UPS Interface Port — Select the serial COM port on the WatchGuard QMS that is connected to the

UPS.

 Shutdown Interval — Enter the number of minutes (0-30) to wait before the WatchGuard QMS is

automatically shut down.

 Configure Web Admin — Modify the ports used to get access to the system web browser

administration interface.

The system only supports APC type UPS systems.

User Guide 13

System Administration

 Configure Serial Console — Enables you to configure a serial port for when you want to use the

console over a serial connection. You must set your terminal program to these values to use the serial

console:

 VT100 Emulation

 Baud Rate: 9600

 Data Bits: 8

 Parity: None

 Stop Bits: 1

 Flow Control: Hardware

Configure the Admin User

The primary admin account is created automatically during installation. To modify the password or strong

authentication settings for the admin user:

1. Select Administration > Accounts > Administrator.

2. In the User ID field, you can see and modify the current admin user name.

The admin user name cannot be deleted, but the account name can be modified. This helps prevent

attempts to compromise the primary admin user name because it enables the administrator to use a

non-standard user name. We recommend that you create additional admin users and use those

accounts to manage the system instead of the primary admin account. It is a good idea to write down

the primary admin account password and keep it in a safe place.

3. In the Forward email to: text box, enter an optional email address to forward mail to from this

account.

4. Type and confirm a Password for the admin user.

System Administration

14 WatchGuard QMS

5. From the Strong Authentication drop-down list, select an optional strong authentication method for

the admin user.

Strong authentication methods require a hardware token that provides a response to the login

challenge. You can choose from these types of secure authentication tokens:

 CRYPTOCard

 SafeWord

 SecurID

A configuration wizard guides you through the steps to configure the token for the specified

authentication method.

6. In the IP Access Control List (ACL) option, click Edit to enter a list of IP addresses or networks that are

allowed admin access to this system.

 Type a specific IP address such as

192.168.1.250, or for a network address use 192.168.1.0 for

the entire 192.168.1.0/24 network.

 Click Add.

 Admin access must also be enabled on a network interface (with Configuration > Network

>Interfaces), in addition to the ACL access. Keep the IP access list undefined to restrict admin

access only through the network interface option.

7. From the Password Enforcement drop-down list, select an enforcement method for user and admin

passwords.

 Unrestricted — Allows any type of password for the admin account and user accounts. This is the

default setting that is used after the initial system installation.

 Strong — Requires passwords for both admin accounts and user accounts to be at least 6

characters in length and include a mix of alphabetic and non-alphabetic characters.

8. Click Add User.

After you enable strong passwords, any existing or uploaded user accounts and passwords that do

not have a strong password do not have the restrictions enforced until the next time the passwords

are modified.

Page is loading ...

Watchguard QMS User guide

Related papers

Other documents